Hey folks, been lurking here for a bit but finally have something substantial to share. As someone who lives and breathes automation pipelines, my network's stability and programmability are non-negotiable. I ran a heavily customized pfSense box for years—Ansible playbooks for config, custom scripts for service checks, the whole nine yards. The flexibility was fantastic for my CI/CD tinkering, but the maintenance overhead started eating into my actual dev work.
So, five months ago, I took the plunge and replaced it with a FortiGate 60F for my homelab and staging environment gateways. Wanted to see if the "enterprise" experience could streamline things. Here's my deep dive, from a pipeline-obsessed perspective.
**The Good – Where FortiGate Shines for DevOps Workflows:**
* **Centralized Management & API-First (Kinda):** Having a single-pane-of-glass for firewall policies, VPN, and SD-WAN is a game-changer for replicating environments. The REST API is fairly comprehensive, which means I can (and did) integrate it into my infrastructure-as-code stack.
* Example: I built a GitHub Actions workflow that pushes new firewall object groups to the FortiGate whenever a Terraform module for a new microservice is merged. No more manual updates!
```yaml
# Snippet from my GitHub Actions workflow for object updates
- name: Update FortiGate Address Object
run: |
curl -k -X POST "https://${{ secrets.FGT_IP }}/api/v2/cmdb/firewall/address"
-H "Authorization: Bearer ${{ secrets.FGT_TOKEN }}"
-H "Content-Type: application/json"
-d '{"json": {"name": "svc-payment-${GITHUB_SHA:0:8}", "subnet": "${{ steps.tf.outputs.new_cidr }}", "type": "ipmask"}}'
```
* **Performance & Security Fabric Integration:** The throughput with all UTM features enabled is insane compared to my old setup. More importantly, the built-in vulnerability scanning and integration with FortiAnalyzer (I'm trialing it) means I can pipe security findings directly into my monitoring dashboards. It's like having a security scanner stage in my pipeline, but for the entire network traffic.
* **SD-WAN for Redundant CI/CD Nodes:** I have two ISP links. Configuring SD-WAN rules to route my GitLab runner traffic over the lower-latency link, while pushing docker pulls to the higher-bandwidth one, was remarkably straightforward. This improved my pipeline execution times noticeably.
**The Not-So-Good – Where I Miss pfSense:**
* **The CLI is... different.** I'm a `pfctl` and FreeBSD jails guy at heart. FortiOS CLI feels like its own universe. It's powerful, but the learning curve was steep. I still sometimes have to flip to the GUI to find where a specific setting is buried, which breaks my pure CLI/API flow.
* **Template Flexibility (or lack thereof):** In pfSense, I could treat the entire config as an XML file to be managed by Ansible. FortiGate's config is more hierarchical and has some stateful nuances. My attempts at full-blown configuration-as-code have been limited to specific API endpoints, not the entire box. This feels like a step back in terms of idempotent automation.
* **Cost of the Ecosystem:** The hardware is one thing, but to really unlock the DevOps potential (like proper logs to a SIEM or detailed traffic analytics), you're looking at FortiAnalyzer/FortiManager licenses. The price jump for that integrated visibility is significant for a homelab.
**Verdict:**
The FortiGate 60F is a beast. For raw performance, consolidated security features, and reliable SD-WAN, it's a clear winner. It has made my network layer more "set and forget," which is valuable.
However, from a pure *automation and tinkering* standpoint, I feel a bit more boxed in. The API is good for *interacting* with the device, but pfSense felt more like a *malleable platform* I could completely reshape with code. I'm still working on bridging that gap—maybe with a custom Terraform provider.
Would I go back? Not right now. The performance uplift and security integration are too compelling. But I do spend an inordinate amount of time thinking about how to make its configuration truly declarative. Anyone else tackling this? How are you baking your FortiGates into your CI/CD pipelines for network infrastructure?
pipeline all the things
Agree on the API being useful, but watch out for TCO beyond the sticker price. That 60F needs an active support contract for firmware updates and threat intelligence. That's a yearly recurring cost you didn't have with pfSense.
The centralized management is great until you want to do something outside Fortinet's predefined workflow. Their API is comprehensive, but it's also opinionated. Try scripting a complex, non-standard NAT rule and you'll feel the box walls.
Have you factored the license costs into your IaC pipeline? A renewal can creep up on you.
Exactly. The license cost doesn't just creep, it's designed to. Their whole model is getting the box in the door cheap, then charging rent for security you thought you bought.
You can't even script around it properly. That API lock-in is the real wall.
Your stack is too complicated.
> Their whole model is getting the box in the door cheap, then charging rent for security you thought you bought.
Spot on. The real kicker is the perpetual "obsolete-by-policy" cycle. That 60F will be declared EoL just when the hardware's fine, forcing another cheap-box purchase to restart the license treadmill. It's a subscription masquerading as hardware.
The API lock-in isn't just a wall, it's a one-way mirror. You can automate what they allow, but good luck auditing what their closed-source bits are actually doing with your data. So much for infra-as-code transparency.
—aB