MikroTik or Fortinet firewall: which one for an SME?

This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.

MikroTik and Cisco are not comparable as two brands of the same nature. MikroTik ships its hardware with RouterOS and a permanent license, without a security subscription, but without native IPS. Cisco today offers Secure Firewall and Meraki MX firewalls whose advanced security functions rely on subscriptions. AsloTech supplies and installs MikroTik and Fortinet firewalls; Cisco, Sophos, pfSense and OPNsense are cited here for comparison. The right choice depends on the person who will administer the equipment, the functions you need (VPN, VLAN, IPS, web filtering) and the renewal cost of licenses. This article compares these families on those criteria; prices are given by quote.

The brands supplied by AsloTech: MikroTik and Fortinet

MikroTik

MikroTik is a Latvian company founded in 1996 in Riga. Its system RouterOS equips its RouterBOARD devices and can also be installed on a PC or in a virtual machine. In the manufacturer’s catalogue: small routers (hEX and hAP series) for an office, the RB5009 model and the CCR (Cloud Core Router) series for higher throughput, and the CRS (Cloud Router Switch) series for switching, with routing functions depending on the model. The chosen model for your site is selected by quote, based on your connection speed and the functions to enable.

Advantages

• Permanently licensed RouterOS delivered with the device: no subscription to activate the firewall, VPN or VLANs. The license level sets certain usage limits, such as the number of tunnels or captive portal users.
• Full stateful firewall (filter, NAT, mangle and raw tables), VLAN, queueing to limit throughput, Hotspot captive portal, IPsec, and WireGuard since RouterOS 7.
• One device can act as router, firewall, DHCP server and VPN gateway.
• Official documentation and a large user community.

Limitations

• No native IPS signatures or web category filtering. If you need them, you must add a device or service.
• Everything is configurable, so an overlooked rule stays open: it is the installer’s job to close what must be closed.
• The administration must be protected. In 2018, the CVE‑2018‑14847 flaw in WinBox was exploited against routers reachable from the Internet. It has been fixed, but the rule remains: do not expose WinBox (TCP 8291), SSH or the web interface on the Internet connection, and keep RouterOS updated on the “stable” or “long‑term” channel.
• The troubleshooting relies on the installer, documentation and manufacturer forums: that is why you should entrust installation and follow‑up to a provider who knows the brand.

Fortinet FortiGate

Fortinet is an American company (Sunnyvale, California). Its firewall range is called FortiGate and runs on the FortiOS system. As with MikroTik, the model suited to your site is determined by quote, based on the number of users, your connection speed and the security services to enable.

Advantages

• Security services (IPS, antivirus, web filtering) are available in the range and provided by FortiGuard subscriptions: you do not need to add a second device to obtain them.
• Stateful firewall and IPsec VPN on the same device (a FortiGate can establish a tunnel with a MikroTik, a Cisco or a pfSense: see Enterprise VPN).
• Administration via the FortiOS web interface or command line.

Limitations

• Security services rely on subscriptions to renew. Without a subscription, the FortiGate continues stateful filtering, but its signatures are no longer updated: this cost is planned over the firewall’s lifespan.
• The manufacturer’s datasheets distinguish the “firewall only” throughput from throughputs with IPS or VPN enabled. Size according to the services you will activate.
• As with any brand, a too broad rule or an administration open to the Internet negates the device’s benefit.

Families mentioned for comparison

Cisco

Cisco Systems is an American company founded in 1984. For a SME firewall, three names recur:

• Secure Firewall (Threat Defense), formerly Firepower: the current next‑generation firewall line.
• ASA 5500‑X (Adaptive Security Appliance): Cisco announced the end of life for this family, with sales and support discontinued. Do not buy a used ASA for a new project: it no longer receives security patches.
• Meraki MX: managed firewall from a cloud dashboard, handy for monitoring multiple sites.

Advantages

• Advanced security features (IPS, URL filtering, anti‑malware) are built into the line, with possible centralized administration for multiple sites.
• Cisco training and certifications (CCNA, CCNP, CCIE): technicians are trained, but no certification is required to administer a firewall.
• Manufacturer support contracts.

Limitations

• Advanced features require subscription licenses, which must be renewed. A Meraki MX needs a valid license: upon expiration, after a grace period, the device or organization is disabled per Meraki documentation.
• Administration tools vary by line (local, centralized or cloud).
• The total cost includes hardware, licenses and support, not just the purchase price.

Other options

• Sophos Firewall (formerly XG Firewall): British company. As with Fortinet, check the datasheet for included services and those requiring a subscription.
• pfSense and OPNsense: open‑source firewalls based on FreeBSD, with OPNsense derived from a split of pfSense. They run on a PC or x86 chassis: you choose the hardware, and system maintenance is yours or your provider's. pfSense CE is free; pfSense Plus is the commercial edition shipped with Netgate devices. IPS can be added via modules (Snort, Suricata).

Comparison by criteria

Also read the throughput on manufacturer sheets. They often distinguish the “firewall only” rate from the rate with IPS or VPN enabled: keep the one that matches the functions you will use.

How to choose between these families?

Start with your needs, not the brand:

1. Who will administer the equipment? A technician comfortable with command line will benefit from RouterOS. Without a trained administrator, a range with guided interface and manufacturer support avoids mistakes.
2. Which functions are needed? VLAN, guest Wi‑Fi with captive portal, site‑to‑site VPN and bandwidth limiting are possible on MikroTik and pfSense. If you also want an IPS or category‑based web filtering, choose a range that integrates it, like Fortinet with subscription, or add dedicated equipment.
3. What real throughput? Size with your Internet connection rate and the enabled functions, not with the maximum advertised rate.
4. What budget over several years? Add hardware, renewable licenses and installation and maintenance services.
5. What continuity? Plan a configuration backup, a UPS, and if the activity depends on Internet, a second connection.

Between the two brands we supply, the rule is simple. MikroTik works when the need is limited to filtering, VLANs, VPN, bandwidth limiting and captive portal, without a renewing security subscription. Fortinet works when you also want an IPS, antivirus or category‑based web filtering, with a FortiGuard subscription budget planned over the firewall’s lifespan. In both cases we start from your existing network to propose the model.

How much does a firewall cost?

AsloTech does not publish firewall prices: the rate depends on the model, your connection throughput, functions and licenses, and is quoted. The total cost consists of four elements:

• the hardware;
• licenses and subscriptions: no security subscription for MikroTik, renewing FortiGuard subscriptions for Fortinet security services;
• installation, configuration, acceptance testing and commissioning;
• maintenance and update monitoring (see IT maintenance contract).

To compare two quotes, request them for the same scope: number of users, connection throughput, functions (VPN, VLAN, IPS, web filtering) and subscription duration.

Common mistakes on site

• Administration interface exposed to the Internet: WinBox, SSH or web interface accessible from the public connection.
• “Allow all” rule left after troubleshooting.
• Original admin password retained.
• Double NAT : the firewall is connected behind the operator’s box, which also performs NAT. Port forwarding and VPN become difficult. Put the box in bridge mode if it allows, otherwise configure a DMZ on the box that points to the firewall.
• No configuration backup : a replaced device after a failure forces you to reconfigure from scratch. Export and keep the configuration after each change (see also the 3-2-1 backup rule).
• Firewall stored anywhere: place it in the network rack, powered by a UPS.

Next steps

Check our page network security and firewall to study your needs with us: we supply and install MikroTik and Fortinet firewalls, on quote. Our page computer networks covers cabling and active equipment. You can also read how to connect your sites with a VPN, segment your network with VLANs, or size the Wi‑Fi. A computer maintenance contract allows you to track firewall updates.

Frequently asked questions

Also read