FortiGate 501E & FG1101F equivalent Palo Alto model (below PA-5000)

[mohammedsalhis]

Hello,

I am planning to migrate from Fortinet to Palo Alto.

Current firewall: FortiGate 501E Edge & DC

Current Firewall: FortiGate 1001F Edge & DC

Deployment: Enterprise edge
All security features enabled (IPS, App-ID, URL filtering)

I am looking for the closest Palo Alto equivalent model,

Which model would you recommend and why?

Thank you 

[BPry]

@mohammedsalhis,

I would highly recommend engaging your local sales team so that they can run an analysis and recommend appropriate hardware. One of the hardest things with you just giving us models is that we don't know why you went with that unit, if it's actually sufficient for your existing installation, and what your requirements actually are. If you are pricing a PAN with everything enabled, but your existing Fortinet is just a stateful firewall we're not going to be looking at remotely the right comparisons. You could have been moved up-market on the Fortinet due to SSL Inspection CPS, which isn't as big of an issue on PAN, or you could have missed the mark on sizing completely initially.

The direct simple comparison for your 501E would be the PA-1410. You would absolutely want to know more about your existing setup before recommending you proceed, because again we don't know what you currently have. If you have 10 VDOM configured on your 501E (which is supported) and need to maintain it, the entire 1400 series is out of consideration because it can only have a maximum of 6 VSYS.

Likewise with your 1001F, the lowest market comparison would be your PA-3430 assuming that you're actually hitting near the 1001F top performance figures, which you likely aren't. There's again however quite a few additional aspects that you would want to consider before outright saying go buy that as the replacement.

Overall, just giving model numbers and asking for a replacement is asking for trouble when you actually make the purchase. You need someone that can look at your existing configuration and what your current systems are actually getting hit with, determine if you can make any necessary adjustments that would let you go down-market or up-market, and give you a proper replacement. 

What you're essentially asking for, and getting, is an 'educated guess' of what might work in your environment based solely off of a common environment and datasheet numbers of your existing hardware. That is not how you should be making hardware purchases. It will work 92% of the time, and 8% of the time replacing hardware like this is going to put you in a world of hurt and make you very unhappy. Get your sales team involved to scope this replacement, it's literally why PAN pays sales engineers.