We just completed our 30-day pilot of FortiSASE for our remote workforce (about 150 users). The goal was to consolidate security and improve visibility. The result was unexpected: our IT help desk saw a 100% increase in tickets specifically complaining about "slow internet" or "laggy video calls."
Prior to rollout, we averaged 8-10 such tickets per week. Since enabling FortiSASE with basic web filtering and threat protection (no fancy extra inspection), that jumped to 18-20 weekly. We're routing traffic through the nearest FortiSASE POP, according to their dashboard.
I'm trying to figure out if this is our configuration, a known trade-off, or something else. Has anyone else run into this? I'm especially curious about:
* **Performance benchmarks:** How does the latency introduced by FortiSASE compare to other SASE/SSE vendors (like Zscaler, Netskope, or even Palo Alto Prisma Access) in real-world use? Is a certain amount of slowdown expected?
* **Troubleshooting steps:** We've checked the obvious—split tunneling is off for corporate apps, and we're using the recommended client. Are there specific FortiSASE policy settings or bypasses that are common for performance-sensitive apps (Teams, Zoom, Salesforce)?
* **Pricing vs. Performance:** We were sold on the tight integration with our existing FortiGate and the cost per user seemed competitive. But if it's impacting productivity this much, the math changes. Did anyone negotiate specific performance SLAs into their contract?
Our current setup is pretty standard:
* Security bundle with web filtering, DNS filtering, and anti-malware.
* All traffic routed through the SASE POP.
* Users are geographically dispersed across the US.
Any insights or similar experiences would be really helpful. We're pausing the rollout until we understand this better.
A 100% ticket increase for latency complaints is a significant performance signal. While some overhead is expected with any secure web gateway, that magnitude suggests a configuration or routing issue rather than an inherent trade off.
On your benchmark question, I've run controlled tests on several platforms. In my experience, the latency penalty for basic filtering and threat protection should be relatively consistent across major vendors, often in the 15-30ms range for a well placed POP. A doubling of user complaints points to something beyond that baseline. Have you verified the actual "nearest POP" by running traceroutes from a few user endpoints? The dashboard's assignment can sometimes be suboptimal.
For troubleshooting, I'd start with two specific bypasses. First, create a policy to exclude your video conferencing SaaS domains (Zoom, Teams, Webex) from deep inspection, routing them only for basic URL filtering. Second, check if you have SSL inspection enabled even for "basic" policies, as that's a common hidden source of latency. A phased approach of bypassing specific traffic can help isolate the culprit.
Your bill is too high.
Ouch, that's a tough result for a pilot. I ran a similar test last year and saw a small bump in complaints, but nothing like doubling.
On benchmarks, I've seen FortiSASE add 40-50ms in some regions, which is on the higher side. Zscaler and Netskope often come in lower for me, around the 15-30ms range user961 mentioned. But 100% more tickets feels like a routing or policy issue, not just baseline overhead.
For troubleshooting, definitely check those traceroutes. The "nearest POP" logic can be off. Also, look at your SSL inspection depth. Even basic threat protection can add latency if it's doing full packet inspection on all traffic. Creating a bypass policy for known video call subdomains (Zoom, Teams) is a common fix that can buy you time to figure out the root cause.
—b