SD-WAN Comparison
Fortinet FortiGate, Cisco Catalyst SD-WAN, HPE Aruba EdgeConnect, Palo Alto Prisma SD-WAN and Cisco Meraki MX compared on the eleven points that decide most branch and multi-site projects: security in the box, licensing, link handling, switching and Wi-Fi, and what happens when the cloud is out of reach. We sell and support Fortinet, and our engineering background includes Cisco, HPE Aruba and Arista networks. Each cell is checked against the vendor’s own public documentation, linked under Sources. Last reviewed October 27, 2026.
The Comparison
Read across a row to compare one capability. “Yes” means the vendor documents the capability on the SD-WAN device; the note names any license or release it needs. “Not in public docs” means we could not confirm it either way in the vendor’s public documentation; it may exist under another name. On a phone, each row becomes a card.
| Feature | Fortinet FortiGate | Cisco Catalyst SD-WAN | HPE Aruba EdgeConnect | Palo Alto Prisma SD-WAN | Cisco Meraki MX |
|---|---|---|---|---|---|
| Firewall and intrusion prevention in the SD-WAN device | YesFull NGFW; IPS with a FortiGuard subscription | YesIPS and URL filtering in the router security stack | YesZone firewall included; IPS with the Advanced Security license | YesZone firewall; threat prevention with a branch security subscription | YesIPS with the Advanced Security or SD-WAN Plus license |
| Web and DNS filtering on the device | YesWeb, DNS filtering and antivirus with FortiGuard | YesURL filtering, DNS security, malware protection | Not in public docs | YesDNS security and URL filtering with a branch security subscription | PartialWeb filtering on the MX with Advanced Security; DNS filtering runs in Cisco Umbrella, licensed separately |
| Encrypted-traffic (TLS) inspection on the device | YesDeep inspection on the FortiGate | YesTLS proxy on supported router models | Not in public docs | Not in public docs | YesHTTPS inspection on MX 26.2 and later, licensed tiers |
| Switches and Wi-Fi in the same console as SD-WAN | YesFortiSwitch and FortiAP managed from the FortiGate | Separate consoleSwitches and Wi-Fi run in a separate dashboard | Separate consoleOrchestrator for SD-WAN; Central for switches and Wi-Fi, integrated | Not in public docs | YesMX, MS switches and MR access points in one dashboard |
| How SD-WAN is licensed | Per deviceSD-WAN is built into FortiOS, no separate license | Bandwidth tierSubscription by bandwidth tier, term and feature package | Bandwidth tierPer gateway, bandwidth tiers from 20 Mbps to unlimited | Bandwidth tierPer-site bandwidth tier, or pooled bandwidth | Per deviceModel-specific license on each device |
| Spreads one session's packets across two links (per-packet) | PartialAcross aggregated IPsec tunnels, not plain internet links | YesRelease 26.1 and later; packets reordered at the destination | YesPacket-level bonding across links | Not in public docs | NoPer-flow only; flows split by uplink |
| Repairs lossy links for voice and video (FEC or packet duplication) | YesAdaptive FEC and packet duplication | YesFEC and packet duplication | YesFEC and packet duplication (path conditioning) | YesFEC and packet duplication (ION 6.3.1 and later) | Not in public docs |
| Steers calls on voice quality (MOS score) | YesMOS-based SLA in performance health checks | Not in public docsPath choice documented on loss, latency and jitter | Not in public docs | Not in public docs | Yes“Best for VoIP” uses the uplink with the best MOS |
| Direct branch-to-branch tunnels on demand | YesADVPN shortcut tunnels | YesOn-demand spoke-to-spoke tunnels | Not in public docs | Not in public docs | NoBranch traffic goes through a hub, or a full mesh |
| WAN optimization (deduplication, compression) | PartialNot on models with 2 GB of memory or less | YesTCP optimization and data redundancy elimination (AppQoE) | YesWith the Boost license | Not in public docs | Not in public docs |
| Keeps forwarding if cloud management is unreachable | YesSD-WAN runs autonomously on the FortiGate; central management is optional | YesForwards on cached routes for a configurable period | Not in public docs | YesKeeps running; VPN keys rotate for up to 72 hours | PartialCloud is out of band, but MX 17 and later reboot after 8 hours offline |
Features depend on model, software release and license tier. Confirm against the vendor documents linked under Sources, and against the quote for the exact model you are buying.
What It Means
All five run a firewall on the SD-WAN device, and every vendor licenses its intrusion prevention and filtering separately. The table notes name the license where the vendor’s docs do. Price the security subscription you need for each site, not just the SD-WAN license.
Spreading one session across two links helps most when both links have similar latency, such as two fiber circuits. With fiber plus a cellular backup, the latency gap usually makes it a poor fit. EdgeConnect bonds links, Catalyst added it in release 26.1, FortiGate does it across aggregated tunnels, and Meraki balances per flow.
FortiGate and Meraki license per device. Catalyst, EdgeConnect and Prisma license by bandwidth tier, so a faster circuit can mean a higher license. Check what a circuit upgrade does to the renewal before you sign a multi-year term.
Four of the five document it; HPE’s public docs don’t say. Meraki documents that MX 17 and later reboot after eight hours without the cloud. FortiGate runs SD-WAN locally with management optional; Prisma documents up to 72 hours of key rotation without its controller.
Typical Fit
Our view of how these platforms are typically deployed. The right answer usually depends on what already runs your campus and security, and who will operate the network day to day.
Branches and multi-site businesses that want firewall, SD-WAN, switching and Wi-Fi control in one device, licensed per device, with no cloud dependency.
Larger Cisco routing estates with in-house network teams, where integration with the existing Cisco stack matters more than a single box.
Aruba campus environments, and WANs that need link bonding or WAN optimization across long-distance or lossy links.
Organizations standardized on Palo Alto security that plan to inspect traffic in Prisma Access, the cloud security service.
Lean IT teams running many small sites who value one cloud dashboard and zero-touch deployment over deep tuning.
Keep Reading
FAQ
The one that matches what you already run and who will operate it. Fortinet puts the firewall, SD-WAN, switching and Wi-Fi control in one device with per-device licensing. Meraki trades depth for a single cloud dashboard. Cisco Catalyst SD-WAN, HPE Aruba EdgeConnect and Palo Alto Prisma SD-WAN fit best where those vendors already run the campus or security stack. The table above shows where each one differs.
No. Cisco's documentation describes MX load balancing per flow: each new flow is assigned to an uplink in proportion to the configured bandwidth, and a single session stays on one link. If you need one session spread across two links, look at EdgeConnect link bonding, Catalyst SD-WAN release 26.1 and later, or FortiGate aggregated IPsec tunnels.
Usually not. Per-packet spreading helps when two links have similar latency, such as two fiber circuits or tunnels between the same two sites. With fiber plus a cellular backup, the latency gap usually makes per-packet spreading a poor fit, even where the platform reorders packets. What most offices need is fast per-session failover and steering by application, which every platform here does.
Yes. Fortinet documents that SD-WAN can be configured on any FortiGate without a separate license. Application-aware steering relies on FortiGuard updates, which come with the FortiCare and security bundles most FortiGates are sold with.
We only mark a feature Yes or No when the vendor's own public documentation says so. “Not in public docs” means we could not confirm it either way. The feature may exist under another name or in a newer release. If you represent a vendor and can point to a public source, send it and we will update the table.
Sources
Vendor documents change with each release; confirm against the linked pages before you decide.
Fortinet, FortiGate, FortiOS, FortiGuard and FortiCare are trademarks of Fortinet, Inc. Cisco, Catalyst and Meraki are trademarks of Cisco Systems, Inc. HPE, Aruba and EdgeConnect are trademarks of Hewlett Packard Enterprise. Palo Alto Networks and Prisma are trademarks of Palo Alto Networks, Inc. Vendor names are used to identify the products discussed. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by any vendor named here.
Choosing an SD-WAN
Send the number of sites, the circuits at each, what runs your switching and Wi-Fi today, and the applications that cannot drop. We recommend a platform, size it, and quote the migration as a fixed-fee project with a tested rollback.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
