Ran a six-month trial of FortiSASE for our primary and DR data centers. Vendor slides promised seamless security, reduced overhead, and cloud agility. The reality was a performance tax and operational headaches that sent us back to our on-prem FortiGate clusters.
The core issue wasn't basic connectivity—it was predictable, high-throughput workload performance. Our ETL pipelines and intra-DC backups need consistent low latency and high bandwidth. With FortiSASE, all that east-west traffic got hairpinned through the nearest PoP, adding milliseconds that add up fast. Vendor said "negligible impact." My packet captures said otherwise.
Here's a sample of the latency increase we measured for a simple database query loop between application and database tiers, on-prem vs. through the SASE tunnel:
```sql
-- Simulated query run 1000 times in a loop
-- On-prem (FortiGate direct): Avg network RTT 0.8ms
-- Via FortiSASE PoP: Avg network RTT 4.2ms
-- That's a 425% increase in just network latency per hop.
```
The problems multiplied from there:
* **Cost unpredictability:** Data egress charges from the cloud providers, plus SASE bandwidth tiers, created a bill that was higher than our estimated on-prem 3-year refresh.
* **Debugging hell:** Trying to isolate a performance issue meant opening tickets with Fortinet SASE support, then our cloud provider, and then our own network team. Too many handoffs.
* **Limited visibility:** The SASE dashboard is great for user-centric stats, but deep packet inspection and flow logs for data center servers felt like an afterthought. I couldn't get the same granular telemetry I can pull via CLI from my physical FortiGates.
We're now back to FortiGate 600Fs in active-passive at each site. Our latency graphs are flat again, our costs are fixed, and my team controls the entire path. The cloud-delivered firewall model might work for securing remote users or branch offices, but for data center core traffic, it introduced more complexity than it solved.
-- bb
-- bb
I'm the tech lead at a 120-person logistics company, and we manage our own multi-VPC AWS environment plus two colo data centers. I evaluate every new "cloud-native" security promise, but our production analytics and order processing still runs behind on-prem Palo Alto firewalls.
- **Fit / Target Audience:** FortiSASE is a solid fit for a remote workforce or securing branch offices with direct-to-cloud traffic. For an enterprise with significant data center east-west traffic, it's a square peg. It's built for the north-south user-to-app flow, not app-to-app.
- **Real Pricing:** The sticker price is competitive for the secure web gateway and ZTNA bits, maybe $12-15/user/month at our scale. The killer was the data processing fees for the SASE tunnel. Our internal backups and data syncs pushed us into the highest tier, adding a 40% overage charge we didn't forecast. Our on-prem FortiGate 600E clusters have a predictable 3-year TCO.
- **Where It Breaks:** Your latency finding is spot-on. The performance tax isn't for all traffic, just the predictable, high-volume flows between fixed points. In our test, a sustained 10 Gbps sync between data centers maxed out the PoP's inspected throughput, causing packet loss and retransmits. The vendor's "negligible impact" assumed our traffic was mostly user-to-internet.
- **Deployment & Gotcha:** The deployment for devices and users was fast. The silent killer was the routing. We had to get very clever with SD-WAN rules and policies to try and bypass the tunnel for known internal IP ranges, and even then, some traffic would still take the scenic route. The operational headache of managing that versus simple, explicit data center firewall rules wasn't worth it.
I'd recommend sticking with on-prem firewalls for any org where the data center is the center of gravity. If you have a hard requirement to also secure a growing remote workforce, a hybrid model - on-prem for the data center, a separate ZTNA solution for users - might be cleaner. For a clean call, tell us what percentage of your traffic is user-to-DC versus DC-to-DC, and if you're under any compliance pressure to have a unified security log.
trial before buy
That latency increase for database queries is the exact kind of thing my team misses until the monthly bill shows a 30% spike in compute costs for the same workloads. The extra milliseconds force the app to hold connections open longer, consuming more resources.
Your point about cost unpredictability hits home. With on-prem firewalls, my capex is fixed after the purchase. But when you inject a cloud-based SASE layer, you're now subject to the variable data egress fees of your cloud provider *on top of* the SASE provider's bandwidth tiers. It creates a double-billing scenario that's impossible to model accurately until it's too late.
Did you also see any unexpected charges for the intra-POP data transfer, or was it purely the egress back to your DCs that hurt?