How do I choose a European firewall to replace a Fortinet FortiGate?
Start with the question that cannot be answered by a datasheet: does your tender or your regulator ask for a named qualification? If it does, the shortlist is short.
Stormshield publishes an ANSSI qualification and Spanish CCN approval, and genua states Common Criteria EAL 4+ plus approval for German VS-NfD, NATO RESTRICTED and EU RESTRICTED on its genugate product page. The other vendors on this page state no national approval of that kind on the pages we reviewed, so filter on it first and compare features afterwards.
If no qualification is required, the decision is about operating model. Securepoint and R&S LANCOM Unified Firewalls are packaged for organisations with a small IT team and a reseller, Endian is built around office and industrial gateways, Clavister around routing-heavy networks, and OPNsense and IPFire around administrators who maintain their own hardware.
Fortinet lists its headquarters in Sunnyvale, California, which is the reason buyers with a European supplier requirement start this search, but jurisdiction alone does not rank the alternatives against each other.
Whatever you shortlist, run a throughput test with inspection switched on, using your own rule set. The headline features (intrusion prevention, application control, VPN, sandboxing) are listed by almost every vendor here, and the numbers that differ are the ones you measure.
Which of these firewalls publish prices and how are the licences built?
Only OPNsense and IPFire print a price. OPNsense has a free community build and a Business Edition at EUR 149 per year, valid for one installation, and IPFire states that no feature needs a licence and no update needs a subscription. Appliances and support contracts for both are sold separately, so the free software is not the whole budget.
The commercial vendors quote. Securepoint describes one licence that covers hardware, software, service and support, and offers rental, purchase or a managed service. R&S LANCOM Unified Firewalls use runtime licences of one, three or five years. genua, Clavister, Endian, Stormshield, Sophos and Check Point list pricing on request or point to the website without a figure.
When quotes arrive, ask three things in writing: what stops working if the subscription lapses, whether a second unit in a high-availability pair needs its own licence, and what the same appliance costs in year four. R&S LANCOM states that a high-availability cluster needs no extra licence, which is the kind of clause that changes a five-year total.
Does a European firewall vendor keep my traffic out of reach of US law?
For most products here the question is smaller than it sounds, because the firewall is a box in your own rack. genua says its licence can be activated offline and patches applied by hand. Securepoint, Endian, Clavister and R&S LANCOM sell on-premise appliances, and OPNsense and IPFire run on your own hardware. Traffic passing through a device you own does not travel to the vendor unless you switch on a cloud service.
The cloud parts are where you check. R&S LANCOM offers the LANCOM Management Cloud, Securepoint the Unified Security Console, Endian the Switchboard and Sophos a cloud console in Sophos Central, and each stores configuration and device data somewhere. Clavister says its anomaly detection runs on the device and uses no cloud processing. Stormshield states that it processes data mostly within the EEA with standard contractual clauses for the rest.
Jurisdiction differs by vendor: Germany, France, Sweden, the Netherlands and Italy are in the EU, the UK is covered by an adequacy decision, and Israel is outside the EU and EEA. This site accepts Israeli vendors under its eligibility rules, so Check Point appears here, but you should record the difference in your own risk file.
What breaks when I migrate firewall policies away from FortiGate?
The rule base does not convert on its own. Policies, address objects, VPN tunnels and licences have to be rebuilt in the new vendor's model, and the places where models differ are the ones that cause outages: how an application is identified, how NAT is ordered against filtering, and how site-to-site tunnels negotiate their parameters. Plan the move at a hardware renewal, as Fortinet buyers usually do, and run both units in parallel for a period.
Pick the migration route that matches your estate. A branch network with ten identical sites moves easily to a vendor with a central console, such as Securepoint with its Unified Security Console or R&S LANCOM with its management cloud. A data-centre perimeter with years of accumulated exceptions is a rewrite whichever vendor you choose, and Clavister, with its application-based routing and virtual routers, is the one on this page built around that kind of network.
Ask each candidate for a trial unit or a virtual image before you commit. R&S LANCOM sells a virtual firewall for ESXi, Hyper-V, KVM and VirtualBox, and OPNsense and IPFire both run on virtual machines, so the testing cost of those three is low.
When should I not switch away from Fortinet?
When the contract with Fortinet is not what keeps you awake. If your data protection officer has no requirement for a European supplier, if your hardware is mid-cycle and your team knows the platform, a migration is cost without a measurable gain.
The same goes for very large networks: Securepoint and Endian say little about multinational deployments, and Clavister's own page notes it is smaller than Check Point or Sophos, which matters for partner coverage, although both of those sit outside the EU.
Do not switch for a feature list either. The European tools match the common headline features, but a single vendor's integration of firewalls, switches, access points and endpoint agents is something you give up by changing one layer. R&S LANCOM and Sophos are the options on this page that argue for staying inside one vendor's ecosystem, so check what you already own before you start.
Is a firewall the same as a web application firewall?
No. A network firewall such as Securepoint's UTM or Clavister NetWall controls traffic between networks by address, port, application and user. A web application firewall inspects HTTP requests for one site or API and has its own category on this site.
The two overlap in some products. genugate includes an integrated web application firewall next to its packet filter, and most organisations still run the two layers as separate purchases. If your goal is to protect a public web shop, a network firewall alone does not cover it.
