FortiGate vs Palo Alto performance: how to size it

What each figure measures

Both vendors publish several throughput figures per model. Each one is honest about something different.

The most important line on any firewall datasheet is the footnote. It states the traffic profile, the packet size and which services were enabled. Two figures with the same name and different footnotes describe different tests.

This describes the categories of figure each vendor publishes and the conditions each carries, taken from current Fortinet and Palo Alto Networks datasheets and their footnotes, checked 8 August 2026. We publish no throughput values, because we run no lab and any number here would be a vendor figure repeated without its context. Read the footnote on the datasheet for the specific model you are quoting.

Three rules follow from the table, and together they eliminate most sizing errors.

• Compare a figure only against a figure measured the same way. Comparing one vendor's firewall throughput against the other's threat protection throughput is the most common error in this category and it produces an answer that is wrong by a wide margin.
• Take the figure that matches the services the customer will actually enable, rather than the services on the quote.
• Where a vendor does not publish a figure for a condition you care about, treat that as a question for the reseller rather than as an absence of cost.

Why inspection costs so much

The drop from a headline figure to an inspection figure is large on both platforms, and it is a property of the work rather than of the product.

Forwarding a packet requires a lookup and a decision. Inspecting a stream requires the platform to reassemble it, determine which application it belongs to, evaluate it against signature sets, and in many cases scan the content that is carried inside it. Each of those steps consumes memory bandwidth and processing that the forwarding path does not.

Packet size compounds the difference. A test using large packets moves more bytes for each decision made, which flatters throughput. Real traffic contains many small packets, so the same appliance performs more decisions per byte carried.

Both vendors publish the gap openly and neither hides it. The problem is with comparison rather than with disclosure. A comparison built from the largest number on each datasheet compares two best cases measured differently, and produces a ranking that no deployment will reproduce.

Decryption, the largest variable

Most traffic on a modern network is encrypted. A firewall that does not decrypt is inspecting a small share of what passes through it, whatever its datasheet says.

Decryption is expensive on both platforms. It requires the appliance to terminate and re-establish sessions, perform the cryptographic work in both directions, and then perform all the inspection it would otherwise have done. Where a vendor publishes a decryption figure, it is measured under its own conditions and belongs in the sizing model as its own input.

Three implications matter for an MSP.

• Size for decryption even where the customer has not enabled it. Security reviews add it later, and the appliance chosen without it becomes the constraint.
• Establish the encrypted share of the customer's traffic during the sizing exercise rather than assuming a figure. It is measurable from the existing firewall.
• Treat the exemption list as part of the design. Applications that break under inspection need documented exemptions, and every exemption reduces the share of traffic actually being inspected.

The security consequences of that decision are covered in the security effectiveness page, which argues that TLS inspection is the single largest determinant of whether any inspection capability does anything at all.

The ASIC question

Fortinet designs its own processors and uses them to accelerate specific work. Palo Alto uses a single-pass architecture in which identification and inspection are performed in one coordinated stage. Both are real engineering positions and both are marketed harder than they deserve.

The honest assessment has two parts.

Fortinet's acceleration is a genuine advantage for the traffic it accelerates. Packet forwarding, session handling and IPsec offload are the clearest cases, and they are why Fortinet's forwarding-dominated figures are strong relative to price. A customer whose workload is dominated by bulk transfer or by site-to-site tunnels is a customer where this matters.

The advantage narrows on the workloads that usually decide sizing. Content inspection and decryption are the constraint in most deployments, and both platforms are limited by that work. A comparison that leads with acceleration is describing the part of the workload that is least likely to be the bottleneck.

The practical consequence is that neither architecture argument replaces a sizing exercise. Read the figure that matches the customer's traffic profile, on both platforms, and let the architecture explain the number rather than substitute for it.

Architecture descriptions taken from Fortinet's hardware acceleration documentation and Palo Alto Networks architecture documentation, checked 8 August 2026. The assessment of where each advantage applies is our judgement from operating both platforms, rather than a vendor claim or a measurement of ours.

The sizing method

Run this in order, from the customer's existing environment rather than from an estimate. Every input below is measurable on the firewall they already have.

The vendor-neutral version of this method, including where each measurement comes from and how to itemize headroom, is on the sizing page. This section applies it to the two datasheets in front of you.

A worksheet rather than a result. Every value comes from the customer's own environment, which is the only place a defensible sizing input exists.

Two of these inputs are skipped most often and cause most of the early replacements.

New sessions per second decides more sizing outcomes than throughput at sites with many short-lived connections. A network of thin clients, point-of-sale terminals or heavy web applications can exhaust session establishment capacity while throughput remains unremarkable.

The redundancy model changes the answer by a full tier where a high-availability pair runs active-passive and one unit must carry everything during a failure. Size the surviving unit rather than the pair.

Building your own equivalence

Equivalence exists between a model and a workload rather than between two models.

Once the worksheet is complete, the procedure is short. Take the customer's inspected throughput requirement including decryption. Read each vendor's figure measured with those services enabled, under the conditions in that datasheet's footnote. Find the smallest model on each side that clears the requirement with your headroom applied. Confirm that the same model also clears the session count, the session rate and the VPN load, since throughput alone frequently selects a model that fails on one of the others.

That gives you a pair of models that are equivalent for this customer. It is defensible in a meeting because every step is traceable to a measurement or to a printed vendor figure.

This page publishes no table of model pairs on purpose. Model line-ups change, lifecycle status changes, and datasheet figures are revised. A table published today is quoted in a customer meeting eighteen months from now, and the MSP who trusted it carries the consequence. The method above survives all three kinds of change.

Five sizing mistakes

These are the ones that produce a saturated firewall in year two.

1. Sizing against the headline figure. The firewall throughput number is measured without inspection. A deployment that enables inspection is operating against a different number entirely.
2. Leaving decryption out. It is the largest single variable, it is usually enabled eventually, and adding it later is the most common reason an appliance is replaced before its subscriptions expire.
3. Sizing to today's peak. A model that exactly meets the current peak has no capacity for growth, for services not yet enabled, or for the encrypted share continuing to rise.
4. Ignoring session counts. Throughput and session capacity are separate limits. Many sites reach the session limit first, and the symptom looks nothing like a bandwidth problem.
5. Sizing the pair rather than the survivor. In active-passive high availability, one unit carries the full load during a failure. That is the day capacity matters most.

An undersized appliance is replaced early, and an early replacement costs more than selecting one tier up at purchase. That comparison belongs in the customer conversation alongside the quote, and it is the strongest argument available for the more expensive of two correctly matched models.