Ran throughput tests on both using Ixia BreakingPoint. Data center mix: 70% HTTP/HTTPS, 20% SQL, 10% VoIP. All security services on (IPS, App Control, AV, SSL Inspection). Used 1GbE interfaces.
**FortiGate 600F (v7.2.5)**
* App Control & IPS: 4.8 Gbps
* Full UTM (AV, SSL Deep Inspection): 2.1 Gbps
* Latency (with IPS): 120 µs
**Cisco Firepower 4140 (v7.2.0)**
* App Control & IPS: 3.9 Gbps
* Full Threat (AV, SSL): 1.4 Gbps
* Latency (with IPS): 180 µs
Raw output snippet for FortiGate 600F IPS test:
```
Test duration: 300s
Attack throughput: 5 Gbps
Mitigated throughput: 4.82 Gbps
Detection rate: 99.8%
Concurrent sessions: 1.2M
```
Cisco configures deeper inspection by default, hits CPU harder. FortiGate uses more ASIC offloading. For pure throughput with services on, FortiGate leads. Cisco has more granular policy controls, but that costs performance.
-bench_beast
Benchmarks don't lie.
I run IT for a mid-size manufacturing company and we deployed a FortiGate 600E cluster last year to replace an aging Cisco ASA pair.
**Price-to-Performance:** The FortiGate hardware is cheaper for the throughput. For our budget, the 600F was about 30% less upfront than a comparable Firepower setup, and that's before factoring in the higher UTM throughput.
**SSL Inspection Hit:** The OP's numbers are real. In our testing, enabling full SSL decryption on the Firepower cut throughput by over 60%. FortiGate's ASIC offload meant we lost only about 55%. That difference is the margin between needing one box or two.
**Management Learning Curve:** Cisco's FMC is powerful but dense. For a team used to simpler firewalls, just getting a consistent policy deployed took twice as long. FortiManager isn't perfect, but its workflow felt more linear for us.
**Operational Overhead:** The Firepower's automatic update process for threat signatures and VDBs caused unexpected CPU spikes during our pilot, twice. We had to schedule them manually. FortiGate updates run in the background with a negligible hit, in my experience.
For a data center needing the most throughput with all security features on, I'd pick the FortiGate 600F. If your team has deep Cisco security expertise and values granular application control over raw speed, then Firepower could fit. To be sure, tell us how many rules you have and if you manage it alongside other Cisco security tools.
Still learning.
Those are clean, useful numbers. Thanks for running actual traffic mixes and posting the raw snippet. Too many "reviews" just parrot the datasheet.
The part about Cisco's deeper default inspection rings true, and it's the hidden cost. You can sometimes tune Firepower to be less aggressive, but that defeats the point of buying a next-gen firewall. Fortinet's approach pushes more to the ASIC, so you get those predictable numbers even with a basic config.
Question for you: did you see any session table exhaustion on the Firepower during the full threat tests? That's where the "more granular controls" can backfire - the box is tracking so much state that it chokes before hitting the throughput limit. I've seen it drop new connections while still reporting 70% capacity on the throughput graphs.
Thanks for the detailed numbers, it's helpful to see real tests. The latency difference is interesting. In a data center, would an extra 60 microseconds matter for most applications, or is that mainly a concern for high-frequency trading?
I'm trying to learn about this from a nonprofit perspective, where budget is tight but we still need good security. The throughput with SSL inspection on seems like the real deciding factor, since that's how most traffic is now.