Home / Services / Networks & SD-WAN / Fortinet vs Cisco Meraki

Fortinet SD-WAN vs Cisco Meraki

Fortinet FortiGate and Cisco Meraki MX both connect and secure multi-site networks. They differ in how they route application traffic, how deep the firewall policy goes, how the estate is managed and how licensing works. Those differences decide what your IT team runs day to day, and what it takes to move from one to the other.

We design, deploy and manage both. This comparison sets out where each fits, what changes for the people running the network, and what to plan for when you replace an existing platform.

Discuss your network Compare the platforms
Platform comparison
Path selection · Firewall policy · FortiManager · Meraki Dashboard · Licensing · SASE · Migration
Decision areas

Six areas that decide which platform fits

A platform can meet the technical brief and still be hard for the team to run. A simple management model can be easy to run and still miss a control the network needs.

01

Application traffic

Which applications need path selection on latency, loss or jitter, and how each site should behave when a link degrades without dropping.

02

Security and inspection

The firewall policy, segmentation, intrusion prevention, web filtering, application control and SSL inspection the environment needs, and the evidence insurers or auditors ask for.

03

Central management

Who changes policy and firmware, how changes reach the branches, where logs are kept and how incidents are investigated.

04

Licensing and lifecycle

Security subscriptions, cloud licence terms, support dates on existing equipment and contract end dates.

05

Secure access and SASE

Whether the network also carries ZTNA, secure web access and SaaS controls, now or later.

06

Existing estate and skills

Current firewalls, Meraki switches and access points, VPNs, site templates and the expertise available in-house or through a provider.

Where your answers point
Fortinet Either Meraki
Application traffic
Security and inspection
Central management
Licensing and lifecycle
Secure access and SASE
Existing estate and skills

Choose the option closest to your network in each area.

Talk it through with us
The six areas pull on each other
  • An inspection requirement changes appliance sizing and licence scope.
  • An existing Meraki switching and wireless estate strengthens the case for MX.
  • A planned MPLS exit can turn a firewall refresh into a wider routing and resilience project.
Fortinet

How Fortinet FortiGate SD-WAN works

Routing and security on one platform

FortiGate runs SD-WAN and next-generation firewall in the same FortiOS. Performance SLA checks measure latency, loss and jitter on each link. SD-WAN rules then use those measurements, together with application classes from Fortinet’s Internet Service Database, to choose the path for each type of traffic.

The same platform carries firewall policy, IPS, application control, web filtering, VPN and segmentation, so when traffic moves to another path, its security policy goes with it.

That suits networks where security and routing are designed together. Business applications can run on different performance rules from general web traffic, and each branch can break out directly to the internet with inspection still applied. Firewall rules, address objects, application definitions and inspection profiles shape the result as much as the steering rules do.

The depth gives finer control, and it asks more of the people running it. Application identification, inspection exclusions and rule order need deliberate design, documentation and testing. A FortiGate left on default settings won’t deliver what the platform was chosen for.

FortiManager, FortiAnalyzer and the Security Fabric

FortiManager handles policy, configuration and firmware across the FortiGates from one place. Across several sites it:

  • stops configurations drifting apart
  • makes changes easier to stage and review
  • keeps a known baseline for the whole estate

FortiManager can be self-hosted, cloud-hosted or run by a managed provider. We host it in Australian data centres.

FortiAnalyzer collects logs from across the estate for analysis and investigation. That’s a separate job from configuration: someone still owns log retention, alert review and the response.

Fortinet’s Security Fabric lets FortiGate share information with other Fortinet products, such as FortiSwitch, FortiAP and FortiClient. It adds value when those products are deployed and run together. Each extension also deepens the commitment to one vendor, so it’s a decision to make deliberately.

FortiGuard subscriptions and sizing

FortiGate hardware and its FortiGuard subscriptions are costed together. IPS, antivirus, web and DNS filtering and threat intelligence depend on current subscriptions.

If a subscription lapses, the FortiGate keeps routing traffic and enforcing its firewall rules. IPS and antivirus keep working on their existing signatures but stop receiving updates, and cloud-based web and DNS filtering can stop working. Protection weakens as the signatures age.

Size the appliance for the security work it will actually do. Raw firewall throughput says little about performance with SSL inspection and IPS switched on, the number of users, the WAN links and the applications crossing it. SSL inspection also needs a certificate rollout, tested exclusions and a staged introduction.

Supported FortiGates often stay in place through an SD-WAN upgrade. Where the hardware can’t carry the intended security workload, or is close to end of support, the same assessment sets the replacement.

Fortinet SD-WAN Check your FortiGate’s support dates
Teams call Performance SLA Latency, loss and jitter on each link 01 SD-WAN rule Application from the Internet Service Database 02 Firewall policy IPS, application control and web filtering 03 Link A · fibre Degraded Link B · 5G Within SLA FortiManager Policy, configuration and firmware Hosted in Australia FortiGate Branch FortiGate Head office FortiGate Warehouse Security Fabric FortiSwitch FortiAP FortiClient FortiAnalyzer Logs for analysis and investigation Configuration flows down · logs flow to FortiAnalyzer Threat intelligence DNS filtering Web filtering Antivirus IPS FortiGuard subscriptions FortiGate Routing and firewall rules Sized for the work it does SSL inspection on IPS on Users WAN links Applications Hardware and subscriptions costed together
Cisco Meraki

How Cisco Meraki MX works

Meraki Dashboard Templates and monitoring Auto VPN builds the site-to-site mesh
Meraki Dashboard
MX · Branch Forwarding traffic Changes and visibility
MX · Office Forwarding traffic Changes and visibility
MX · Site Forwarding traffic Changes and visibility
Licence model
Licence state Active
Active
Grace period 30 days
Devices stop

Licence active and the Dashboard reachable: traffic, changes and visibility as normal.

Meraki Dashboard One dashboard MX Security and SD-WAN MS Switches MR Access points MX added at the WAN edge of an existing Meraki estate Firewall and SD-WAN requirements checked against the MX model and licence

Cloud-managed branch networking

Meraki MX combines branch security and SD-WAN, managed through the Meraki Dashboard. Templates, remote visibility and central administration make it efficient for networks with repeatable branch designs, and for a small IT team looking after many sites.

Auto VPN builds the site-to-site mesh between MX devices with very little manual configuration. The platform also handles:

  • uplink performance monitoring
  • traffic preferences
  • failover
  • SD-WAN policies

That covers most distributed branch networks whose applications don’t need complex routing and security rules for each traffic class.

Running the branches from one dashboard is a real operational advantage, especially where Meraki switches and wireless are already in place. Firmware updates are scheduled through the dashboard, and new sites can be set up before the hardware arrives. Each site still needs its carriers, addressing, wireless and application dependencies checked.

The dashboard, licensing and security controls

The dashboard: Meraki Dashboard is a cloud service. If it’s unavailable, MX devices keep forwarding traffic on their last configuration, but changes, visibility and cloud-managed features wait until it’s back.

Licensing: this is part of how Meraki works. Meraki licenses devices under co-termination, per-device or subscription models, and an active licence is needed for management and features. When a licence lapses, a 30-day grace period follows. After it, co-termination and per-device licensing stop the affected devices operating. Subscription licensing disables management instead: the devices keep forwarding traffic, but configuration, monitoring and firmware updates through the Dashboard stop. Licence model, tier, term and renewal dates belong in the lifecycle plan from the start.

Security controls: MX provides firewall, IDS/IPS, content filtering and application control, with the features set by the model and licence. Its policy model favours clear, consistent administration. Where custom IPS tuning, detailed SSL inspection, complex segmentation or granular application routing sit at the centre of a project, we test the specific MX model and licence against the requirement.

The wider Meraki estate

An organisation already running Meraki switches and access points gets one dashboard across the whole estate by adding MX at the WAN edge. That’s a sound reason to choose it, as long as the firewall and SD-WAN requirements sit within the MX model and licence proposed.

Multi-site Network Upgrade
Day to day

Where the differences show up day to day

Fortinet

FortiGate’s performance SLAs and application rules matter when a link stays up but performs badly, or when classes of traffic need different paths.

Cisco Meraki

Meraki’s uplink monitoring and SD-WAN preferences serve branches with consistent traffic patterns well.

Either platform

On either platform, performance also depends on the carrier links, routing, DNS, firewall behaviour and cloud paths. Two carriers can still share one physical path, so we test applications and failover on the design itself.

At a glance

Fortinet SD-WAN vs Cisco Meraki at a glance

Dimension Fortinet FortiGate SD-WAN Cisco Meraki MX
WAN performance and failover Performance SLA thresholds, detailed traffic steering and application-aware SD-WAN rules Uplink health monitoring, SD-WAN preferences, Auto VPN and failover set centrally
Firewall and security policy Granular firewall policy, IPS tuning, segmentation, application control and SSL inspection Firewall, IDS/IPS, filtering and application control within a standard cloud-managed policy model
Central administration FortiManager for configuration and policy, hosted where you choose; FortiAnalyzer for logging and analysis Meraki Dashboard for cloud administration, templates, visibility and configuration across sites
Management dependency Management and logging components chosen and operated as part of the design Management and configuration depend on the Dashboard and an active cloud licence
Licensing Hardware, plus the FortiGuard services and management components required Hardware plus an active cloud licence, with features and term set by the licence chosen
Switching and Wi-Fi FortiSwitch and FortiAP under one Fortinet fabric, where that integration helps One Dashboard across MX, Meraki switches and access points
SASE direction FortiSASE and Fortinet ZTNA Cisco Secure Access
Ongoing engineering FortiOS policy, inspection tuning, firmware and change control need clear ownership Templates, licences, Dashboard access and the chosen security features need clear ownership
Fit

Where each platform fits

Fortinet

Fortinet is a strong fit when

  • applications or sites need granular path selection and performance rules
  • firewall inspection, segmentation, VPN and WAN policy have to be designed together
  • an MPLS exit and a security refresh are happening at the same time
  • a security assessment or cyber insurer requires more granular segmentation, logging or application inspection than the proposed Meraki design provides
  • an existing FortiGate estate can move onto one FortiManager-managed design
  • Fortinet secure access is part of the plan
  • FortiOS administration, tuning and patching have a clear owner, in-house or through us
Cisco Meraki

Cisco Meraki is a strong fit when

  • many branches need consistent connectivity and security without engineering effort at each site
  • Meraki switching and wireless already run the estate
  • the IT team is small, and a cloud dashboard reduces configuration effort and the risk of misconfiguration
  • retail, hospitality and service networks need fast zero-touch rollout and simple troubleshooting
  • the MX model and licence cover the security and application requirements
  • SASE isn’t on the near-term roadmap, or Cisco Secure Access suits it
Before choosing

Start with the network already in place

A FortiGate or Meraki estate that already meets the requirements can stay. Support dates, subscriptions, WAN contracts, the team’s skills and the projects ahead decide whether a change pays off.

Switching for features the business won’t use adds cost and risk. Keeping a platform that no longer fits, because a licence has time left, creates its own constraints.

We can assess either path: targeted improvements to what’s there, a staged replacement or a managed network.

Switching

What changes when you switch platforms

Moving between Fortinet and Meraki, in either direction, is more than an appliance swap. Firewall policy, site-to-site VPN, segmentation, application routing, logging, remote access and management processes each change, and so do the skills needed to run the network.

Direction

Meraki to Fortinet: a policy redesign

Meraki configuration doesn’t translate directly into FortiOS. We map address objects, firewall rules, VPNs, segmentation and application priorities against the business applications, then build and test them on the FortiGate design. The redesign is also the time to clear out stale rules, broad access and old exceptions before they reach the new platform.

Before the wider rollout, we put in place:

  • the FortiManager structure
  • administrator access
  • monitoring and log handling
  • FortiGuard licence selection, inspection capacity and firmware standards

FortiOS skills are in place, in-house or through us, before the first site moves.

Running both during the move FortiManager Meraki Dashboard No shared configuration Cutover tests

Each site cutover is its own event. Before the old device is retired, we test site-to-site traffic, remote access, applications, routing and failover. Acceptance criteria, rollback and incident ownership are set for each site in advance. FortiGate and Meraki sites can share the wider network while locations move in stages. Their management stays separate: FortiManager runs the Fortinet sites, the Meraki Dashboard runs the Meraki sites, and no configuration is shared between them.

The cost of changing

Map the dates before setting the timeline

Meraki licences are prepaid for a term, and exiting early may not recover the unused value, depending on the licence model and contract. Add the policy rebuild, retraining and any period when both platforms run side by side.

A renewal or end of support is a good time to compare. The decision follows the total cost of running each platform over the same term.

A typical set of dates across both platforms
Remaining hardware life
Meraki licence terms
FortiGuard renewals
MPLS and carrier contracts
Today Year 1 Year 2 Year 3
Still in term at this point: remaining hardware life, MPLS and carrier contracts, plus the next FortiGuard renewal.
SD-WAN Deployment
Our approach

How we work across Fortinet and Cisco Meraki

Before recommending a platform or a change, we look at the sites, carriers, applications and firewall requirements, the existing equipment and the responsibilities your IT team holds.

Engineering

Network and security engineering

WAN routing, firewall and inspection policy, switching, wireless, secure access and application paths, on whichever platform fits.

Contracts

Existing platforms and contracts

Licence terms, carrier agreements, support dates and the current management model are part of the recommendation. Equipment that still meets the requirement stays.

Operation

Deployment and operation

We deliver the upgrade, manage the network afterwards or work alongside your IT team. Policy ownership, management access, incident handling and carrier escalation are agreed up front.

Recent work

See what we’ve delivered for our clients

Refrigeration & climate technology
Beijer Ref
National SD-WAN rollout
We designed, supplied and deployed SD-WAN across Beijer Ref's national branch network, with branches trading as each site moved across.
Outcome One managed network across the branch estate.
Read the Beijer Ref case study →
FAQ

Common questions about Fortinet and Cisco Meraki

Is Fortinet better than Cisco Meraki for SD-WAN?

It depends on the network and the team running it. FortiGate combines SD-WAN and next-generation firewall in FortiOS, with finer control over routing, firewall policy and inspection, managed through FortiManager. Meraki MX is run from the cloud Dashboard, alongside Meraki switches and wireless, with a simpler model for setting up and running many branches. Application needs, security requirements, the existing estate, licensing and who manages the network decide which fits.

What are the limitations of Cisco Meraki MX?

Mainly policy depth. Meraki’s standard policy model gives less control than FortiOS over SSL inspection, custom IPS, complex segmentation and granular SD-WAN rules. MX also depends on the Dashboard for management and on an active cloud licence: after the grace period, a lapsed co-termination or per-device licence stops the devices, and a lapsed subscription disables their management. For many branch networks, those are fair trade-offs for simpler administration.

Why can Meraki be expensive across many branches?

Each device carries a recurring licence, so across many sites licensing becomes a large share of the total cost. The licence model, tier, term and included security features set the price. Compare complete proposals for both platforms over the same term: hardware, subscriptions, security features, management and engineering, on the models you actually need.

What is Meraki’s main operational advantage?

Simplicity at scale. The Dashboard gives one place for templates, firmware, monitoring and remote support across MX, switches and access points. Zero-touch deployment and scheduled firmware updates make it efficient where sites follow a common pattern.

Can Fortinet and Cisco Meraki run side by side during a migration?

Yes. FortiGate and MX sites can share the wider network while locations move in stages, each managed in its own platform. Routing, VPNs, firewall policy and application access are tested at each site before the old device is retired.

Does Fortinet have a SASE path that Meraki doesn’t?

Both connect to SASE services, but the designs differ. FortiGate connects to FortiSASE and Fortinet ZTNA, keeping branch and remote access in one Fortinet environment. Meraki MX connects to Cisco Secure Access, which means more components to integrate. The ZTNA, web, SaaS and data controls you need, and who will run them, decide the better fit.

How long does a move from Meraki to Fortinet take?

It depends on the number and variety of sites, the complexity of the policy, carrier lead times, application dependencies and licence dates. We set the schedule from those, through assessment, design, pilot sites, staged cutovers and handover into support.

Is Cisco Meraki being phased out because of SASE?

No. Cisco continues to develop Meraki, including its SD-WAN and security features, and its SASE approach integrates MX with Cisco Secure Access. Meraki remains a strong platform for organisations that don’t need SASE from a single vendor.

Should we switch from Meraki to Fortinet?

When the network needs deeper firewall or routing policy, more inspection control or one Fortinet direction across firewall, SD-WAN and secure access. Check hardware support, licence commitments, the cost of redesigning policy and access to FortiOS skills first. If the Meraki estate meets the requirements, a switch adds cost for little gain.

Should we switch from Fortinet to Meraki?

When the network can run within MX’s policy and feature set, and a cloud-managed branch model would reduce administration. Identify the FortiOS inspection, segmentation, routing and secure-access functions that would need a different approach, and weigh the migration, licence terms and support model after cutover. Base the decision on the requirements: frustration with a poorly run Fortinet estate is often fixed by running it well.

Next step

Talk to us before you choose or change your SD-WAN platform

Tell us about your current network, the applications running across it, the security controls you need and where your licences stand. We’ll work through a Fortinet or Cisco Meraki design your team can run, and the cost of keeping or replacing what you have.

Discuss your network Explore Networks & SD-WAN