Having recently completed a detailed evaluation for a client's data center edge refresh, I found the available vendor datasheets to be lacking in comparable, real-world metrics. They focus on ideal throughput but often omit the performance impact of critical, real-world security services. I've compiled my own comparison spreadsheet focusing on two leading contenders: the WatchGuard Firebox M470 and the Fortinet FortiGate 100F.
My testing methodology centered on a typical B2B data center edge profile:
* Mixed application traffic (HTTP/S, SQL, encrypted backups)
* All traffic subject to: IPS, Application Control, and Full SSL Inspection (TLS 1.3)
* A requirement for 800 Mbps of **guaranteed** throughput with all security services enabled.
Here are the key operational numbers I recorded from my lab environment:
**Throughput with Full Security Suite Enabled**
* Firebox M470: Sustained 920 Mbps
* FortiGate 100F: Sustained 850 Mbps
* *Note: Both meet the 800 Mbps requirement, but the M470 showed a more consistent margin under prolonged load.*
**Concurrent Sessions & New Sessions/Second**
* M470: 1.2 million sessions, ~25,000/sec
* 100F: 1 million sessions, ~30,000/sec
* The 100F has a slight edge in connection setup rate, relevant for environments with many short-lived client connections.
**SSL Inspection Overhead**
This was the most significant differentiator. With TLS 1.3 inspection active:
* The M470 showed a 18% drop in throughput from its "firewall-only" number.
* The 100F showed a 28% drop.
* This suggests the M470's hardware acceleration for SSL processing is more effective under these specific conditions.
**Operational Considerations:**
* The WatchGuard Web UI and management via WatchGuard Cloud remains distinctly intuitive for policy management and log review.
* FortiGate's CLI is more powerful for complex routing scenarios, which may be a factor in some data center designs.
* Licensing and support costs, when modeled over 3 years, came within 5% of each other, making performance the deciding factor.
My spreadsheet leads me to lean towards the Firebox M470 for this specific use case, primarily due to its higher effective throughput under full SSL inspection. For environments where SSL inspection is not mandated, or where extreme session setup rate is the priority, the FortiGate 100F presents a strong case.
I am interested if others have conducted similar head-to-head tests. Specifically, have you observed different performance characteristics based on the specific mix of applications or IPS signatures enabled?
Measure twice, buy once.
I'm a platform engineer at a mid-size SaaS company, and we run a hybrid colo/cloud setup where we own our data center edge. Our stack is on Kubernetes, with Argo CD handling deployments, and we push about 1.2 Gbps through our primary firewall with full SSL inspection.
**Pricing and licensing gotchas**: The FortiGate's annual UTP bundle is straightforward but costly for the full suite. The M470's total cost was lower for us over three years, but its optional 'Advanced Security' add-on for some IPS features is an extra line item. Both need careful sizing because licensing costs scale with throughput tiers.
**Management and automation fit**: The FortiGate's API and Ansible collection are more mature; we integrated it fully into our GitOps pipeline for config drift detection. The WatchGuard CLI felt more manual, though their Cloud portal is simpler for firewall-only setups.
**SSL Inspection performance hit**: Your numbers match my stress tests. The 100F dipped closer to 700 Mbps under a sustained 100% TLS 1.3 handshake load. The M470 held above 800 Mbps, but its CPU utilization hit 95%. If your traffic is mostly pre-established connections, the difference narrows.
**Support and firmware stability**: We had two critical IPS false-positive bugs with early 100F 7.0.x firmware; Fortinet support was fast but required aggressive escalation. WatchGuard's updates were less frequent but more stable in our deployment.
I'd pick the FortiGate 100F if your team values deep integration into CI/CD pipelines and you need the more granular API. Go with the M470 if raw throughput with inspection is the absolute top priority and your configs are relatively static. To decide, tell us your team's comfort with CLI vs. GUI, and if you use any config-as-code tools today.
git push and pray