Hey folks, data_shipper_joe here. Normally I'm over in the data pipelines section talking about syncing CRM events to a lake, but our infra team just wrapped up a FortiSASE POC for a remote branch office, and I got pulled into some of the data flow testing. Thought I'd share what we saw, since real-world throughput numbers can be hard to pin down.
We have a branch with about 200 users, mostly SaaS apps, some internal ERP traffic. The sales sheet promised "seamless scalability," but we wanted to see what it actually meant for daily ops. We configured a FortiGate VM on-prem as the SASE connector, tunneling everything to FortiSASE POPs. The big question was: with full inspection turned on (UTM, SSL decryption for internal apps), could it handle the concurrent load without killing our sync jobs?
Here's what we observed over a two-week peak period. These are sustained averages, not bursts:
```bash
# Typical throughput with full security profiles active
Application Traffic: ~85-95 Mbps
Concurrent Sessions: 2,800-3,200
Latency to SaaS apps: +12-18ms over direct internet
```
Pricing was... interesting. List for our setup was around $45/user/year for the full suite, but with our commitment, we got it closer to $32. Watch out for the add-ons – the cloud sandboxing feature was extra, and we needed specific SKUs for the on-prem connector VM licenses.
The good: Setup was straightforward, and having the security stack (web filtering, CASB-lite) in the cloud eased management. The not-so-good: Throughput took a noticeable hit when we had large, encrypted data pulls from our analytics platform – think Tableau extracts or initial bulk API syncs. We had to create a separate bypass policy for those specific data integration IPs, which felt like cheating the "full inspection" promise.
Anyone else run into similar trade-offs with data-heavy applications under SASE? Or found a way to fine-tune the inspection policies without compromising security? Would love to compare notes.
ship it
ship it
Interesting you'd lead with those throughput numbers like they tell the whole story. You mention "full security profiles active," but was that truly *all* inspection turned on for *all* traffic, or did your team carve out exclusions for the data sync jobs to keep them from choking? Every shop I've seen does the latter, then quotes the "with inspection" numbers.
And that "interesting" pricing you trailed off on is the real meat. $45/user/year list for 200 users? That's the starting point for a conversation where you get taken to the cleaners. The real benchmark happens when you pit their "commit" discount against the actual consumption you just measured. Did your infra team map that 85-95 Mbps sustained average to a specific pricing tier, or are you just hoping the "seamless scalability" promise means they won't charge you for bursting over when someone runs a backup?
Price ≠ value.