FortiGate vs Palo Alto pricing: the five-year number

Why the percentage is fiction

Search for the price gap between these platforms and you will find confident multiples. Treat every one of them as unusable, for five reasons that all operate at once.

Discount depth is not a property of the product

What a customer pays is a negotiated number, and the negotiation is influenced by partner tier, deal size, whether the vendor is defending an incumbent or displacing one, and where the quarter sits. Two identically specified orders placed by different partners in different months are not the same price. None of that is visible in a published comparison.

The configurations being compared are rarely equivalent

The two vendors do not package security services along the same seams. Fortinet groups services into bundle tiers; Palo Alto names a subscription per capability. That means there is no clean "equivalent configuration" to compare — there is only a configuration that covers the same capabilities, which has to be assembled deliberately on both sides. Most published comparisons skip this and compare a bundle against a partial stack.

Support is a scope difference, not just a line item

Support tiers differ in what they actually entitle the customer to: response commitments, hardware replacement turnaround and the level of engineer reached on escalation. Two quotes carrying support at different tiers are two different products, and the cheaper one is not cheaper for the same thing.

Term length changes the shape, not just the total

A three-year and a five-year commitment do not annualize cleanly against each other, because the discount attached to the longer term is itself negotiated. Comparing a three-year total to a five-year total, or annualizing one to match the other, produces a number that looks precise and means nothing.

Renewal is negotiated separately from the initial order

This is the one that inverts deals, and it gets its own section below.

The seven cost inputs

In rough order of how much they move the five-year number, which is close to the reverse of how much attention they usually get.

1. The appliance

The most discussed and the least important. It is a one-time cost in a five-year model dominated by recurring ones. It matters mainly because sizing it wrong forces an early replacement, which is a far larger cost than choosing a tier up at the start. Size against inspection throughput with decryption accounted for, never against the headline firewall throughput figure.

2. The subscription bundle

The largest recurring line and the one most often mismatched between two quotes. Get the contents listed explicitly on both quotes, capability by capability, rather than by bundle name. Bundle names change; capability lists are checkable.

Each vendor's structure has a cost against it. Fortinet's bundling means a customer frequently pays for services they will never turn on, and moving between tiers at renewal can be a step change rather than an increment. Palo Alto's per-capability subscriptions mean the security posture the customer thinks they bought is several separate line items, and a missing one is easy to overlook until it is needed.

3. The support tier

Compare scope, not price. Ask both vendors to state response commitments and hardware replacement turnaround in the quote itself. For a customer whose firewall is a single point of failure, next-business-day replacement and four-hour replacement are different businesses.

4. Term length

Fix it identically across both quotes before comparing anything. If one vendor will only quote a different term, get both terms from both vendors.

5. Renewal pricing

Ask for it in writing, at the time of the original order, for every year of the model. See below.

6. The management platform

Routinely absent from a first quote and routinely needed by year two. Once a customer is past a handful of firewalls, central management stops being optional, and both vendors license it by managed device count. If a quote does not include it, the quote is for a smaller estate than the one being planned.

7. The operating labor

Never on the quote, always on the profit and loss. It gets its own section too.

Building the five-year model

Fill this in for both vendors, on matched scope, before comparing a single total. The discipline is the point: identical term, identical capability coverage, identical sizing basis.

A worksheet, not a data set. Bonsai publishes no prices for either vendor: the numbers that belong here come from your own quotes, and a figure taken from a web page and repeated in a customer meeting is a liability rather than a shortcut.

Two rows in that table are the ones people leave blank and then regret. Deployment and migration effort is real work with a real cost, and it is not symmetric — moving to a different platform costs more than staying. Operating labor is covered below.

The year-three problem

Initial-order pricing and renewal pricing are negotiated separately. A vendor competing to displace an incumbent has every reason to be aggressive on the first order and much less reason to be aggressive once the customer's policy, staff knowledge and integrations are all built around the platform.

The practical consequence for an MSP is that the quote comparison your customer signs off on may not describe the relationship they end up in. A deal that wins on year one can lose across five years, and by the time that becomes visible the switching cost has become the vendor's negotiating position.

The defense is procedural and it costs nothing: ask both vendors, in writing, at the time of the original order, what renewal will be priced at for every year of the term. A vendor unwilling to commit to that is telling you something useful about years three through five.

The line nobody quotes

Every cost above appears on a piece of paper somebody sends you. The largest recurring cost in a managed firewall does not.

Somebody has to watch it, patch it, change rules on it, respond when it breaks, and be available when it breaks outside office hours. For a customer who expects genuine around-the-clock coverage, that is not one engineer — a real rota needs enough depth that a Sunday-night incident does not depend on one specific person being awake and available. Priced honestly, that line is frequently larger than the appliance and the subscriptions combined, and it is identical in structure whichever vendor wins the hardware decision.

This is also the line where the platform comparison stops mattering. Neither vendor sells you the rota.

Ten questions for both resellers

Put all ten to both, in writing, and the two quotes become comparable. Most of the value on this page is in this list.

1. What inspection throughput is this appliance sized for, with decryption enabled, and what traffic profile was that figure measured with?
2. List every capability included in the proposed subscription, by capability rather than by bundle name.
3. Which capabilities in your product line are not included in this quote?
4. What are the support response commitments and the hardware replacement turnaround at this tier?
5. What is the term, and what does the same configuration cost at the other common term length?
6. What will subscription and support be priced at for each year after the initial term?
7. Does this quote include central management, and at what device count does it become necessary?
8. Does remote access as described here require any additional client, endpoint or posture licensing?
9. What deployment or migration services are assumed, and are they in this figure?
10. What happens operationally if a subscription lapses — what stops working and what keeps working?

Question six is the one most often deflected and the one that most often changes the answer. Question ten is the one nobody asks and everybody eventually needs.