Fortinet vs Meraki
Both are strong platforms. The choice usually comes down to who runs the network, how you want to license it, and how much security inspection you need.
We are a Fortinet Engage Advocate Partner and resell Fortinet. We do not resell Meraki, but we design and implement Cisco networks, including Meraki.
The Short Answer
At a Glance
The vendor documents behind each row are listed under Sources. Published throughput figures are in the Security Inspection section.
| Decision point | FortiGate | Meraki MX | What to check |
|---|---|---|---|
| Management model | Local web interface and CLI on every FortiGate; FortiManager for fleets; FortiManagement Cloud (formerly FortiGate Cloud) as a cloud service | Configured from the Meraki cloud dashboard, with a limited local status page for IP settings and troubleshooting | Who makes changes, and whether you need to manage a site with no cloud access |
| Licensing model | Hardware, FortiCare support and optional FortiGuard bundles (Advanced Threat Protection, Unified Threat Protection, Enterprise Protection) or an SD-WAN bundle | A license for every device: co-termination (one shared expiry date per organization), subscription, or legacy per-device licensing; MX tiers set the features | Which tier is quoted, and whether every switch and access point is licensed too |
| At license expiry | Base firewall and routing continue; IPS and antivirus run on the last signatures; expired category-based web and DNS filtering can still block traffic, depending on configuration | Co-term: the organization shuts down after a 30-day grace period. Per-device: only the unlicensed devices shut down. Subscription: traffic keeps forwarding and management is disabled after the grace period | Your licensing model and renewal date, in writing |
| Security inspection | IPS and anti-malware in every security bundle; URL, DNS and video filtering, DLP and AI-based inline malware prevention depending on bundle and model | Advanced Security tier adds IDS/IPS, content filtering and Cisco AMP malware protection, with Talos threat intelligence | Vendor-published throughput with inspection on, for the model you are quoted |
| SD-WAN | Built into every FortiGate at no extra cost; optional SD-WAN bundle for SLA database, orchestration and monitoring | Auto VPN and SD-WAN path selection; Secure SD-WAN Plus adds application and WAN health analytics and smart breakout | Which analytics you need, and at what tier |
| Switching and Wi-Fi | FortiGate manages FortiSwitch through FortiLink and FortiAP through its wireless controller | Meraki MS switches and MR or CW access points in the same dashboard, each licensed | Single vendor is a convenience, not a requirement. |
| Remote access | IPsec VPN and ZTNA; SSL VPN tunnel mode was removed in FortiOS 7.6.3 | Client VPN on the MX; Cisco offers migration from Meraki Secure Connect to Cisco Secure Access | Plan the remote-access design either way |
| Logs and history | FortiAnalyzer, or up to a year of cloud logs with FortiManagement Cloud or the SD-WAN bundle | Dashboard history is short (IDS events about 15 days); long-term logs need a syslog server | Your audit or retention requirement |
| Who runs it best | A team, or a partner, comfortable with FortiOS and its licensing | Lean IT teams managing many sites | The skills you have today, not the ones you plan to hire |
Management Model
Meraki. Cisco describes the dashboard as “the centralized cloud management platform for all Meraki devices and services”, and the MX datasheet calls the MX “100% cloud managed”, so installation and remote management are zero touch. Firewall, switches and Wi-Fi share one dashboard, with client views consolidated across the network. Each device also has a local status page for IP configuration, status and troubleshooting; everything else is configured in the cloud.
Fortinet. Every FortiGate has its own web interface and command line and runs with no cloud service at all. For fleets, FortiManager centralizes configuration and policy across many devices, including SD-WAN and ZTNA policy. FortiManagement Cloud, which Fortinet describes as ideal for SMBs and managed service providers, is a SaaS service with zero-touch provisioning of FortiGates and connected FortiSwitch, FortiAP and FortiExtender devices, and up to a year of cloud log storage.
The trade is simplicity against control. A dashboard that a generalist can run well is a real advantage; so is a firewall you can reach and change locally when the internet circuit is the problem.
Licensing Model
Meraki supports three licensing models. Co-termination (co-term) and subscription are available to all customers; per-device licensing is limited to existing per-device customers, and new conversions to it are no longer supported. Subscription and co-term licenses cannot be mixed in one dashboard organization.
A FortiGate is bought as hardware plus FortiCare support, usually with a FortiGuard bundle. On the current 70G datasheet, the security bundles are Advanced Threat Protection, Unified Threat Protection and Enterprise Protection, and there is a separate SD-WAN bundle.
Small-model caveat: Fortinet’s FortiGuard ordering guide notes that Content Disarm and Reconstruct, video filtering and inline CASB are not available on the FortiGate 30G and 50G in any OS build. Check that before choosing the smallest model to save money.
At License Expiry
This is where the two platforms differ most, and on Meraki it depends on which licensing model your organization uses.
The practical takeaway: on either platform a missed renewal is a real risk, either an outage or a firewall running on old signatures. Know your licensing model, your renewal date and who owns it.
Security Inspection
Meraki MX. Cisco markets the MX as a built-in next-generation firewall with IDS/IPS, URL filtering and malware protection, backed by Cisco Talos threat intelligence. On co-term and per-device licensing, those services need the Advanced Security tier or higher; the MX datasheet states that advanced security services require an Advanced Security license.
FortiGate. IPS and anti-malware come with every security bundle; URL, DNS and video filtering, data loss prevention and inline malware prevention depend on the bundle and model, as above. Inspection runs on Fortinet’s own security processors; the 70G uses the SP5 chip, which Fortinet says accelerates application identification, IPsec VPN and SSL inspection.
Each vendor’s own published numbers for comparable small models:
Cisco and Fortinet test differently, so treat these as a starting point for sizing, not a head-to-head result. Size from your own traffic with inspection turned on; the FortiGate sizing guide shows the method.
SD-WAN
Meraki. Auto VPN builds site-to-site IPsec tunnels and routes automatically, and the MX supports active/active VPN, policy-based routing and dynamic path selection. On co-term and per-device licensing, Secure SD-WAN Plus adds the analytics layer: WAN, VoIP and web application health, Smart SaaS quality of experience, ThousandEyes internet outage data and smart breakout.
Fortinet. Fortinet includes SD-WAN and a network controller in every FortiGate at no extra cost. The optional SD-WAN bundle adds an SLA database, underlay and application monitoring, overlay orchestration, a connector for FortiSASE private access and a year of cloud log retention. FortiManager handles SD-WAN policy across larger fleets.
For most multi-site businesses, either platform handles dual internet circuits and branch VPNs well. The differences are in how much you tune by hand, what analytics you pay for, and how you manage it. For a build or a move off MPLS, see SD-WAN migration.
Switching and Wi-Fi
Meraki: MS switches and MR or CW access points live in the same dashboard as the MX, and each device carries its own license.
Fortinet: the FortiGate manages FortiSwitch through FortiLink, which Fortinet describes as integrating the switch “as a logical extension of the NGFW”, and FortiAP through its wireless controller. A FortiGate 70G supports up to 24 FortiSwitches and 96 FortiAPs (48 in tunnel mode).
Mixed environments work both ways: a FortiGate in front of Meraki switches and access points, or Meraki Wi-Fi behind another firewall. One vendor everywhere is a convenience, not a requirement.
Typical Fit
On our architecture review page, Meraki and Fortinet score the same on breadth of features and differ on the skill needed to run them well. The same pattern shows up here.
Total Cost Drivers
We do not compare vendor prices here. Compare current written quotes for the same models, features and terms, line by line:
Compare three- and five-year totals per site from written quotes for the same sites. If you want the current network reviewed first, the Network Risk Assessment is $3,500 for a single small site: one firewall, up to three switch groups (a stack counts as one), 100 connected devices and 6 access points; larger networks priced by size on the assessment pricing page.
How We Help
Every engagement has one senior network engineer as your point of contact.
The network architecture review scores Meraki, Fortinet and keeping what you have against criteria you approve, with three- and five-year costs from your quotes. It is quoted after scoping, and the fee is our only income from it by default; we quote hardware only if you ask after accepting the report, with our margin disclosed.
The Meraki alternative page covers MX lifecycle dates and a fixed-fee migration to FortiGate from $6,500.
We implement and support Cisco networks, including Meraki MX, MS and MR: design changes, licensing alignment, renewal planning and documentation.
FAQ
Neither is better for every small business. Meraki suits a lean IT team that wants firewall, switches and Wi-Fi in one cloud dashboard and is comfortable paying a license for every device. FortiGate suits a team, or a partner, that wants deeper security controls and SD-WAN included in the appliance, and is comfortable with FortiOS. Who runs the network day to day and the three- to five-year cost per site usually decide it.
Both are next-generation firewalls with SD-WAN. The Meraki MX is configured from the Meraki cloud dashboard and licensed per device; what happens at expiry depends on the licensing model. A FortiGate has its own local interface and command line, can also be managed centrally with FortiManager or FortiManagement Cloud, and is licensed as hardware plus support and optional FortiGuard security bundles.
On co-termination licensing, there is a 30-day grace period, after which the organization is shut down and its devices stop passing traffic to the internet until licensing is restored. On per-device licensing, only the device whose license expired shuts down after its 30-day grace period. On the newer subscription model, there is normally a 30-day grace period, after which networks enter a disabled management state: devices keep forwarding traffic on their last compliant configuration, but you cannot change settings, see monitoring data, get firmware updates or open support cases.
Base firewall and routing keep working. According to Fortinet, firewall services stay fully functional, and the IPS and antivirus engines keep running on the last signatures they received, with no new updates. Category-based web and DNS filtering stops because it depends on live FortiGuard lookups, and by default web traffic that cannot be rated is blocked unless the FortiGate is set to allow websites when a rating error occurs. Decide which behavior you want before a renewal date, not after.
On a FortiGate, SD-WAN is built into every appliance at no extra cost; an optional SD-WAN bundle adds an SLA database, overlay orchestration, underlay and application monitoring and cloud log retention. On a Meraki MX, Auto VPN and SD-WAN path selection come with the base license, and Cisco's Secure SD-WAN Plus tier adds analytics such as WAN, VoIP and web application health and smart internet breakout.
FortiManagement Cloud is Fortinet's cloud management service, which Fortinet describes as ideal for SMBs and managed service providers, with zero-touch provisioning of FortiGates and connected FortiSwitch, FortiAP and FortiExtender devices and up to a year of cloud log storage. FortiManager manages larger fleets. Unlike an MX, each FortiGate also has a full local interface, so it can be run without any cloud service.
Yes. A FortiGate works with any standards-based switch and access point behind it, so Meraki MS switches and MR access points keep working as long as their own licenses are current. The reverse also works: a Meraki MX in front of FortiSwitch or other third-party switches. You give up the single dashboard, not the network.
It depends on the models, the license tier, how many switches and access points are licensed, the term length and who operates it. Compare current written quotes for the same models, features and terms over three and five years, including support, log retention, management platform and staff or managed-service time.
No. We resell Fortinet and do not resell Meraki, and we design and implement Cisco networks, including Meraki. The network architecture review scores Meraki, Fortinet and keeping what you have against criteria you approve.
Yes. Staying on Meraki is a valid outcome, and we support Meraki MX, MS and MR networks.
Sources
Last reviewed . Vendor documents change; confirm against the linked pages before you decide.
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Other vendor names are trademarks of their respective owners, used to identify the products discussed. Ambio Edge Networks is an independent Fortinet Engage Advocate Partner. This comparison is not endorsed by Fortinet or Cisco.
Fortinet or Meraki
Send the sites, current firewall, renewal date and what the network needs to do. We will tell you which platform fits and why.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
