European Alternatives to Fortinet
Looking for a European alternative to Fortinet? Fortinet, Inc. lists its headquarters at 909 Kifer Road, Sunnyvale, California, so the vendor behind FortiGate firewalls is established under US jurisdiction, which matters for buyers who must keep network infrastructure with European suppliers. Switching vendors also means moving firewall policies, VPN tunnels and licences, so the decision is usually made at hardware renewal.
The European firewalls below come from companies in Germany, France, Sweden, the Netherlands, Italy, the UK and Israel, and range from government-qualified appliances to open source software you run yourself.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects which tools are listed. Editorial policy
10 European Alternatives to Fortinet
Stormshield
French network firewalls qualified by ANSSI, for IT and OT
genua
Two-box high resistance firewall for classified networks
R&S LANCOM Unified Firewalls
German UTM firewalls from the LANCOM line, hardware or virtual
Securepoint
German UTM firewalls with an all-inclusive licence per device
OPNsense
Open source firewall platform developed by Deciso
Clavister
Swedish NetWall firewalls for defence, energy and telecom
Sophos Firewall
XGS appliances managed from a cloud console
Endian
South Tyrol UTM gateways for office and industrial networks
Check Point
Israeli enterprise firewalls from branch to data centre
IPFire
Free open source firewall distribution, single edition
Key takeaways
- Fortinet, Inc. lists its headquarters at 909 Kifer Road, Sunnyvale, California, so the vendor behind FortiGate is a US company.
- Stormshield (France) and genua (Germany) are the two alternatives with published government assurance: ANSSI qualification and Spanish CCN approval, and Common Criteria EAL 4+ with German VS-NfD approval.
- OPNsense (Netherlands) and IPFire (Germany) are open source, with OPNsense Business Edition at EUR 149 per year for one installation and IPFire at no licence cost.
- Sophos Firewall is contracted in the United Kingdom and Check Point in Israel, so only eight of the ten alternatives are inside the EU.
- None of the commercial alternatives prints a price, so the quote is the first step of any comparison with a FortiGate renewal.
Why people leave Fortinet
Fortinet, Inc. gives 909 Kifer Road in Sunnyvale, California as its address on the contact page, and its best-known product line for this comparison is FortiGate, the firewall appliance family. A firewall is the one device that every packet between your offices, your data centres and the internet passes through, so the question of who builds it and under which law is a procurement question as much as a technical one.
Buyers who start looking beyond Fortinet are rarely reacting to a single event. The usual trigger is a rule on the tender: a public body, a defence supplier or an operator of critical infrastructure that must source network equipment from European suppliers, or a data protection officer who wants the vendor's contracting entity inside the EU. A US headquarters does not make a firewall insecure, but it does mean the supplier is established under US jurisdiction.
This page treats that as the starting point and not as a verdict. We confirmed Fortinet's headquarters address and nothing else, so we make no claims about its prices, licence terms or vulnerability record. The ten alternatives below are compared on what each one publishes: a national qualification, a licence model, a hardware or software form and a European contracting party.
- The supplier is established in California Fortinet lists a Sunnyvale address, so the company contracting with you sits under US jurisdiction. For organisations that must keep network infrastructure with European suppliers, that settles the matter before any feature comparison starts. Every vendor on this page is a company in France, Germany, the Netherlands, Sweden, Italy, the United Kingdom or Israel, which changes the legal party you sign with and the courts that would hear a dispute.
- Published national assurance exists in Europe Some tenders ask for a qualification from a national agency, not a vendor claim. Stormshield publishes an ANSSI qualification and Spanish CCN approval for its firewalls, and genua states Common Criteria EAL 4+ and approval for German VS-NfD, NATO RESTRICTED and EU RESTRICTED. If your buyer's checklist names one of those bodies, a European vendor can answer it directly with a document.
- Licence models you can read before you buy Switching also lets you choose the licence shape. Securepoint describes one licence covering hardware, software, service and support, R&S LANCOM sells runtime licences of one, three or five years, and OPNsense prints a Business Edition price of EUR 149 per year per installation. IPFire has no tiers at all. Most of the commercial vendors still quote privately, so the benefit is the structure of the licence, not a lower figure.
- Open source and offline options Two alternatives publish their code and run on hardware you pick: OPNsense from the Netherlands and IPFire from Germany. genua states that its licence can be activated offline and patches applied by hand, which suits networks without an internet path. A buyer who wants to audit what runs on the perimeter, or to operate with no vendor connection at all, has choices on this page that depend on neither a cloud account nor a subscription.
What you have to replace, not just match
What you replace is a rule base and a set of tunnels, not just a brand. FortiGate firewall policies, address objects, NAT rules and site-to-site VPN definitions have to be rebuilt in the new vendor's model, and the licence you pay each year has to be replaced with whatever the new vendor sells. Inventory the features you actually switch on before you shortlist anyone: intrusion prevention, application control, SSL inspection, remote-access VPN, SD-WAN and high availability.
The European products cover those functions in different packages. R&S LANCOM names deep packet inspection, SSL inspection, IDS/IPS, sandboxing and IPsec, SSL and WireGuard VPN. Securepoint adds a content filter, Geo-IP blocking and an included VPN client. OPNsense and IPFire cover the firewall, VPN and, for OPNsense, Suricata intrusion prevention, while central multi-site management is where the open source tools and the commercial suites differ most.
Do not forget the management layer around the box. A fleet of FortiGates is usually operated through a central console, logging and reporting. On this page the equivalents are the LANCOM Management Cloud, Securepoint's Unified Security Console, Endian Switchboard, genucenter, Sophos's cloud console and OPNsense's OPNcentral plugin. Ask each candidate how it handles configuration backups, firmware rollouts across sites and log export to your existing SIEM.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Stormshield | Issy-les-Moulineaux, France | Enterprise pricing on request | EU (France) |
| #2 | genua | Kirchheim (Munich), Germany | Pricing on request | EU (Germany) |
| #3 | R&S LANCOM Unified Firewalls | Wuerselen, Germany | Runtime licences of 1, 3 or 5 years; prices on request | EU (Germany) |
| #4 | Securepoint | Lueneburg, Germany | Pricing on request; rent, purchase or managed service | EU (Germany) |
| #5 | OPNsense | Middelharnis, Netherlands | Community edition free; Business Edition EUR 149/year per installation | EU (Netherlands) |
| #6 | Clavister | Ornskoldsvik, Sweden | Pricing on request | EU (Sweden) |
| #7 | Sophos Firewall | Abingdon, United Kingdom | See website | United Kingdom (adequacy decision, outside the EEA) |
| #8 | Endian | Bolzano, Italy | Pricing on request | EU (Italy) |
| #9 | Check Point | Tel Aviv, Israel | See website | Israel (outside the EU/EEA) |
| #10 | IPFire | Datteln, Germany | Free software; appliances and support sold in the IPFire store | EU (Germany) |
How each alternative compares to Fortinet
Best for: French and EU public bodies and operators that must show a national qualification for the perimeter firewall
Stormshield is based in Issy-les-Moulineaux, France, and is a wholly-owned subsidiary of Airbus Defence and Space Cyber Programmes. Its firewall line is the SNS range, with industrial SNi models and ruggedised SNxr models for constrained environments. The category page lists the firmware as ANSSI-qualified and notes Spanish CCN approvals.
Against Fortinet the point is not a feature but a document: where a procurement asks for a qualification from the French national agency, Stormshield can supply it from a French contracting entity. Stormshield says it processes data mostly within the EEA, with standard contractual clauses for the rest. Pricing is quoted, so the first move is a request for a quote.
What Stormshield does better than Fortinet
- French contracting entity and a parent in the European defence industry, where Fortinet lists a Californian address
- Published ANSSI qualification and Spanish CCN approval for the firewall firmware
- Industrial SNi and ruggedised SNxr models in one family
- Data processing described as mostly within the EEA
Where Stormshield is a step down from Fortinet
- Prices are quoted, not published
- Partner coverage outside France is not documented on the pages we reviewed
- Aimed at regulated buyers, so a small office finds simpler offers elsewhere
Standout against Fortinet. Stormshield is the alternative to pick first when the tender text asks for ANSSI or CCN.
Best for: Government, defence and critical infrastructure networks with classification rules and offline segments
genua GmbH of Kirchheim near Munich, registered in Munich under HRB 98238, builds genugate, a firewall that runs the packet filter and the application level gateway on two separate computers. It states Common Criteria EAL 4+ with AVA_VAN.5, and approval for German VS-NfD, NATO RESTRICTED and EU RESTRICTED. The range also includes genuscreen, genuwall, a data diode and genucenter.
Compared with a single-box FortiGate the design trades simplicity for isolation: a flaw in content analysis does not hand over the filter that guards the inside. The licence can be activated offline and patches applied manually, which fits air-gapped networks. The cost is a sales-led purchase with no published prices and a heavier setup than a small office needs.
What genua does better than Fortinet
- Separate computers for filtering and content analysis, an isolation design that a single-box appliance does not have
- Stated Common Criteria EAL 4+ and German, NATO and EU RESTRICTED approvals
- Offline licence activation and manual patching for isolated networks
- German company with a Munich register entry and imprint
Where genua is a step down from Fortinet
- No published prices and a sales-led process
- More complex than a one-box UTM for a small office
- Public site written for authorities and industry, not for self-service buyers
Standout against Fortinet. genua separates the filter from the content inspection on different hardware, which is its main argument against a single appliance.
R&S LANCOM Unified Firewalls
a German UTM family that shares a cloud console with LANCOM network gear
Best for: Mid-sized companies and schools already running LANCOM routers, switches or access points
The LANCOM Unified Firewalls are sold by Rohde & Schwarz Networks and Cybersecurity GmbH in Wuerselen, entered at the Aachen court under HRB 16976, and run the operating system LCOS FX. The vendor says they are developed in Germany. Desktop, rack and virtual versions exist, and the virtual one runs on ESXi, Hyper-V, KVM and VirtualBox in sizes S to XL.
Against Fortinet the draw is a single German vendor for the firewall, switches and access points, managed from the LANCOM Management Cloud. The feature list names R&S PACE2 deep packet inspection, SSL inspection, IDS/IPS, sandboxing and IPsec, SSL and WireGuard VPN. Licences run for one, three or five years and prices are on request.
What R&S LANCOM Unified Firewalls does better than Fortinet
- German contracting party with an Aachen register entry
- High-availability cluster without an extra licence, according to the vendor
- One cloud console across firewall, switches and access points from the same vendor
- WireGuard listed next to IPsec and SSL VPN
Where R&S LANCOM Unified Firewalls is a step down from Fortinet
- Prices are not shown on the product pages
- Fixed-term runtime licences need renewals budgeted
- The shift from the LANCOM name to Rohde & Schwarz complicates documentation searches
Standout against Fortinet. R&S LANCOM Unified Firewalls make most sense where the rest of the network already carries the LANCOM name.
Best for: Small and medium businesses, practices and municipalities in the German-speaking market that buy through resellers
Securepoint GmbH in Lueneburg builds UTM firewalls in the Black Dwarf and RC series on its own operating system, LUNA. The imprint names a Lueneburg register entry and a Swiss subsidiary in Baar. The vendor says development takes place in Germany and that the products contain no hidden access, a statement to request in writing during procurement.
Compared with a FortiGate bought through a reseller, the pitch is a single licence described as covering hardware, software, service and support, with rental and managed-service options and an included VPN client. The Unified Security Console manages several devices from the cloud. The market focus is the DACH region, and very large networks are not the stated target.
What Securepoint does better than Fortinet
- German company with a Swiss subsidiary and a clear imprint
- One licence described as covering hardware, software, service and support
- Rent, buy or managed-firewall options through partners
- VPN client included, with a cloud console for several firewalls
Where Securepoint is a step down from Fortinet
- No published prices and reseller-led buying
- Documentation and partners concentrated in German-speaking markets
- Less suited to very large or multinational networks
Standout against Fortinet. Securepoint is the easiest alternative to buy as a service for an organisation without its own firewall administrator.
Best for: IT teams and managed service providers who run their own firewall and want auditable code
OPNsense is built on FreeBSD and developed by Deciso, with sales handled by Deciso Sales B.V. in Middelharnis, the Netherlands, whose terms name Dutch law. The site describes a simplified two-clause licence. The free download includes a stateful IPv4 and IPv6 firewall, traffic shaping, IPsec, WireGuard and Suricata intrusion prevention with the Emerging Threats Open rules.
Against Fortinet the difference is the model. You can read the code, install it on commodity x86 hardware or a virtual machine, or buy a Deciso DEC appliance. The Business Edition at EUR 149 per year covers one installation and adds a commercial firmware repository. Central features come from the OPNcentral plugin, not a vendor-run console.
What OPNsense does better than Fortinet
- Source code you can inspect, under a short BSD-style licence
- A free community build and a printed Business Edition price of EUR 149 per year
- Freedom to choose your own hardware or a DEC appliance
- Dutch contracting company under Dutch law
Where OPNsense is a step down from Fortinet
- No national qualification such as ANSSI or Common Criteria stated
- Support depends on a paid plan or the community forum
- Business Edition licence covers one installation only
Standout against Fortinet. OPNsense is the alternative that prints the price of its paid edition in a public shop.
Best for: Operators of mission-critical and telecom networks that need rich routing alongside firewalling
Clavister AB describes itself as a Swedish cybersecurity company headquartered in Ornskoldsvik, with shares listed on the Nasdaq First North Growth Market. Its firewall family is NetWall, with application-based routing, several virtual routers, dynamic routing protocols and fail-over methods for link and route changes. Models range from small desktop units to data-centre appliances, plus virtual versions.
Compared with Fortinet, Clavister is the smaller and more specialised vendor. It says anomaly detection trains on the device in under 15 minutes without cloud processing, and OneConnect is its VPN client. It also sells identity products and cross-domain gateways to defence buyers. Prices are not shown, and the customer focus is large organisations.
What Clavister does better than Fortinet
- Swedish listed company with public financial reporting
- On-device anomaly detection that uses no cloud processing, according to the vendor
- Routing features aimed at complex, multi-path networks
- Cross-domain gateways and identity products from the same vendor
Where Clavister is a step down from Fortinet
- Prices are not published
- A smaller partner network than the large global brands
- Small-office buyers have fewer reseller and price options
Standout against Fortinet. Clavister is the alternative to test when routing complexity, not office UTM features, drives the purchase.
Best for: Organisations already managing endpoints or e-mail in Sophos Central that accept UK jurisdiction
Sophos Firewall comes from Sophos Limited, whose registered office is in Abingdon, United Kingdom. The product page lists XGS hardware, the Xstream architecture and a built-in ZTNA gateway, managed from a cloud console. For customers outside the US, Canada and Latin America the end user terms name Sophos Limited as the contracting party.
Against Fortinet this is a move to UK law, not to EU law: the UK is outside the EEA but covered by an adequacy decision. If you want a supplier inside the EU, Sophos does not meet that bar, while for a buyer who already runs Sophos Central it removes a second vendor relationship. No firewall price is shown on the pages we reviewed.
What Sophos Firewall does better than Fortinet
- UK contracting entity for most customers, where Fortinet lists a US address
- ZTNA gateway named as a built-in feature
- One cloud console shared with other Sophos products
Where Sophos Firewall is a step down from Fortinet
- Outside the EU and EEA, covered only by an adequacy decision
- Data location for Sophos Central is stated as see vendor
- Customers in the US, Canada and Latin America contract with a different Sophos entity
Standout against Fortinet. Sophos Firewall is the alternative for buyers whose requirement is a non-US vendor and whose existing estate is already Sophos.
Best for: Machine builders, manufacturers and energy operators that need a gateway plus secure remote maintenance
Endian SRL is entered in the Bolzano chamber of commerce and gives Via Ipazia 2 in Bolzano as its address, with VAT number 02472130216. It sells Endian UTM for business networks and Endian 4i for industrial networks, both on EndianOS, and a Connect app for remote device access. Endian Switchboard handles management under a zero trust approach.
Against a FortiGate in a plant network, the draw is a vendor that publishes industry pages for renewable energy, critical infrastructure, machine builders and manufacturing, plus compliance pages for GDPR, IEC 62443 and NIS2. Prices are on request and the public pages give little on throughput, so datasheets are needed. It is a small company next to the global brands.
What Endian does better than Fortinet
- Italian company with chamber of commerce entry and VAT number published
- Separate IT and OT gateways, with remote access from the same vendor
- Compliance pages that address NIS2 and IEC 62443 directly
- Site available in English, German and Italian
Where Endian is a step down from Fortinet
- Prices not published and sizing needs datasheets
- A small vendor, so reseller coverage in your country needs checking
Standout against Fortinet. Endian is the alternative built around remote maintenance of machines, not just perimeter filtering.
Best for: Large organisations that want clustered firewalls from branch to data centre and accept an Israeli vendor
Check Point Software Technologies Ltd. is based in Tel Aviv, Israel, and its December 2025 securities filing, quoted on this site, gives the principal office as 5 Shlomo Kaplan Street. The firewall page lists Quantum Force models, firewall clustering, and SD-WAN and VPN, positioned from branch to data centre.
Compared with Fortinet, Check Point is the alternative closest in scale and the one least aligned with a strict EU-supplier rule: Israel is outside the EU and EEA. It appears here because European Purpose accepts Israeli vendors under its eligibility rules. Pricing is not published, the data location is given as see vendor, and the regional contracting entity is not confirmed.
What Check Point does better than Fortinet
- Not a US company, with the legal name and principal office stated in a filing
- Branch-to-data-centre model range with clustering
- SD-WAN and VPN from the same vendor
Where Check Point is a step down from Fortinet
- Israel is outside the EU and EEA
- No published price and an unconfirmed regional contracting entity
- Data location given only as see vendor
Standout against Fortinet. Check Point suits a buyer whose rule is non-US rather than EU, and who needs enterprise scale.
Best for: Small offices, schools and home labs with technical staff who run their own hardware
IPFire is an open source firewall that its team says has been developed in the open since 2004. The legal page names The IPFire Project c/o Lightning Wire Labs GmbH in Datteln, Germany. There is one edition, and the site states that no feature needs a licence and no update needs a subscription.
Against a FortiGate the trade is cost for effort. The console builds zones such as a DMZ and a guest network and supports WireGuard, OpenVPN and IPsec, and the project publishes IPFire Location, a free geolocation database for country rules. Appliances and support are sold in the IPFire store. No national certification or central multi-site console is described on the pages reviewed.
What IPFire does better than Fortinet
- No licence cost and no subscription to receive updates, according to the project
- Source code open and a German legal contact
- You pick the hardware
- WireGuard, OpenVPN and IPsec all listed
Where IPFire is a step down from Fortinet
- No government certification stated
- No central console for many sites described
- Support quality depends on the plan you buy
Standout against Fortinet. IPFire is the alternative with the lowest licence cost and the most work left to your own administrators.
What actually breaks when you switch
The first break is the rule base. FortiGate policies, address objects, NAT and VPN definitions do not import into another vendor's model, so each rule is rewritten or translated and then tested.
The places that cause outages are the ones where models differ: how an application is identified, how NAT is ordered against filtering, and how site-to-site tunnels negotiate their parameters. Budget a parallel run, and write down every exception your team added over the years before you retire the old unit.
The second break is contractual. A running FortiGate licence does not transfer, and the new vendor's licence starts a new term, so a move mid-cycle means paying for two.
Check what the new licence includes: Securepoint bundles hardware, software, service and support, R&S LANCOM uses fixed runtime terms of one, three or five years, OPNsense charges per installation and IPFire charges nothing for the software. Then check retraining, since your administrators know one interface and logs, and your SIEM parsers will need new mappings.
When is the right time to move away from a FortiGate?
At a hardware or licence renewal, because that is when you pay for the next term anyway. A firewall bought for five years is worth keeping until its support ends unless a rule requires a European supplier sooner. Moving mid-term means paying twice: the running licence on the old unit and the new vendor's licence on the replacement.
Plan the project backwards from the renewal date. Request quotes three to six months ahead, test a virtual image or a loan unit, rebuild the rule base on a test network and run both devices side by side for a period. The vendors with a virtual version (R&S LANCOM, Clavister, genua) or a free download (OPNsense, IPFire) make the testing step cheap.
Can a European firewall match FortiGate on throughput and features?
We did not verify Fortinet's performance figures, so this page cannot rank any alternative against a specific FortiGate model. What the European vendors publish is a feature list: deep packet inspection, IPS, application control, VPN, sandboxing and clustering appear on most of them. The numbers that matter are throughput with inspection enabled on your own rule set.
Ask every candidate for a test unit and measure it, because datasheet numbers are produced under conditions that differ from your traffic. For very high throughput, Clavister and Check Point list data-centre class models, but only a test tells you whether a given model carries your load.
Which one to pick
If a rule names a national body, shortlist Stormshield or genua first. Stormshield fits French and EU public-sector buyers and industrial sites, genua fits classified and air-gapped networks. For a small or mid-sized network without a qualification requirement, Securepoint and R&S LANCOM Unified Firewalls are packaged for reseller-led buying, with Securepoint offering rental and managed options and R&S LANCOM sharing a console with LANCOM network gear.
If you have administrators who prefer to own the stack, OPNsense and IPFire cost the least in licences, with OPNsense adding a priced edition and Dutch appliances. Pick Endian for plants and machine builders, Clavister for routing-heavy telecom and defence networks, and Sophos or Check Point only if a non-US rule, not an EU-supplier rule, is what you must satisfy. Whichever you choose, measure throughput with inspection enabled before you order.
Frequently Asked Questions
It depends on the criterion. For a published national qualification, Stormshield from France and genua from Germany are the closest fits. For a UTM appliance for a small or mid-sized network, Securepoint and the R&S LANCOM Unified Firewalls are the usual shortlist, and OPNsense suits teams that prefer open source code on their own hardware. Endian covers industrial gateways, and Clavister targets telecom and defence networks.
No. Fortinet, Inc. lists its headquarters at 909 Kifer Road, Sunnyvale, California, which places the contracting company under US jurisdiction. This page did not verify further details about its terms or data handling, so it makes no claims beyond the address.
Yes. OPNsense is developed by Deciso in the Netherlands, based on FreeBSD, with a free community build and a Business Edition at EUR 149 per year for one installation. IPFire is maintained around Lightning Wire Labs in Germany and has a single edition with no licence tiers. Both vendors sell appliances and support.
GDPR does not by itself require a European vendor, and a firewall that stays on your premises moves little personal data to its supplier. The relevant questions are whether the device or its cloud console sends configuration, logs or telemetry to the vendor, and under which law that vendor contracts. A tender or sector rule may add its own requirement for European suppliers.
Stormshield sells industrial SNi and ruggedised SNxr models, Endian has its 4i gateways for operational technology, genua offers the genuwall industrial firewall and Clavister lists rugged models in its NetWall range. Compare temperature range, protocol support and certification on each model's datasheet before ordering.
Related comparisons
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.