How to choose between FortiGate and MikroTik for a branch

Choosing between FortiGate and MikroTik does not start with port throughput or the price of the box. First decide exactly what the branch gateway must recognize, who will review its events, and how many hours the organization is prepared to spend on regular maintenance. Although both devices can fill the role of a router at the edge, they solve different operational problems.

FortiGate makes more sense when the perimeter must provide updated application and website classification, IPS, file inspection, and one set of policies for several sites. MikroTik makes more sense when the job calls for good routing, IPsec, link failover, and precise packet filtering, while other tools provide advanced security. Buying a MikroTik as a cheap NGFW usually ends with homegrown address lists. Running a FortiGate without the necessary subscriptions and an event review process turns an expensive NGFW into an ordinary firewall.

How to decide before choosing a model

Start by recording the required outcome for traffic, connectivity, and operations. A vendor name should not appear in that description. If the team cannot state its requirements without naming a device, it is still comparing catalogs rather than solutions.

For a typical branch, I fill in four rows:

This table separates projects quickly. If connection state, address lists, segmentation, and a tunnel to the center are enough, RouterOS provides all the required detail. If the gateway must distinguish an approved cloud service from an unwanted application on the same TCP 443 port, receive attack signatures, and apply web categories, the comparison shifts toward FortiGate with active FortiGuard services.

Do not write "protect the branch" as a requirement. Turn it into tests: a malicious domain is blocked, an unknown inbound session is dropped, the guest network cannot reach accounting, the point of sale keeps working over the second provider when the first one fails, and the event reaches the person responsible for reviewing it. Some attractive features will then remove themselves from the quote.

Decide separately what happens to IPv6. Leaving the protocol enabled on clients without an equivalent rule set is worse than consciously operating only IPv4. Both platforms filter IPv4 and IPv6 with separate policy sets, so acceptance testing must repeat the checks for every stack that is actually reachable. List every gateway management method as well: GUI, SSH, API, console, and access from the center. Every remote method needs a restricted source, a separate account, and an action log.

These platforms provide different classes of filtering

FortiGate can make decisions using data that an ordinary packet filter does not have: URL categories, domain reputation, intrusion signatures, application type, and antivirus scan results. The official FortiOS guide describes FortiGuard as a collection of signature packages and query services. That wording matters: the device applies a local policy, but the quality of many decisions depends on a continuously updated external database and a valid subscription.

RouterOS has a capable stateful firewall. The administrator builds rules in the input, forward, and output chains, using connection state, interface, address, protocol, port, address list, and other attributes. That is enough to protect the router itself, isolate VLANs, restrict administrative access, and explicitly permit corporate flows. I consider the "allow what is needed and drop everything else" approach in the MikroTik manual the right starting point for a branch with a known set of services.

The L7 matcher in RouterOS does not turn it into an NGFW. It searches for a pattern in a stream, consumes CPU, and is a poor fit for modern encrypted traffic. Static address lists are not the same as a reputation service either. Someone must collect the sources, remove false positives, manage entry lifetimes, and prove that a failed list download has not gone unnoticed.

The difference becomes clear in an unpleasant incident. A user opens a recently created phishing domain over HTTPS. MikroTik rules allow DNS and TCP 443 because the network flow itself is permitted. A separate DNS filter or endpoint security agent might still stop the request, but that is another layer. A FortiGate with a suitable subscription and configured DNS or web filter can apply category and reputation data at the gateway. The word "can" matters: the security profile must be attached to the correct firewall policy, while the license and access to the service must both be working.

There is an opposite mistake: enabling every profile on one rule and treating the number of detections as a measure of protection. Noisy signatures without an owner create a queue that people stop reading. Define an action for every event class: block immediately, log only, send to the central system, or refer for investigation. Start in monitor mode where a false positive would stop the business, collect the applications actually in use, and then tighten the policy. Give that transition a deadline, or temporary monitoring will remain forever.

HTTPS limits what filtering can promise

Without TLS decryption, no gateway can see all content in a modern HTTPS session. It can use available metadata, certificates, DNS observations, IP reputation, and selected protocol attributes, but it cannot read an arbitrary file inside the encrypted connection. A supplier's claim that a device "inspects all web traffic" therefore means nothing unless it names the SSL inspection mode.

FortiOS offers certificate inspection and deep inspection. In the first mode, the device does not intercept the TLS session and works with a limited set of visible attributes. In the second, FortiGate terminates the encrypted connection from the client, creates another connection to the server, and inspects the clear content between them. On managed workstations, this requires a trusted corporate certificate authority, carefully scoped exceptions, and tests for applications that use certificate pinning. Deep inspection usually cannot be deployed correctly on guests' personal devices.

The official FortiOS guide also distinguishes flow-based and proxy-based inspection. Flow mode matches content against patterns while it passes through, while proxy mode reconstructs an object before deciding what to do with it. The available feature set and processing cost differ. You cannot buy a model using the firewall throughput figure and then enable IPS, antivirus, and deep inspection on all traffic. Sizing must use the inspection profile that will actually run and the size of typical sessions.

The right MikroTik strategy is more modest. It should filter the network attributes it can see, send corporate DNS to a controlled resolver, close bypass paths, and leave protected content inspection to managed endpoints or a separate proxy. Homegrown TLS inspection beside RouterOS adds another product, certificates, logging, and failure points. Once those parts are counted, the cheaper option sometimes stops being cheaper.

There is a legal side too. Traffic decryption touches personal data, banking applications, and private communications. Before enabling deep inspection, agree on the networks and exclusions with process owners and compliance staff. Technical capability does not replace a lawful basis or clear notice to employees.

Both use IPsec, but the tunnel operates differently

Both platforms can build site-to-site IPsec to the head office. For one branch with one provider, the result may look the same: local subnets appear in the policy, IKE negotiates parameters, ESP carries the traffic, and routes direct corporate networks into the tunnel. The difference grows with the number of branches, links, and people changing the configuration.

FortiGate makes it convenient to combine IPsec with SD-WAN, link health checks, and consistent policies. In large hub-and-spoke designs, ADVPN lets branches create direct dynamic tunnels to one another when needed instead of always passing through the central node. Not every branch benefits from this. If all access ends at the center anyway, a simple static tunnel is easier to test and recover.

RouterOS provides the full set of building blocks: IPsec profiles and proposals, peers, identities, policies, routing, netwatch, scripts, and multiple routing tables. An experienced engineer can build dependable failover from those blocks. The platform will not infer the architecture or protect the engineer from conflicting rules.

The MikroTik documentation walks through a revealing failure. A general masquerade rule changes the address before the packet matches the IPsec policy, so encryption never starts. The fix places an exception above the general NAT rule:

/ip firewall nat
add chain=srcnat action=accept place-before=0 \n    src-address=10.20.0.0/24 dst-address=10.0.0.0/8 \n    comment="bypass NAT for HQ IPsec"

After adding the rule, clear the old connection or wait for it to end, because conntrack will keep applying the previous decision. A second conflict involves FastTrack: an accelerated flow can bypass the IPsec policy. The official example recommends excluding that traffic before FastTrack or correctly taking it out of connection tracking. This is not a defect in IPsec. It is the cost of explicitly controlling packet processing order.

On either platform, agree on current cipher suites, use unique credentials for each site, limit selectors to the required subnets, and enable DPD. Test MTU by transferring large packets and running an application test, not merely by looking at a green tunnel status. A tunnel can be up while ERP stalls because of fragmentation or the return route leaves through another provider.

Routing matters more than the logo at either end. Record who advertises the branch network, what happens to the route when the tunnel fails, and whether asymmetry is allowed. A static route with a reachability check works for a simple pair of links. BGP makes sense when there are many routes and sites, but it adds filters, timers, and another class of mistakes. Do not introduce a dynamic protocol merely because the device supports it.

Measure performance after enabling protection

The routing speed in a data sheet does not show how much traffic will pass through a working branch policy. A device incurs different costs when processing large UDP packets, many short TCP sessions, IPsec, and decrypted web traffic. Comparing one maximum FortiGate number with one MikroTik number is pointless.

For FortiGate, record firewall throughput, IPsec throughput, threat protection throughput, and SSL inspection throughput for the exact model under consideration. Then read the notes on the vendor's test method, because profile selection, packet size, and inspection mode affect the result. Leave headroom for signature updates, link growth, and bursts of new connections. A small branch rarely runs out of gigabits alone, but it can easily run out of session capacity or CPU during deep inspection.

For MikroTik, read the test table for the exact hardware model and use the row closest to your firewall rules. A FastPath result with large packets cannot be carried over to a long filter chain, queues, and IPsec. Check whether the chosen processor supports hardware acceleration for the required ciphers, but still measure your own configuration.

A useful pilot reproduces at least four flows:

1. Normal internet access with the profiles that will remain enabled after launch.
2. A large file transfer over IPsec in both directions.
3. Several thousand short connections if the branch runs point-of-sale systems, VDI, or many web requests.
4. Simultaneous failure of the primary WAN and increased traffic on the backup.

Record CPU load, memory, loss, latency, and failover time. Also record which inspections had to be disabled to reach acceptable speed. If the model passes only with IPS switched off or without required rules, the pilot has failed even if the throughput graph looks impressive.

FortiGate subscriptions buy data, MikroTik uses engineering time

FortiGate cost includes the appliance, the required FortiGuard bundle, FortiCare support, centralized management and logging where required, and implementation work. The current FortiGuard ordering guide separates ATP, UTP, and Enterprise bundles by included services. Do not carry a bundle name from an old quote into a new project automatically. Verify the current SKU and the included service list through an authorized channel.

A subscription is not required merely to route packets or run a basic firewall. It pays for updated IPS and antivirus definitions, web ratings, query services, and other parts of the chosen bundle. FortiCare is separately associated with technical support and firmware update entitlement. Before purchase, request a quote covering at least the organization's normal budgeting horizon, renewal terms, and the consequences of each item expiring.

A hardware MikroTik already includes its RouterOS license. The MikroTik guide states that hardware licenses do not expire and include unlimited software upgrades. There is no annual charge for IPS databases or web categories because RouterOS has no equivalent cloud databases. A zero subscription cost means a different security scope, not a free copy of FortiGuard.

The commercial quote should separate mandatory and optional items. Ask the supplier to mark the service without which a claimed function disappears, support that provides access to updates and cases, and each separate management component. Record the term, start date, renewal process, and non-renewal outcome for every item. A first-year price with a promotional bundle is a poor comparison if the device will remain in service much longer.

Count the work that often stays hidden:

• maintaining the firewall and address lists;
• checking updates and backups;
• reviewing logs and configuring external syslog;
• testing IPsec after changes;
• replacing hardware and restoring its configuration.

If a central engineer already manages RouterOS and has templates, monitoring, and spare devices, the marginal cost of another branch will be low. If every site is maintained from memory by a new contractor, subscription savings quickly turn into diagnostic hours. FortiGate has no magic either. Unreviewed events, expired licenses, and unsupported FortiOS releases cost more than a carefully maintained RouterOS deployment.

Administrator skill changes the risk

MikroTik requires an administrator who understands packet flow, connection tracking, NAT, routing, IPsec selectors, and rule order. WinBox makes configuration faster but does not explain the consequences. The most dangerous configuration appears to work: internet access is available and the tunnel is green, while management is exposed on the WAN or IPv6 bypasses the carefully built IPv4 filter.

A minimally qualified RouterOS owner can read a configuration export, find a rule by its counter, trace a packet through raw, mangle, NAT, and filter, update a device safely, and recover it without the old flash storage. That person understands which flows bypass FastTrack. If the company lacks these skills, it must buy them as a service and define a response time.

FortiGate reduces manual construction but requires a different skill set. The administrator must understand firewall policy order, security profile assignment, certificate and deep inspection, flow and proxy mode, license state, logs, and the supported FortiOS upgrade path. Clicking IPS in the interface is easy. Verifying that the profile is attached to the right policy, signatures update, an exception has narrow scope, and the event reaches its owner is considerably harder.

Repeatability matters across several branches. With MikroTik, use reviewable text exports, templates, and automated comparison with a baseline, while storing certificates and secrets separately. RouterOS documentation warns that export omits system user passwords, installed certificates, SSH keys, and certain databases. A binary backup is not a universal portable template either, because the vendor recommends restoring it to the same RouterOS version.

Centralized management and analysis in the Fortinet ecosystem usually use separate components. Their licenses, server resources, and required skills belong in the project. Buying ten identical gateways does not create unified management by itself.

Design updates and failure before installation

A secure perimeter must survive more than an attack. It must also survive a failed update, a dead power supply, a lost provider, and the absence of an engineer at the branch. A device that nobody can replace within the agreed time does not meet the requirement, regardless of its feature set.

For either option, keep a current configuration outside the device, record the system version, and test recovery on a spare. For MikroTik, keep both an encrypted backup and a text export because they solve different problems. After a RouterOS update, check the board firmware, IPsec, FastTrack exceptions, the IPv6 firewall, and access to centralized logging.

For FortiGate, determine the supported path between FortiOS versions in advance, make a backup, and verify configuration compatibility. Jumping "straight to the latest" across several intermediate branches may violate the recommended sequence. Working internet after the reboot is not enough. Check FortiGuard registration, database versions, IPsec in both directions, security profiles, and event delivery.

Not every small branch needs HA with two appliances. A pair in one rack does not protect against a powered-down cabinet, a cut last mile, or a bad policy synchronized to both nodes. Sometimes one spare gateway at a regional center, a ready configuration, and a clear instruction provide a better recovery time for less money. Local HA and two independent WAN links may be justified for a branch that runs continuous point-of-sale or medical work.

Assign an update window and the authority to stop the rollout. If CPU load rises at the first site, a critical service stops opening, or IPsec behavior changes, the other branches should wait. Centralized management distributes a correct change quickly and multiplies a mistake at the same speed.

Four branches produce four different answers

For a small office with ten workstations, one tunnel to the center, and all internet traffic backhauled through the head office NGFW, I usually choose MikroTik. The branch keeps routing, local segmentation, and IPsec, while content inspection happens centrally. This choice has one condition: a branch link failure must not silently release users directly to the internet without an equivalent policy.

For a remote office with local internet breakout, a guest network, and users who regularly open external attachments, FortiGate looks more sensible. A UTP subscription or another suitable current bundle makes sense if the organization actually enables web or DNS filtering, IPS, and antivirus and delivers logs to an owner. Select the bundle by its contents, not by habit.

For a store with two providers, a small fixed set of cloud destinations, and centrally managed endpoint protection, MikroTik often wins on cost. Rules can be narrow and point-of-sale reachability can be tested separately. If the cloud address list changes often and the supplier publishes it without a convenient format, add maintenance work to the price.

For a regional office with local servers, many VLANs, direct internet access, and a requirement to review attacks locally, I would prefer a properly sized FortiGate. NGFW functions run at the actual perimeter, and capacity planning includes active inspection. If the organization already has mature independent DNS filtering, EDR, NDR, and centralized logs, MikroTik can return to the shortlist, but the design must show which layer covers each threat.

These examples do not create a rule based on employee count. User numbers are a poor predictor of session counts, TLS volume, and downtime cost. One diagnostic device in a clinic can require a more dependable link than forty office laptops.

A pilot must test failure, not interface convenience

A good pilot ends with an acceptance record containing numbers, logs, and named owners. An interface demonstration shows where a button is, but it does not prove that the branch will survive a real failure.

Give both candidates the same configuration: production VLANs, the actual IPsec connection to the central site, primary and backup WAN links, real egress rules, logging, and required security profiles. Then disconnect each link in turn, reboot the device under traffic, issue a blocked DNS request, try unauthorized inter-segment access, and restore the configuration to a spare appliance. Record detection time, failover time, and manual intervention.

The record must answer five questions:

1. Which threats the gateway blocks by itself and where it gets the data for that decision.
2. What stops working when each subscription or support agreement expires.
3. Who receives an event, who reviews it, and within what time.
4. How the connection is restored after complete device loss.
5. What hardware, services, and labor cost over the full budgeting horizon.

Do not allow one participant to demonstrate FortiGate with deep inspection and every profile while the other measures MikroTik with FastPath and an empty firewall. Those are two different tests. The comparison is fair only when both produce the same application outcome.

For organizations in Kazakhstan, GSE can connect the perimeter choice to the wider server and network architecture through a vendor-neutral approach and a nationwide service network with 24/7 support. Responsibility for acceptance criteria still belongs to the customer. An integrator can build the system, while the business owner defines acceptable risk.

If both devices meet the requirements after the pilot, choose the option with simpler recovery and an available configuration owner. If no engineer can explain why a packet passes each rule, the branch is not ready for installation.