Network Architecture Review
Before every site moves to one firewall, switching or Wi-Fi platform, get a written recommendation from an engineer whose fee doesn’t depend on which hardware you buy. Our fee is the research and design fee. We earn no margin, referral fees or vendor incentives on the recommendation. If you later want to buy the hardware or the build from us, you can ask after you accept the report, and we tell you exactly what we earn before you decide.
How We’re Paid
An architecture decision locks in hardware, licenses and operating habits for five years or more. It deserves advice from someone whose pay doesn’t depend on which platform you pick.
Most IT providers earn a margin on the hardware and licenses they recommend. That is a fair business, and it is also a reason to doubt the recommendation. Our review is paid by its fee alone, and the scoring is accepted, then left unchanged, before any purchase is discussed.
Fortinet, Cisco and Cisco Meraki, Palo Alto Networks, Aruba, Arista, and the one you already own. Our hands-on depth is Fortinet and Cisco; for other platforms we work from vendor documentation, quotes and your team's experience, and the report says which is which.
The fee covers the stakeholder interviews, the technical deep dive, the cost model and the written recommendation. If the right answer is a smaller purchase, our fee doesn't change.
You agree the requirements and their weights before any platform is scored. You get the full scoring sheet, so your team can check the math or re-weight it.
Four Ecosystems, No Favorite
This is our starting map of the four ecosystems most multi-site companies consider, in alphabetical order. In a review, each one is tested against your requirements.
| Topic | CiscoMeraki MX, MS, MR/CW · Secure Firewall · Catalyst | FortinetFortiGate, FortiSwitch, FortiAP, FortiSASE | HPE NetworkingAruba CX, Aruba APs, Central · Juniper SRX, Mist | Palo Alto NetworksPA-Series, Prisma SD-WAN, Prisma Access, Cortex |
|---|---|---|---|---|
| Approach | Two operating models: the Meraki cloud dashboard, or Secure Firewall and Catalyst with on-premises and cloud controllers. The two are converging. | One vendor for firewall, SD-WAN, switching, Wi-Fi and SASE. Switches and access points are managed from the firewall itself. | Campus and branch networking first, with two cloud platforms (Aruba Central and Juniper Mist) that HPE says will stay distinct while sharing AI features and compatible hardware. Firewalls come from the Juniper SRX line. | Security first. Firewall, SD-WAN, SASE and security operations on one platform; campus switching and Wi-Fi come from another vendor. |
| Firewalls | Meraki MX67 to MX450 (0.7 to 6 Gbps firewall); MX95 publishes a 2 Gbps advanced-security target. Secure Firewall 200, 1200, 3100, 4200 and 6100 series; sizing depends on which inspection is turned on. ISA3000 for industrial sites. | FortiGate 30G to 7121F. Published threat protection from about 0.5 Gbps on the 30G to roughly 20 to 30 Gbps on the 900G depending on the test mix, higher on larger models, with custom security chips. Rugged 50G, 60F and 70G for industrial sites. | Juniper SRX from branch to data center (SRX1600: 24 Gbps firewall, 21 Gbps IPS, best case). Aruba gateways handle branch firewalling; Aruba has no dedicated NGFW. | PA-410 to PA-7500. Published threat prevention from about 2.1 Gbps (top PA-400) to roughly 20 to 70 Gbps across the PA-5400 series, higher on larger models. Rugged PA-400R models with 5G options. |
| SD-WAN | Meraki AutoVPN on MX and the new 8000 Secure Routers; Catalyst SD-WAN for larger networks. | Built into every FortiGate. | Aruba EdgeConnect appliances; Juniper SD-WAN via Mist. | Prisma SD-WAN on ION appliances, or SD-WAN on the firewall. |
| Remote access | Cisco Secure Access and Secure Client. Meraki Secure Connect customers are being moved to Secure Access. | FortiSASE and FortiClient ZTNA. SSL VPN tunnel mode was removed in FortiOS 7.6.3; plan on IPsec or ZTNA. | Aruba SSE (formerly Axis) and Juniper Secure Edge. | Prisma Access and GlobalProtect. |
| Switching | Meraki MS and Catalyst 9000; some Catalyst models can run in Meraki mode. | FortiSwitch, access to data center, managed from the FortiGate. | Aruba CX 6000 to 8000 series, Juniper EX and QFX. Rugged EX4100-H. | None. Paired with another vendor. |
| Wi-Fi | Meraki MR and the CW91xx Wi-Fi 7 range. Several older MR models have published end-of-support dates; the lifecycle inventory checks each one. | FortiAP, including Wi-Fi 7 models. | Aruba AP-730 Wi-Fi 7 series and Juniper Mist APs. | None. Paired with another vendor. |
| Management and logs | Meraki dashboard: short history for IDS and event logs (IDS events about 15 days), so long-term logs need a syslog server. | FortiGate GUI, FortiManager for fleets, FortiAnalyzer for logs. Retention depends on how much log storage you buy. | Aruba Central (on HPE GreenLake) and Juniper Mist, both with AI-assisted troubleshooting. Firewall policy lives in a separate console. | Panorama or Strata Cloud Manager; Strata Logging Service with one-year retention by default. |
| When the subscription lapses | Meraki depends on the license model: on per-device and co-term licensing, devices stop after a 30-day grace period; on the newer subscription model, traffic continues after a 30-day grace period but management is lost. | Signature updates and support stop, and category-based web and DNS filtering stops, which blocks that traffic by default unless configured otherwise. Confirm in writing how your bundle behaves. | Mist: devices keep running, but management and monitoring are lost. Confirm Central terms in writing. | Installed threat signatures can keep working for a time; new signatures, cloud-based analysis, updates and support stop as each subscription expires. |
| Who runs it best | Meraki: lean IT teams managing many sites. Secure Firewall: dedicated security staff. | A team, or a partner, comfortable with FortiOS and its licensing. | Teams that prioritize AI-assisted campus and branch operations. | Dedicated security staff, plus a second vendor for switching and Wi-Fi. |
| Users praise | One dashboard across sites, zero-touch deployment, stable SD-WAN; Secure Firewall IPS and Cisco integration. | Strong security features, built-in SD-WAN, central management, price against rivals, quick deployment. | Stable hardware, ClearPass access control, Juniper documentation. | Threat prevention depth, granular application and identity policy, stable performance. |
| Users criticize | License cost, limited deep firewall controls on MX, thin reporting and history; Secure Firewall management is slow. | Busy interface at scale, reporting needs add-ons, firmware upgrades need planning, switching and Wi-Fi weaker than the firewalls. | Central licensing cost, mixed support, dated SRX interface, two management platforms to choose between. | License cost, configuration complexity, inconsistent support. |
Researched 2026-10-23 from vendor datasheets, product pages and lifecycle notices. Throughput figures are each vendor's own published numbers, measured with different test methods, so they are a starting point for sizing, not a comparison. User themes are summarized in our own words from public PeerSpot reviews. Platforms outside these four are listed below with the situations that bring them into a review.
Cisco, Fortinet, HPE and Palo Alto Networks are scored on every review. These platforms enter the comparison when your answers call for them.
Excluded for US sites: equipment on the FCC Covered List, such as Huawei. Hands-on production experience: Cisco, Fortinet, Juniper, Aruba, Arista and Ubiquiti UniFi. Other platforms are evaluated from vendor documentation, demonstrations and lab work, and every score in a review is labeled by its evidence.
Breadth scores how much of a typical multi-site network one vendor covers: firewall, SD-WAN, remote access, switching, Wi-Fi and a single console. Skill scores how much specialist knowledge it takes to run the platform well day to day. Both use the facts in the table above, on a 1 to 5 scale. Dots are product stacks, not whole companies, which is why Cisco and HPE each appear twice. Filled dots are the four core ecosystems; hollow dots are screened platforms we evaluate when they fit. No corner is better than another; each fits a different kind of company. Positions are editorial estimates; deployment, licensing and your team’s experience move them. Not affiliated with or derived from any analyst firm’s chart.
| Ecosystem | Breadth | Skill needed | Why |
|---|---|---|---|
| Cisco Meraki | 4.5 | 1.6 | Firewall, switching, Wi-Fi, SD-WAN in one cloud dashboard; few deep controls to tune. |
| HPE Aruba | 3.8 | 2.4 | Switching and Wi-Fi in Central, plus EdgeConnect SD-WAN and SSE in their own consoles; firewalling on gateways, no dedicated NGFW. |
| HPE Juniper | 4.0 | 3.2 | Mist-managed switching and Wi-Fi plus SRX firewalls; more depth, more to learn. |
| Fortinet | 4.5 | 3.5 | Firewall, SD-WAN, switching and Wi-Fi managed from the firewall, plus FortiSASE; deep options take FortiOS skill. |
| Cisco Secure Firewall + Catalyst | 4.2 | 4.3 | Full range on controllers; extensive controls, specialist administration. |
| Palo Alto Networks | 2.8 | 4.4 | Deep security platform; switching and Wi-Fi come from another vendor. |
| Check Point screened | 2.6 | 3.6 | Firewall, SD-WAN and SASE; switching and Wi-Fi from another vendor. |
| Arista screened | 3.4 | 3.4 | Campus switching, Wi-Fi, NAC and VeloCloud SD-WAN; firewalls from a partner. |
| Cato Networks screened | 3.2 | 1.8 | Cloud-delivered SD-WAN and security as a service; LAN from another vendor. |
| Ubiquiti UniFi screened | 3.6 | 1.5 | Gateway, switching and Wi-Fi in one console; lighter security depth; support depends on the plan bought. |
Who Runs It Day to Day
The right platform depends as much on who will operate it as on what it can do. A cloud-first company with a lean IT team and a company with its own security engineers should not buy the same thing.
How the Review Runs
Each step produces something you keep. The first three gather facts; the last three turn them into a decision.
Step 1
A scoping call sets the sites, the decision being made, who approves it, and the deadline. Then we agree the evaluation criteria and weights.
Step 2
Every site's IT contact and key users answer one questionnaire: cloud and business applications, where data lives, remote users, production and lab systems, compliance requirements, and how IT is run day to day.
Step 3
Read-only review of firewall, switching and wireless configurations, a lifecycle inventory with end-of-support dates, measured traffic and where it goes, and the security and logging gaps that matter for the decision.
Step 4
Two or three realistic scenarios, for example one platform everywhere, a different platform, or a group standard with a documented local exception. Each is scored against your criteria with a three- and five-year cost, from quotes your team obtains from resellers of your choice. We write the quote requests so every bill of materials is comparable.
Step 5
An executive summary for the people who approve the spend, the technical detail for the engineers, a target design and bill of materials, and a migration plan. Then a walkthrough call to answer questions.
Step 6
Implementation is quoted separately for Fortinet or Cisco designs, including Meraki. If you ask after accepting the report, we can also quote Fortinet hardware, with our margin disclosed. You are free to buy elsewhere and to hire another provider.
Everything Rides on the Network
Each respondent starts with title, role and experience, and the questions adapt to them. Directors weigh priorities. Engineers give measured facts. People who wear many hats cover every area they handle. Answers are cross-checked across roles and sites, conflicting answers go to a workshop, and technical facts are checked against configurations and measurements before anything is scored.
Role picks the usual areas. Add any others you handle, and the questions follow. Nothing here is sent or stored.
Sample from the full questionnaire. Directors get priorities and governance only. Engineers get the technical version.
What You Get
Written for two readers: the managers who approve the spend, and the engineers who will build and run it. The executive summary is short enough to go straight into an internal approval document.
| Criterion | Weight | Scenario A one platform | Scenario B another platform | Scenario C standard + local exception |
|---|---|---|---|---|
| Security inspection at the required speed | 20% | 4 | 5 | 4 |
| Day-to-day operation by site staff | 20% | 5 | 3 | 4 |
| Five-year cost | 20% | 3 | 4 | 5 |
| Central visibility across sites | 15% | 5 | 4 | 4 |
| Segmentation for production systems | 10% | 3 | 5 | 4 |
| Fit with existing skills and equipment | 10% | 3 | 4 | 5 |
| Vendor support in every region | 5% | 4 | 4 | 4 |
| Weighted total (of 100) | 79 | 82 | 86 |
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Inspection throughput falls short at HQ | medium | high | Size from measured peak, test with inspection on before purchase |
| Plant machines need vendor access mid-migration | high | medium | Approved remote-access path in place before cutover |
| License terms renew on different dates | medium | medium | Co-terminate renewals in the purchase plan |
| Staff unfamiliar with the new console | low | medium | Two-hour handover per site, written runbook |
Why It’s Worth It
Hardware, licenses, support and the habits of the people running it all lock in on the day you buy. Getting it right on paper is cheaper than undoing it after purchase.
Scenarios rarely cost the same over five years, and every site that follows the standard repeats the difference. Real reviews measure the gap from quotes your team obtains.
Approvers get a short summary with the evidence behind it, so the choice doesn’t stall or get remade by someone who never saw the sites.
Throughput, logging, licensing and migration risks are tested on paper, not discovered in the first cutover window.
Scoring sheet, cost model, design and plan are yours, whoever builds it and whichever platform you choose.
Start With One Decision
Most networks are replaced one piece at a time: firewalls this year, switches in two, Wi-Fi after that. Each of those decisions is scored against where the whole network should end up, so each purchase fits the plan and you avoid a mix you never chose.
Firewalls, switches, Wi-Fi or one branch. We score the options for that piece against your other equipment’s support dates and growth plans, and turn the result into a template for the next site.
The full review produces a Standards Blueprint: the target design for every site and domain, and a buy order that follows your support dates.
Every future purchase, quoted by any reseller, is reviewed against your blueprint before you sign, and the lifecycle calendar stays current.
Each is quoted after scoping. The first decision becomes the template, the second site copies it, and by the third refresh your sites match by design.
When It Fits
The review earns its fee when a platform choice will be repeated across offices, plants or regions.
Parent Company Overseas
Many US sites belong to a group whose standards are set abroad, often in Japan or Europe. The review is built to fit that process.
We can provide the US sites’ facts and requirements for a decision led by headquarters, or review sites in other regions remotely, with the scope agreed up front.
The executive summary is short and plain, so it can be attached to or quoted in the parent company’s approval request. A professionally translated Japanese version can be arranged at cost.
We work with the parent’s systems integrator and its existing standards, including those built on Japanese-market platforms such as ALAXALA, Yamaha and NEC.
Calls can be scheduled during Tokyo or European business hours, which fall in the US evening or early morning.
Our Disclosure
Ambio is a Fortinet Engage Advocate Partner and sells Fortinet products, and on a review only when you ask after accepting the report. Our engineer is Cisco, Fortinet and CompTIA certified. The recommendation is finished and accepted in writing before any sale is discussed. Once you accept the report, we don’t change its scores; any revision you ask for is dated and listed. If you then ask us to supply hardware, we quote it separately and show our margin in dollars. Any registration discount or rebate on a sale we make is counted in that margin. We register the deal with the vendor only after you approve our quote in writing, and after we have explained in writing how registration can affect other resellers’ pricing. You keep the right to a competing quote. Any partner we introduce comes with a written statement of what we earn from the introduction, zero by default. We accept no vendor incentives tied to a recommendation, and the design is yours to take to anyone.
FAQ
Only if you ask, after you have accepted the written recommendation. We are a Fortinet partner and can quote it. The quote shows our margin in dollars, and you can take it to any other reseller. If you buy elsewhere, the design and bill of materials go with you.
Yes, when the job needs hands we don't have, such as structured cabling or on-site engineers. Before any introduction we tell you in writing what we earn from it. By default that is nothing, and you choose whom to hire.
Yes. The right answer depends on who runs the network day to day, licensing terms, local requirements and what you already own. The review scores both against criteria you approve, and keeping your current platform is always one of the options.
A fixed fee for the review, agreed after a scoping call. That is our only income from the review. If you later ask us to supply hardware or implementation, each is a separate quote that shows what we earn.
Often, yes. The review checks whether the gear you own has supported life left and works with each option, and keeping it is scored like any other scenario.
Sometimes not. For offices that only reach cloud apps, cloud-delivered security and per-app access can replace some on-site firewalls. Sites with production systems, servers or local devices usually still need one. The review answers it site by site.
We implement Fortinet and Cisco platforms, including Cisco Meraki. For other vendors, we identify at scoping what needs specialist validation and mark those dependencies in the design and bill of materials.
It is quoted after a scoping call, because it depends on the number of sites, stakeholders and systems. The quote is a fixed fee with the deliverables listed.
Plan on about two weeks for one or two sites once access is in place, and four to six weeks for a group-wide review across several regions, mostly waiting on questionnaire responses. The scoping call sets the dates.
Configurations and traffic data are collected to systems we control, encrypted in transit, and deleted within 90 days after the walkthrough unless we are engaged to implement. One engineer has access. Passwords and shared secrets are removed before any automated analysis, and you can strip them before sending.
Yes. We can provide input for the local sites into a corporate decision, or run the whole review. The report is yours to share with them, and we sign your NDA. The executive summary is kept short and plain so it translates cleanly for a parent-company review. Sites outside the US are reviewed remotely; travel is scoped separately. Reports are written in English.
Read-only access to firewall, switch and wireless configurations, and a short measurement window. We make no configuration changes unless you approve one in writing, such as turning on traffic statistics for the measurement window.
In 2026 Gartner® Magic Quadrant™ reports, vendors including Check Point, Fortinet and Palo Alto Networks (Hybrid Mesh Firewall, dated September 7, 2026) and Arista, Cisco and HPE (Enterprise Wired and Wireless LAN Infrastructure, dated May 18, 2026) announced Leader placements.
Analyst reports rank vendors across the whole market. They don’t know your sites, your staff or your budget. We read them, then score each platform against your requirements.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark, and MAGIC QUADRANT is a registered trademark, of Gartner, Inc. and/or its affiliates in the U.S. and internationally.
Start the Review
A scoping call sets the sites, the decision, the deadline and a fixed fee. The review makes no changes without your written approval. See how an engagement runs.
Response from a senior engineer within 1 business day.
A scoping call to confirm the decision you are making and who approves it.
A fixed-fee quote with the deliverables listed.
The review includes no hardware quote. You can ask for one after you accept the report.
