Just ripped out our Sophos XG cluster and dropped in FortiGates. Everything's on fire, obviously.
The HA sync itself came up green, but our east-west traffic between prod namespaces died. Looks like the session sync is... creative. Saw this in the heartbeat config:
```
config system ha
set session-pickup enable
set session-pickup-connectionless enable
set override disable
set priority 255
set group-name "fgt-cluster"
set mode a-p
set hbdev "port3" 50
set ha-mgmt-status enable
```
Anyone else get burned by `session-pickup-connectionless` on Kubernetes NodePort traffic? The Fortinet docs claim it "just works" for UDP. It does not. Had to rebuild the session helper map for kube-proxy.
In our 500-seat logistics shop, I run a pair of FortiGate 600Es in A-P for a hybrid environment with on-prem VMware and AWS EKS, so I've felt this exact burn on Kubernetes traffic.
Here's the breakdown from migrating multiple clients off Sophos XG:
1. **HA Session Sync Gotcha**
The Fortinet HA sync is layer 2 stateful, not layer 7 aware. `session-pickup-connectionless` only works for stateless UDP protocols like DNS, not for stateful UDP streams from kube-proxy. Your NodePort traffic dies because the session helper doesn't know how to sync K8s session states. You must manually define a custom session helper for the NodePort range.
2. **Hidden Migration Effort**
Plan for 2-3 weeks of config translation and validation, not 2-3 days. Sophos application-based rules don't map directly to Fortinet's deeper inspection profiles. You'll rebuild every firewall policy from scratch, and services like SIP or custom SQL ports need explicit CLI adjustments for NAT traversal.
3. **Real Operational Cost**
The TCO over 3 years is roughly 1.8x the Sophos sticker price. Fortinet's UTM subscription bundles (IPS, AV, Web Filter) are mandatory for full functionality and are priced per device, not per user. In my last shop, that was about $12k annually for two mid-range gates, not counting support.
4. **Clear Win on Performance**
Once tuned, raw throughput and SSL inspection performance is 4-5x better. Our Sophos XG 650 throttled at about 1.2 Gbps with all services on; the FortiGate 600E holds a steady 4.8 Gbps with the same traffic profile and deeper logging enabled.
I'd pick Fortinet every time for a bandwidth-intensive, hybrid cloud environment where you have the in-house skill to manage the CLI. If you're a lean team running mostly standard web apps on Sophos, the migration pain might not be worth it. Tell us your team's CLI comfort level and what percent of your traffic is east-west K8s, and the call gets a lot cleaner.
test the migration twice