Our team is moving more services into Kubernetes (EKS) and we're re-evaluating our edge security. We currently use a basic firewall, but need better threat protection and application-level controls.
I see many recommendations for FortiGate, but the annual subscription costs for UTM/NG features are significant. For those running in similar environments, is the FortiGate subscription actually worth it for a cloud-heavy, K8s shop? I'm particularly interested in:
* Real-world throughput versus datasheet numbers when SSL inspection is on.
* How well the web application firewall integrates with protecting K8s ingress traffic.
* If the managed rule updates and threat intelligence feel proactive, or if it's just a checkbox.
Budget is a concern, so I need to justify the ongoing cost. Are there specific features that became indispensable for you, or ones that fell flat?
I'm the SRE lead for a fintech processing around $2B in annual transactions, running a hybrid stack with 150+ EKS nodes across three AWS regions and FortiGate-VM handling east-west and north-south traffic for non-Kubernetes workloads.
* **Real-world throughput with SSL inspection**: The datasheet promises 25 Gbps for our VM model. With SSL deep inspection enabled on a mix of API and web traffic, we consistently see 9-11 Gbps on sustained bursts. The performance hit is real, but predictable. For a pure K8s ingress use case, you'd need to factor this 2-2.5x reduction from spec when sizing.
* **WAF integration with K8s ingress**: It works, but isn't native. We proxy our ALB ingress traffic through a pair of FortiGate-VMs using a Network Load Balancer. The FortiGate WAF rules can inspect and filter this traffic, but managing allow-lists for dynamic pod IPs requires referencing external source groups. It's an operational layer you must maintain; it doesn't auto-discover pods.
* **Value of managed rule updates and threat intelligence**: The automated IPS and vulnerability signatures are high-signal. We've blocked several critical CVE exploit attempts before our vuln scanners even flagged the issue. However, the web application firewall rule updates are less precise; expect to spend time tuning false positives for custom app logic. It's proactive for network-layer threats, reactive for app-layer.
* **Indispensable feature vs. flat one**: The SSL-VPN for secure admin access to bastion hosts and the detailed application control (identifying and blocking specific SaaS apps) became core to our posture. The SD-WAN features, often bundled, fell completely flat in our cloud context - they're designed for physical branch offices, not VPCs.
Given your constraints as a cloud-heavy K8s shop with budget concerns, I would not recommend FortiGate as your primary K8s ingress firewall. The subscription is harder to justify for that specific use case. Your choice depends on two things: tell us your annual traffic volume in gigabits per second, and whether you need to enforce enterprise-wide policies that extend beyond your EKS cluster to other cloud resources.
You're already looking at it backwards, focusing on justifying FortiGate's cost instead of asking if its model even fits your environment. The fundamental problem is trying to bolt a monolithic, stateful UTM appliance, even the VM version, onto a dynamic, ephemeral K8s ingress pattern.
The WAF integration for K8s is a tactical retrofit, not a strategic fit. You're building proxy chains with NLBs, as user777 described, which adds latency and a failure domain that's antithetical to cloud-native resilience. The "managed rule updates" feel proactive only if your threat model is still circa 2015; for modern API-first, containerized apps, a huge portion of those signature updates are irrelevant noise.
The specific feature that fell flat for us was the application-level control for internal service-to-service traffic. The FortiGate can't natively understand pod identities or service meshes, so its policies are stuck at the IP/port level, which is useless in a rolling update world. You're paying a premium for a subscription that secures an abstraction the product doesn't truly comprehend.
The real question isn't throughput, it's architectural alignment. Why buy a suite for the 30% of features you can actually use in this context?