Report:

The Forrester Wave™: Enterprise Firewall Solutions, Q4 2024

Top Vendor Products for Enterprise Firewall Solutions in 2024

• Check Point Software Technologies
• Cisco
• Fortinet
• Palo Alto Networks

Enterprise Firewall Solutions Vendor Product Comparisons 2024

• Check Point Software Technologies - Leaders
  

  Pros:

  • Excels in centralized management and UX, offering consistent UI and workflows across cloud and local consoles
  • Supports collaborative administration with granular profiles, policy locking, change reports, and policy revisions
  • Strong incident response capabilities thanks to robust integrations and automation with playbooks for resolving incidents and creating tickets
  • Infinity ELA license streamlines product consumption, offering full-suite access with pay-as-you-go flexibility

  Cons:

  • Roadmap is generic and broadly focuses on AI, not offering significant enhancement to key components that clients rely on to maximize hardware investments for scaled hybrid architecture
  • Needs to refine its communication of the quantum gateway's effectiveness for creating microperimeters, as focus is more on the Infinity platform rather than on leveraging quantum gateways to secure microsegmented networks beyond the network level


• Cisco - Leaders
  

  Pros:

  • Distinguishes itself with a multilayered approach to traffic inspection and decryption
  • Encrypted Visibility Engine (EVE) uses machine learning to identify traffic based on behavioral patterns, including PQC-encrypted traffic, without decryption
  • IDS/IPS powered by Snort3 and SnortML, detects vulnerabilities and is enhanced with Talos threat intelligence for weekly updates
  • Vision aligns well with networking strengths, leveraging these to craft a security strategy that envisions seamless integration of AI and security in the networking fabric

  Cons:

  • Remains challenged in its migration from legacy firewall solutions
  • Reference customers highlight the arduous implementation process and stress the need for the vendor to enhance its migration procedures


• Fortinet - Leaders
  

  Pros:

  • Delivers competitive cost-to-performance united by FortiOS
  • Firewall appliance with top-tier performance, optimized by three dedicated ASIC processors to significantly reduce resource consumption
  • Performs TLS traffic decryption and inspection, including QUIC/HTTP3, with lower impact to performance
  • FortiFlex program provides greater flexibility while delivering a comprehensive solution

  Cons:

  • Falls short on feature parity, with FortiOS UI feeling more intuitive, sleek, and modern compared to the outdated appearance of the FortiManager interface
  • Needs to improve integrations with third-party security orchestration, automation, and response (SOAR) tools
  • Only one of Fortinet's reference customers responded to Forrester's outreach for this evaluation


• Palo Alto Networks - Leaders
  

  Pros:

  • Differentiates with Strata Cloud Manager for centralized management
  • Precision AI automates tasks with data from ML, deep learning, and AI models to enhance platform experience
  • Leading traffic decryption now intercepts and provides visibility into PQC traffic while blocking and downgrading QUIC sessions
  • Each firewall appliance is integrated with AI/ML technology to provide real-time IPS
  • Ambitious roadmap driven by customer feedback highlights capabilities that align with vision for a secure future in the quantum and AI era

  Cons:

  • Remains one of the pricier options in this evaluation
  • Limited feature parity between Strata Cloud Manager and Panorama leaves the latter absent of features for real-time status dashboards and policy optimization


• Juniper Networks - Strong Performers
  

  Pros:

  • Brings compelling AI capabilities with AI-driven Juniper Mist
  • Innovations include dedicated ASICs to improve hardware performance and integrations with cloud
  • Delivers a consistent user experience across its management interfaces — J-Web, Security Director, and Security Director Cloud
  • Intuitive policy creation and management process enables administrators to configure both standard (traditional) and unified (dynamic and granular L7) policies
  • Policy analysis is an embedded function during creation, allowing rules to be automatically reviewed for anomalies and placement within the firewall ruleset

  Cons:

  • Future is uncertain as its acquisition by Hewlett Packard Enterprise, announced in January 2024, is set to be finalized later in the year
  • Overall vision lacks specificity on how the vendor will achieve its vision
  • Roadmap lacks transparency on product enhancements, migration plans, and microsegmentation support
  • Lacks centralized policies since SD-WAN is managed separately through Juniper Mist
  • Reference customers express the need for more information and improved ongoing support services


• SonicWall - Strong Performers
  

  Pros:

  • Delivers formidable malware analysis and mitigation capabilities with its Capture ATP
  • Capture ATP's sandbox incorporates proprietary Real-Time Deep Memory Inspection (RTDMI) to protect against zero-day threats by blocking traffic with suspicious files at the gateway
  • Leverages both local sandboxing and ATP cloud for static and dynamic analysis, delivering verdicts in under a minute and automating the creation and deployment of new signatures

  Cons:

  • Traffic decryption and DNS security trails others in this evaluation
  • Has yet to demonstrate visibility and protection against advanced security protocols or provide standard protection for DoT and DGA
  • Lags in innovation as one of the last vendors in this evaluation to offer native FWaaS and ZTE/SASE
  • Only one of SonicWall's reference customers responded to Forrester's outreach for this evaluation


• Barracuda - Contenders
  

  Pros:

  • Offers a cost-effective solution for SMBs
  • SD-WAN is offered as part of the CloudGen Firewall and SecureEdge with over 100 predefined apps, and it integrates with major cloud service providers
  • Offers straightforward policy configuration and management with granular options for general traffic and SD-WAN policy profiles
  • Traffic encryption is impressive, offering unlimited licenses for S2S and C2S VPN tunnels, including a proprietary TINA mode

  Cons:

  • Vision lacks depth beyond integrating its portfolio
  • Reference customers note a need to further innovate and keep pace with competitors particularly around cloud integrations
  • UI is outdated and cumbersome, resembling a Windows thick client with configuration trees
  • Lacks advanced cipher support to leverage PQC in secure tunnels
  • CloudGen Firewall overall is below par with a cloud offloading capability that is less than optimal for any architecture larger than an SMB


• Forcepoint - Contenders
  

  Pros:

  • 3500 Series provides high-end performance comparable to other vendors in this evaluation
  • Claims 40 Gbps of threat prevention throughput without built-in offloading via dedicated ASICs or CPUs
  • One of the few vendors on this evaluation that supports inspection and decryption of HTTP3/QUIC traffic

  Cons:

  • Has turned attention away from its on-premises firewalls to focus on its ZTE/SASE services
  • Innovation and roadmap are aligned to the vendor's Forcepoint ONE ZTE/SASE offering and not on further developing its hardware appliance for on-premises use cases
  • Security Management Center UX and UI are dated and inconsistent when compared to its Forcepoint ONE counterpart
  • Doesn't offer DNS over QUIC (DoQ) or DNS over HTTP/3 (DoH3)
  • Declined to participate in the full Forrester Wave evaluation process


• Sophos - Contenders
  

  Pros:

  • Remains committed to delivering ease of use for its firewall solution with UX and UI consistent across the firewall control center and Sophos Central
  • Now has built-in SD-WAN and a ZTNA gateway
  • Xstream network processing unit is effective for offloading networking process
  • Vision focuses on delivering cybersecurity as a service, aligning well with its SMB customer base

  Cons:

  • Firewall solution lacks features like a policy analyzer, hit counts, and dynamic integrations that would streamline and simplify policy creation and management
  • Lacks an FWaaS offering
  • Lacks the ability to create robust microperimeters or support advanced microsegmentation strategies beyond the network level
  • Xstream network processing unit does little for security process
  • Declined to participate in the full Forrester Wave evaluation process


• WatchGuard Technologies - Contenders
  

  Pros:

  • Delivers ease of use and management for day-to-day operations
  • Firebox firewalls integrate with APT Blocker, its dual-engine cloud-based sandbox powered by WatchGuard and Bitdefender, to inspect and block suspicious traffic and files
  • Through ThreatSync XDR and NAV integration, Firebox can automate host isolation based on analysis completed in sandbox
  • Reference customers praise its simplicity for creating and managing policies by noting the intuitive implementation and use of template creation
  • Pricing is simple and straightforward, offering customers three license options and payment plans under its FlexPay program

  Cons:

  • Slow to innovate and embrace cloud-native security as it currently lacks comprehensive ZTE/SASE solutions that can tie to its built-in SD-WAN capability
  • Lacks features such as automated alerting or notifications for shadow and stale rules
  • Roadmap remains simplistic with the vendor taking a late market approach to developing ZTE/SASE and consolidating management with its Firebox

Reference

• Forrester, The Forrester Wave™: Enterprise Firewall Solutions, Q4 2024, 02-Oct-2024, ID

View Market Definition
View Vendor Movements