Same Problem, Three Different Tradeoffs: FortiGate, Meraki, and SonicWall
Three firewall vendors, one comparison from the team that watches them work.
TL;DR: FortiGate, Meraki, and SonicWall solve the same basic problem, but each one is built around a different tradeoff: how much control you keep versus how much simplicity you get, and how the box behaves the day a license lapses. This post compares all three on the factors that decide most mid-market purchases: licensing behavior at expiry, management model, inspection throughput, SD-WAN support, and SIEM visibility. The right choice comes down less to which vendor is objectively better and more to which tradeoff matches how your organization is staffed and monitored.
Picking a firewall vendor is a little like picking a bank. On paper, they all do the same core job: hold your stuff, protect it, and let you access it when you need to. In practice, the differences that actually affect your day-to-day life show up in the fine print you don’t read until something goes wrong: what happens at renewal, how much you can do yourself versus how much requires a call to support, and what the fees look like once you’re locked in.
Firewall vendors work the same way, and it’s a decision most IT leaders make once every five to seven years, which is exactly often enough to have forgotten everything they learned the last time. Meanwhile, the three names that come up constantly in mid-market conversations, FortiGate, Cisco Meraki, and SonicWall, have all diverged in ways that matter more than any feature checklist a datasheet will hand you.
This comparison exists because we watch all three of these platforms from the SOC side, actively monitoring client environments running each of them, and the view from there is different from the view a reseller gives you. A reseller sells you the box. We watch what the box actually does at 2 am when something’s trying to get through it.
This post walks through what actually separates these three once you get past the spec sheet.
Table of Contents
- The Question Nobody Asks Until It’s Too Late: What Happens at Expiry
- Management Model and Multi-Site Deployment: Cloud-First vs. On-Box Depth
- Security Depth at Real-World Throughput
- Logging, SIEM, and What a SOC Really Sees
- Cost Shape and the Verdict, by Organization Profile
- The Box Is Only as Good as What Happens After You Buy It
- Key Takeaways
- Frequently Asked Questions
The Question Nobody Asks Until It’s Too Late: What Happens at Expiry
Start here, because it’s the question that gets skipped in almost every sales conversation and matters more than nearly anything else on this list: what does the box do when the security subscription lapses? Each vendor handles this differently, and the differences are not cosmetic. Some platforms degrade gracefully, continuing to pass traffic while security services stop updating in the background. Others tie core functionality tightly enough to an active subscription that a lapse has much more immediate consequences for the device’s usefulness.
The honest answer for any specific model and firmware version changes over time as vendors update their licensing enforcement, which is exactly why this is a “verify before you sign” question, not a “trust the datasheet” question. Whatever you’re evaluating, ask the vendor or reseller directly, in writing: what is the device’s behavior on day one of a lapsed subscription, and what is its behavior thirty days in? If you don’t get a clear answer, that’s information too. (For the FortiGate-specific version of this question, see our companion post on FortiGate licensing.)
Management Model and Multi-Site Deployment: Cloud-First vs. On-Box Depth
Meraki’s whole pitch is cloud-managed simplicity: a single dashboard, minimal on-box configuration, and a management experience built for IT teams that don’t want to become firewall specialists. That’s a genuine strength for lean teams, and it shows up directly in multi-site deployment speed: a growing organization opening new locations can stand up centralized policy fast, without a dedicated specialist configuring each site by hand.
SonicWall and FortiGate both take a different approach, centralized management layered on top of deeper on-box configuration, rather than cloud-first simplicity. For a team that wants granular control over policy, and especially one being actively monitored by an outside SOC, that on-box depth is usually a feature, not a limitation, since it gives a monitoring team more to work with. It also shows up in how each vendor handles SD-WAN: FortiGate’s SD-WAN capabilities are mature and tightly integrated with its broader security stack, appealing to organizations that want SD-WAN and security policy managed as one coherent system. SonicWall’s SD-WAN story is credible but generally seen as less mature than either of the other two.
For a lean internal team without a dedicated specialist, Meraki’s simplicity and fast multi-site rollout have real appeal, as long as you’ve already answered the expiry question above. For a team that wants deeper control, especially one working with an outside SOC, the on-box depth of FortiGate or SonicWall tends to be the better fit.
Security Depth at Real-World Throughput
The throughput question here is the same one we raised comparing firewall classes rather than vendors (see our previous post on NGFW vs UTM): whatever number sits on a datasheet, ask what happens to it once SSL inspection, intrusion prevention, and application control are all running simultaneously at your traffic volume, in the 100 to 500 user range that describes most mid-market deployments.
In practice, FortiGate’s positioning has historically leaned on inspection depth and the underlying threat research feeding its IPS signatures. SonicWall competes hard on price at this tier, with the tradeoffs in inspection depth that tend to come with it. Meraki’s inspection stack has improved significantly over the years but is still generally considered a step behind the two purpose-built security vendors on the deepest inspection scenarios, which matters more for a regulated-data environment than for a standard business network. None of this is static; all three vendors update their engines regularly, so treat this as a starting point for questions to a reseller, not a permanent scoreboard.
Logging, SIEM, and What a SOC Really Sees
Here’s the section that doesn’t show up in most vendor comparisons, because most vendor comparisons aren’t written by people who spend their nights staring at the logs. Logging depth and SIEM integration quality determine whether a monitoring team can catch something subtle, like a lateral movement attempt, or whether they’re working with a thin, hard-to-parse log stream that turns detection into guesswork.
From the SOC side, FortiGate’s native logging and its integration options tend to give a monitoring analyst more to work with out of the box. SonicWall and Meraki both support SIEM integration, but the granularity and ease of that integration varies enough between them that it’s worth asking your MSSP or internal security team directly which one they’d rather be handed, because the honest answer from the people doing the watching is more useful than any vendor’s marketing claim on this specific point.
Cost Shape and the Verdict, by Organization Profile
We’re intentionally not quoting prices here, since hardware and licensing costs shift constantly, and a specific number would be stale within weeks. What’s worth understanding instead is the shape of the cost over five years for each vendor: hardware cost up front, a recurring subscription that typically needs renewing every one to three years, and the possibility of a hardware refresh if your traffic outgrows the original sizing. Meraki’s model tends to bundle hardware and licensing more tightly together, which simplifies budgeting but reduces flexibility. FortiGate and SonicWall generally separate hardware and licensing more distinctly, which we cover in detail, including what each FortiGuard bundle includes, in our companion post on FortiGate licensing.
That cost shape feeds directly into which vendor fits your organization. For a lean IT team without a dedicated security specialist, prioritizing simplicity and fast multi-site deployment, Meraki’s cloud-first model has real appeal, provided you’ve confirmed the license-lapse behavior in writing before you commit. For a price-sensitive single-site organization with standard business applications and no regulatory pressure, SonicWall is a reasonable, credible choice, as long as the throughput math holds up at your real traffic volume. For a mid-market or growing organization that wants SD-WAN and security policy managed as one system, handles any degree of regulated data, or is being watched by an active SOC, FortiGate’s inspection depth and logging integration tend to be the stronger fit, which is consistent with what we see from the monitoring side of client environments running all three.
None of these verdicts is universal. The right answer for your organization depends on your traffic volume, your compliance requirements, and whether SSL inspection at full strength changes the math.
The Box Is Only as Good as What Happens After You Buy It
FortiGate, Meraki, and SonicWall solve the same problem from three different starting points: how much control you keep, how the box behaves when a subscription lapses, and how visible your traffic is to whoever’s watching it. None of the three is the universal right answer; the fit depends on your team size, your compliance exposure, and whether SD-WAN and security policy need to live in one system or two.
Where this decision goes wrong isn’t picking the “worse” vendor, it’s picking based on a spec sheet instead of how the box behaves in your specific environment. Traffic volume, team bandwidth, and what happens the day a license lapses rarely come up in a sales conversation, and they’re exactly what determines whether a firewall keeps protecting you or just keeps running.
Secureway IT runs a 24/7 SOC that actively monitors firewall environments across all three of these platforms, and picking the right vendor is only half of what that comparison is worth. The other half is making sure whichever box you land on gets set up against best practice from day one, not just racked and left on default settings. That’s the difference between selling a firewall and standing behind one, and it’s why this comparison isn’t theoretical for us; it’s drawn from what we see on the monitoring side of client networks running each vendor, day and night.
Not sure which of these three fits how your organization runs? Reach out to Secureway IT and talk it through with a security specialist.
Key Takeaways
- What happens when a subscription lapses varies significantly by vendor and should be confirmed in writing before you buy, not assumed from marketing material.
- Meraki prioritizes cloud-managed simplicity and fast multi-site deployment; FortiGate and SonicWall lean toward deeper on-box control.
- Real-world throughput with SSL inspection, IPS, and application control all running matters more than the headline datasheet number, for any of the three vendors.
- FortiGate’s SD-WAN integration and logging depth tend to favor organizations with regulated data or active SOC monitoring.
- None of these verdicts are permanent; all three vendors update their platforms regularly, so treat this as a framework for questions, not a final scoreboard.
Frequently Asked Questions
For inspection depth and SOC integration, generally yes. For simplicity and fast multi-site rollout with a lean IT team, Meraki has real advantages. The right answer depends on which of those two things matters more to your organization.
This varies by vendor and even by model and firmware version, and vendors update this behavior over time. Confirm the specific answer in writing from your vendor or reseller before purchase; don’t assume based on what a similar product did in the past.
Often at the initial purchase and single-site tier, yes, but the real comparison depends on your specific sizing, your renewal terms, and whether your throughput needs push you into a larger model down the line. Ask for the total five-year cost shape, not just the sticker price.