2019度网络防火墙的魔力象限报告

Magic Quadrant for Network Firewalls
用于网络防火墙的魔力象限
Published 17 September 2019 - ID G00375686 - 86 min read

With firewall providers embedding multiple security features in firewalls and enabling integration and automation capabilities with other security products, firewalls are evolving into network security platforms.
随着防火墙提供商在防火墙中嵌入多种安全特性，并支持与其他安全产品的集成和自动化功能，防火墙正在演变为网络安全平台。
• Strategic Planning Assumptions
• 战略规划目标

By 2024, 20% of new distributed branch office firewall deployments will switch to firewall as a service, up from less than 5% today.
到2024年，20%的新的分布式分支机构防火墙部署将以服务的形式切换到防火墙，而目前这一比例不到5%。
By 2024, 25% of new firewall deployments will have users consider cloud-native firewall policy support of infrastructure as a service (IaaS) platforms as a mandatory selection criterion, from less than 5% today.
到2024年，25%的新防火墙部署将要求用户将基础设施即服务(IaaS)平台的云本地防火墙策略支持作为强制选择标准，而目前这一比例还不到5%。
By year-end 2024, 25% of firewall end-user spend will be contained within larger security “platform” deals delivered by enterprise license agreements (ELAs), up from less than 5% today.
到2024年年底，由企业许可协议(ELAs)提供的更大的安全“平台”交易将占到防火墙终端用户支出的25%，而目前这一比例还不到5%。
By 2024, 50% of new firewall purchases in distributed enterprises will utilize SD-WAN features with growing adoption of cloud-based services, up from less than 20% today.
到2024年，在分布式企业中购买的新防火墙中，有50%将使用基于云服务的SD-WAN特性，而目前这一比例还不到20%。
Market Definition/Description市场定义/描述
This year, Gartner has modified the definition of network firewalls. As we are observing more clients moving toward hybrid networks and seeking firewall capabilities in the cloud, cloud vendors are also offering native firewall capabilities to their clients.
今年，Gartner修改了网络防火墙的定义。随着我们观察到越来越多的客户端转向混合网络，并在云中寻找防火墙功能，云供应商也在为他们的客户端提供本地防火墙功能。
The traditional firewalls also offer support for these cloud platforms. Hence, starting this year, Gartner has started to also evaluate the native firewall capabilities of cloud providers, along with stand-alone firewall vendors. Also this year, the Magic Quadrants for Enterprise Firewalls and Unified Threat Management (UTM) have been consolidated into a single Magic Quadrant for Network Firewalls.
传统的防火墙还提供对这些云平台的支持。因此，从今年开始，Gartner也开始评估云提供商的本地防火墙功能，以及独立的防火墙供应商。同样在今年，用于企业防火墙和统一威胁管理(UTM)的魔力象限也被合并到用于网络防火墙的单个魔力象限中。
Gartner defines the network firewall market as follows: The network firewall market represented by this Magic Quadrant is composed primarily of firewalls offering bidirectional controls (both egress and ingress) for securing networks.
Gartner对网络防火墙市场的定义如下:这个魔力象限所代表的网络防火墙市场主要由提供双向控制(出口和入口)以保护网络的防火墙组成。
These networks can be on-premises, hybrid (on-premises and cloud), public cloud or private cloud. Network firewalls can also offer additional capabilities such as application awareness and control, intrusion detection and prevention, advanced malware detection, logging, and reporting.
这些网络可以是主集群、混合型(主集群和cloud)、公有云或私有云。网络防火墙还可以提供其他功能，如应用程序感知和控制、***检测和预防、高级恶意软件检测、日志记录和报告。
The companies that serve this market have an identifiable focus on network-based firewall controls — as demonstrated by the proportion of their sales and delivered with their support, sales teams and channels. These vendors provide features dedicated to solve firewall requirements and serve firewall-related use cases.
服务于这一市场的公司有一个明确的重点，即基于网络的防火墙控制——这可以从他们的销售比例和他们的支持、销售团队和渠道中得到证明。这些供应商提供专门用于解决防火墙需求的特性，并提供与防火墙相关的用例。
This Magic Quadrant includes the following types of network firewalls:
这个神奇的象限包括以下类型的网络防火墙:
• Purpose-built physical appliances专用的物理设备
• Virtual appliances虚拟设备
•
• An embedded firewall module嵌入式防火墙模块
• Firewall controls delivered from IaaS platform providersIaaS平台提供商提供的防火墙控制
Magic Quadrant
Figure 1. Magic Quadrant for Network Firewalls
Source: Gartner (September 2019)

Vendor Strengths and Cautions
供应商的优势和注意事项
Barracuda
Barracuda is based in Campbell, California. Its firewalls are visible on public IaaS platforms and in SD-WAN-related use cases on Gartner clients’ shortlists.
梭子鱼建立在加利福尼亚州的坎贝尔。它的防火墙可以在公共IaaS平台和Gartner客户的入围名单上与sd - wan相关的用例中看到。
These days, with a growing number of firewall vendors offering support for public cloud, Barracuda is facing strong competition because of limited visibility in the on-premises firewall use case. The vendor continues to introduce enhancements related to support for public IaaS platforms and SD-WAN. It is primarily shortlisted by midsize enterprises.
这些天来，随着越来越多的防火墙供应商提供对公共云的支持，Barracuda面临着激烈的竞争，因为在本地防火墙用例中可见性有限。供应商继续介绍与支持公共IaaS平台和SD-WAN相关的增强功能。它主要是由中型企业入围的。
Barracuda targets organizations looking for cost-effective security solutions. Its firewall product line (CloudGen Firewall F-Series) includes physical and virtual appliances. It is available on the popular public IaaS platforms Amazon Web Services (AWS), Microsoft Azure and Google Cloud.
Barracuda的目标是寻找经济有效的安全解决方案的组织。其防火墙产品线(CloudGen防火墙f系列)包括物理和虚拟设备。它可以在流行的公共IaaS平台Amazon Web Services (AWS)、Microsoft Azure和谷歌云上使用。
Its firewall centralized management solution, Control Center, is only available as either a software appliance or a public cloud image. Its security portfolio extends beyond firewalls to web application firewalls, data protection and email security solutions.
它的防火墙集中管理解决方案Control Center只能作为软件设备或公共云映像使用。其安全投资组合已从防火墙扩展到web应用程序防火墙、数据保护和电子邮件安全解决方案。
Recent product updates include integration with macmon for network access control (NAC) and full integration, and support for Microsoft Azure Virtual WAN, as well as new firewall instances in Microsoft Azure, Google Cloud Platform and AWS. Barracuda also discontinued its hardware appliances for centralized management, focusing on virtual and IaaS deployments.
最近的产品更新包括与macmon网络访问控制(NAC)的集成和完全集成，以及对Microsoft Azure虚拟WAN的支持，以及Microsoft Azure、谷歌云平台和AWS中的新的防火墙实例。Barracuda也停止了硬件设备的集中管理，专注于虚拟和IaaS部署。
Strengths优势 SD- WAN软件定义广域网：是将SDN技术应用到广域网场景中所形成的一种服务，这种服务用于连接广阔地理范围的企业网络、数据中心、互联网应用及云服务。
• SD-WAN: Barracuda offers mature SD-WAN capabilities within its firewalls. It has extended this SD-WAN support, including tunnels between Barracuda devices and support of the new Microsoft Azure Virtual WAN.
• SD-WAN: Barracuda在其防火墙内提供成熟的SD-WAN功能。它扩展了对SD-WAN的支持，包括Barracuda设备之间的隧道和对新的Microsoft Azure虚拟WAN的支持。
• Product: Barracuda continues to enhance support for public IaaS platforms. It offers easy-to-use templates for connecting on-premises environments to multiple public IaaS vendors, specifically AWS, Microsoft Azure and Google Cloud Platform for creating policies and rules. Cloud connections to all cloud providers are configured and monitored from the centralized management console.
• 产品:梭子鱼继续加强对公共IaaS平台的支持。它提供了易于使用的模板，用于将本地环境连接到多个公共IaaS供应商，特别是AWS、Microsoft Azure和谷歌云平台，用于创建策略和规则。从集中式管理控制台配置和监视到所有云提供商的云连接。
• NAC: In addition to offering integration with macmon (an NAC vendor), the vendor offers a lightweight NAC solution called Barracuda Network Access Client combined with its SSL solution for basic client health checks.
• 除了提供与macmon(一个NAC供应商)的集成之外，该供应商还提供了一种轻量级的NAC解决方案，称为Barracuda Network Access Client，它结合了SSL 解决方案，用于基本的客户端健康检查。
• Customer Feedback: Surveyed customers report higher-than-average overall satisfaction, with Barracuda highlighting ease of deployment, centralized management and service.
• 客户反馈:接受调查的客户总体满意度高于平均水平，梭子鱼强调部署的便利性、集中管理和服务。
• Product Strategy: The retirement of the small and midsize business (SMB)-oriented X-Series and on-premises management appliance simplifies the overall product line and centralized management options.
• 产品策略:退休的面向中小型企业(SMB)的x系列和本地管理设备简化了整体产品线和集中管理选项。
Cautions注意事项
• Customer Experience: A lack of a complete set of APIs and missing integration with the Barracuda Content Shield endpoint security solution were cited as key concerns by customers surveyed. However, in the recent firmware release (8.0), the vendor has made enhancements by offering support for relatively more APIs.
• 客户体验:缺少一套完整的api，并且缺少与Barracuda Content Shield端点安全解决方案的集成，这些都是被调查的客户所关注的关键问题。然而，在最近的固件版本(8.0)中，供应商通过提供对更多api的支持进行了增强。
• Sales Execution: While the vendor offers firewall appliances scaling from 1.2 Gbps to 46 Gbps (pure stateful inspection throughput), Gartner does not see them as a preferred shortlist for data center and enterprise perimeter use cases by Gartner clients.
• 销售执行:虽然供应商提供的防火墙设备从1.2 Gbps扩展到46 Gbps(纯有状态检查吞吐量)，但Gartner并不认为它们是Gartner客户的数据中心和企业边界用例的首选候选名单。
• Marketing Execution: Resellers express concern that potential customers do not see the vendor as enterprise-grade or competing with larger competitors. Despite receiving high marks for ease of cloud connectivity with CloudGen Firewalls, the overall adoption rate of virtual firewall instances within IaaS as either pay-as-you-go or bring-your-own licenses remains low.
• 营销执行:经销商表示，他们担心潜在客户不认为该供应商是企业级的或与更大的竞争对手竞争。尽管CloudGen防火墙在云连接方面获得了很高的分数，但IaaS中虚拟防火墙实例的总体采用率(即使用即付或自带许可)仍然很低。
• Geographic Strategy: Barracuda remains primarily focused on North America and Europe, and is not often seen in South America, the Asia/Pacific region and the Middle East.
• 地理战略:梭子鱼的市场主要集中在北美和欧洲，在南美、亚太地区和中东并不常见。
• Market Responsiveness: Barracuda lacks a FWaaS offering and any cloud access security broker (CASB) integration, which is a favorable requirement with the growing use of SaaS applications. The firewalls also lack support for SDN platforms.
• 市场响应性:Barracuda缺乏FWaaS产品和任何云访问安全代理(CASB)集成，这是SaaS应用程序使用不断增长的有利需求。防火墙也缺乏对SDN平台的支持
• Sandboxing: The vendor lacks an on-premises network sandboxing product, but offers integration with Lastline.
• 沙盒:供应商缺少本地网络沙箱产品，但提供与Lastline的集成
• Product Certification: Barracuda firewalls lack certain certifications that are important to enterprises with heavy regulations such as Common Criteria EAL4.
• 产品认证:Barracuda防火墙缺乏某些认证，而这些认证对于法规严格的企业来说非常重要，比如通用标准EAL4。
Check Point Software Technologies CP软件技术科技
Check Point Software Technologies is a global pure-play security vendor, with headquarters in Tel Aviv, Israel, and San Carlos, California. Its firewalls are facing strong competition from leading firewall players in the market.
Check Point Software Technologies是一家全球性的纯安全性供应商，总部位于以色列的特拉维夫和加州的圣卡洛斯。它的防火墙正面临来自市场领先防火墙厂商的激烈竞争。
Gartner is gradually noticing the vendor’s decreasing visibility for different firewall use cases in client inquiries as compared to other Leaders. With Check Point now showing a focus on cloud and application security with acquisitions, if executed well, it can gain traction in these use cases.
Gartner逐渐注意到，与其他领导者相比，供应商在客户询问中对不同防火墙用例的可见性在下降。Check Point现在将重点放在云和应用程序安全上，如果执行良好，它可以在这些用例中获得支持。
Check Point’s security portfolio, branded as the Check Point Infinity Architecture, includes enterprise firewall appliances (Security Gateway), virtual appliances available on the major cloud platforms (the CloudGuard brand, which includes CloudGuard IaaS, CloudGuard SaaS, CloudGuard Dome9 and CloudGuard Log.ic).
Check Point的安全组合，被称为Check Point Infinity架构，包括企业防火墙设备(安全网关)，主要云平台上可用的虚拟设备(CloudGuard品牌，包括CloudGuard IaaS、CloudGuard SaaS、CloudGuard Dome9和CloudGuard Log.ic)。
The SandBlast brand encompasses threat prevention technologies, including network sandboxing appliances, an endpoint security solution (SandBlast Agent) and a mobile security solution (SandBlast Mobile). Check Point’s centralized management suites (Security Management, SmartEvent and Compliance) are available as a physical appliance (Smart-1 security management appliance) or as software, with a Windows-based management console (SmartConsole).
喷沙品牌包含威胁预防技术，包括网络沙盒设备、端点安全解决方案(喷沙代理)和移动安全解决方案(喷沙移动)。Check Point的集中管理套件(安全管理、SmartEvent和遵从性)可以作为物理设备(Smart-1安全管理设备)或软件使用，带有基于windows的管理控制台(SmartConsole)。
Checkpoint introduced four new Security Gateway appliances in the past year. In addition, it acquired Dome9 for cloud security posture management (CSPM) and ForceNock for web application and API protection (WAAP) security. The vendor offers 23 Security Gateway models — from lower-end options to high-end appliances with 1.6 Tbps throughput.
在过去的一年里，Check Point引入了四个新的安全网关设备。此外，它还收购了Dome9用于云安全态势管理(CSPM)和ForceNock用于web应用程序和API保护(WAAP)安全。该供应商提供23个安全网关模型——从低端选择到1.6 Tbps吞吐量的高端设备。
Strengths
• Pricing Strategy: Check Point offers a simple pricing model where appliances come with a choice of three bundles of subscriptions: Next Generation Firewall (firewall, intrusion detection and prevention system [IDPS], application control and URL filtering), Next Generation Threat Prevention (Next Generation Firewall features plus antivirus, anti-spam and anti-bot), and Next Generation Threat Prevention & SandBlast NGTX (NGTP plus sandboxing and content disarm and reconstruction). Check Point also offers the Infinity Total Protection ELA, as well as a-la-carte pricing.
• 定价策略:CP提供了一个简单的定价模型,电器有选择订阅的三个包:下一代防火墙(防火墙、*检测和预防系统(idps)、应用程序控制和URL过滤),下一代威胁的预防(赢面下一代防火墙功能+防病毒、防垃圾短信和的反傀儡程式),预防和下一代的威胁和沙盒仿真NGTX (NGTP加上沙盒和内容解除和重建)。CP还提供无限总保护ELA，以及a-la-点菜定价。
• Product Execution: Check Point has one of the largest threat research teams among the vendors evaluated in this research. It also offers a third-party threat intelligence feed as an additional option for customers, further increasing the scope of its threat intelligence offering. The vendor’s attach rates for its add-on products are higher than many competitors, which improves its threat intelligence capabilities.
• 产品执行:在本研究中评估的供应商中，Check Point拥有最大的威胁研究团队之一。它还为客户提供了一个第三方威胁情报提要作为一个额外的选项，进一步扩大了其威胁情报提供的范围。该供应商的附加产品的附加率高于许多竞争对手，这提高了其威胁情报能力。
• Partners: Check Point has a historically strong partner ecosystem, with VMware, Silver Peak, Microsoft and Radware being the recent additions. The vendor has also launched a new partner program called Check Point Engage that rewards providers that strengthen relationships with Check Point customers focused on cloud and mobile over hardware purchases.
• 合作伙伴:Check Point有一个强大的合作伙伴生态系统，VMware、Silver Peak、Microsoft和Radware是最近加入的。该公司还推出了一个名为Check Point Engage的新合作项目，奖励那些加强与Check Point客户关系的供应商，这些客户关注的是云计算和移动设备，而不是硬件采购。
• Scalability: Check Point has invested heavily in building specialized offerings to respond to vertical-specific challenges, including ruggedized appliances for critical infrastructure, telecom-specific hyperscale, and protocols such as GTPv1, GTPv2, Diameter, SCTP and SS7. The Maestro Hyperscale Orchestrator appeals to certain verticals like telecommunications and carrier-grade networks that value extremely high throughput capacities.
• 可伸缩性:Check Point在构建专门的产品以应对垂直特定的挑战方面投入了大量资金，包括用于关键基础设施的加固设备、电信特定的超大规模以及诸如GTPv1、GTPv2、Diameter、SCTP和SS7等协议。Maestro超大规模管弦乐编曲吸引了某些垂直领域，如电信和电信级网络的价值极高的吞吐量能力。
• Feature: Check Point continues to lead in centralized management offerings, even for very large, complex and highly exposed environments. Its management suite includes several features such as multidomain security management and smart provisioning to specifically serve managed security service providers (MSSPs).
• 特性:即使对于非常大、复杂和高度暴露的环境，Check Point仍然在集中式管理产品中处于领先地位。它的管理套件包括多个特性，如多域安全管理和智能供应，以专门服务于托管安全服务提供商(MSSPs)。
• Product Support: Check Point supports a large number of private, hybrid and public IaaS environments with its CloudGuard IaaS product line, including VMware NSX, Cisco ACI, AWS, Microsoft Azure and Azure Stack, Google Cloud Platform, Oracle Cloud, OpenStack, and Alibaba Cloud. With Dome9, Check Point is showing a growing focus on public IaaS.
• 产品支持:Check Point以其CloudGuard IaaS产品线支持大量的私有、混合和公共IaaS环境，包括VMware NSX、Cisco ACI、AWS、Microsoft Azure和Azure Stack、谷歌云平台、Oracle云、OpenStack、阿里巴巴云。通过Dome9, Check Point越来越关注公共IaaS。
Cautions
• Marketing Execution: Gartner estimates that, in 2018, Check Point lost market share to its rivals and increasingly is less visible in Gartner client inquiries. Client surveys indicate that the vendor is often left off of shortlists when clients are considering replacement of incumbent firewall vendors.
• 市场执行:Gartner估计，2018年，Check Point的市场份额被竞争对手夺走，在Gartner的客户咨询中越来越不显眼。客户调查显示，当客户考虑替换现有的防火墙供应商时，供应商常常被排除在候选名单之外。
• Market Responsiveness: Check Point is lagging its competition in introducing a full FWaaS offering. The vendor continues to lack the SD-WAN focus found with other firewall vendors.
• 市场反应:Check Point在引入全面的FWaaS方面落后于竞争对手。该供应商仍然缺乏与其他防火墙供应商一样的SD-WAN焦点。
• Product: Check Point Security Management Portal (SMP; cloud-based management console) is only available for limited firewall models and lacks support for the entire firewall series. Check Point firewalls also lack support for TLS 1.3; the product currently downgrades TLS 1.3 connections to TLS 1.2 when decrypting traffic.
• 产品:Check Point安全管理门户(SMP;基于云的管理控制台)只适用于有限的防火墙模型，并且缺乏对整个防火墙系列的支持。Check Point防火墙也缺乏对TLS 1.3的支持;该产品目前降级TLS 1.3连接到TLS 1.2当解密流量
• Customer Feedback: Customers and surveyed resellers perceive performance issues requiring purchase of larger appliances than anticipated, giving lower scores for overall performance, especially when enabling multiple features such as DLP. While Check Point is one of the most shortlisted firewalls for public IaaS platforms, clients cite that the installation and deployment process is not a smooth experience and often requires professional services or help from the support team.
• 客户反馈:客户和被调查的分销商认为性能问题需要购买比预期更大的设备，总体性能得分较低，特别是在启用DLP等多个功能时。虽然Check Point是入围公共IaaS平台的最常见的防火墙之一，但客户指出，安装和部署过程并不顺利，通常需要专业服务或支持团队的帮助。
• Marketing Strategy: Check Point continues to market Infinity as both an architecture and an ELA around the concept of generational threat protection (currently Gen V). Gartner clients express confusion around this messaging and which solutions the vendor can provide to help protect their environment. Check Point lacks strong positioning and product messaging.
• 市场策略:Check Point继续将Infinity作为一个架构和一个ELA围绕代际威胁保护(目前为Gen V)的概念进行营销。Check Point缺乏强大的定位和产品信息。
• Technical Support: Gartner clients continue to cite that Level 3 escalations take longer than Level 1 and Level 2 escalations, and that the vendor lacks in timely updated communication while the team is working on it.
• 技术支持:Gartner客户继续指出，第3级升级比第1级和第2级升级耗时更长，并且在团队进行升级时，供应商缺乏及时更新的沟通。
Cisco
Cisco is a large network, infrastructure and security vendor, based in San Jose, California. It continues to offer multiple firewall models for different use cases, although many models under the different firewall product lines overlap with each other. Cisco firewalls continue to be part of large Cisco infrastructure deals. Gartner does observe the vendor being shortlisted by existing Cisco clients as one of the firewall vendors. Its vision of cloud and automation, if executed well, can help the vendor gain traction in related use cases.
思科是一家大型网络、基础设施和安全供应商，总部位于加州圣何塞。它继续为不同的用例提供多个防火墙模型，尽管不同防火墙产品线下的许多模型相互重叠。思科防火墙仍然是思科大型基础设施交易的一部分。Gartner确实注意到该供应商被现有的思科客户列为防火墙供应商之一。它对云和自动化的愿景，如果执行良好，可以帮助供应商在相关用例中获得牵引力。
Cisco’s security product portfolio includes many solutions, including firewalls, and it has grown continually over the past few years, mainly through acquisitions. It offers endpoint security client Cisco AMP, Cisco AnyConnect (* client), Stealthwatch and Stealthwatch Cloud (network traffic analysis [NTA]), secure web gateway (SWG), email security, network access control and a CASB — with Talos threat intelligence included with Cisco security products.
思科的安全产品组合包括许多解决方案，包括防火墙。在过去几年里，思科主要通过收购不断发展壮大。它提供端点安全客户端Cisco AMP, Cisco AnyConnect (*客户端)，Stealthwatch和Stealthwatch云(网络流量分析[NTA])，安全网络网关(SWG)，电子邮件安全，网络访问控制和一个CASB -包括Talos威胁情报思科安全产品。
Cisco continues to sell multiple firewall product lines: Cisco Adaptive Security Appliance (ASA) 5500-X Series and Adaptive Security Virtual Appliance (ASAv), its virtual firewall appliances; Cisco Firepower NGFW Series, which also exists in the form of virtual appliances (NGFWv); the Meraki MX series; and Cisco IOS Firewall. The vendor also offers two industrial firewalls (the ISA series).
思科继续销售多个防火墙产品线:思科自适应安全设备(ASA) 5500-X系列和自适应安全虚拟设备(ASAv)，其虚拟防火墙设备;思科火力NGFW系列，也以虚拟设备(NGFWv)的形式存在;Meraki MX系列;和思科IOS防火墙。供应商还提供了两个工业防火墙(ISA系列).
Cisco Umbrella is the vendor’s cloud DNS security and secure web gateway. Cisco Tetration started as cloud visibility software, and recently evolved into an agent-based firewall for application and microsegmentation.
思科伞是供应商的云DNS安全和安全的网络网关。Cisco Tetration最初是云可视化软件，最近发展成为一个基于代理的应用和微分割防火墙。
Cisco Threat Response (CTR) is the Cisco web portal for threat investigation, adding context and an indicator of compromises to events sent from registered Cisco security products.
思科威胁响应(CTR)是思科威胁调查的门户网站，为注册的思科安全产品发送的事件添加上下文和危害指标。
The vendor continues its effort to build a unified centralized management console with Cisco Defense Orchestrator (CDO), which aims at managing all of its firewall product lines. The Cisco Meraki MX series also offers cloud-based management targeting distributed organization use cases.
供应商继续努力，以建立一个统一的集中式管理控制台与思科防御编配(CDO)，旨在管理其所有的防火墙产品线。Cisco Meraki MX系列还提供了针对分布式组织用例的基于云的管理。
Firepower Management Center (FMC) is Cisco’s on-premises centralized management offering, available for Cisco ASA 5500-X and Firepower devices only.
火力管理中心(FMC)是思科的现场集中管理产品，仅适用于思科ASA 5500-X和火力设备。
Strengths
• Sales Execution: Cisco’s global footprint is a big asset when trying to convince large organizations to purchase its firewalls and adjacent security products. Gartner analysts see a large number of organizations signing ELAs with Cisco, including for a large number of Cisco Firepower firewalls. Many clients describe themselves as “Cisco shops.”
• 销售执行:当试图说服大型组织购买思科的防火墙和邻近的安全产品时，思科的全球足迹是一项巨大的资产。Gartner分析师认为，许多组织与思科签署了ELAs协议，其中包括思科的大量火力防火墙。许多客户将自己描述为“思科商店”。
• Marketing Execution: Cisco owns a broad portfolio of network and security solutions. Gartner sees the vendor enthusiastically promoting the integration and automation roadmap within its products as a strong marketing and sales strategy, which is also resonating with end users. It is also an attractive proposition for clients that want to consolidate toward a single vendor.
• 市场执行:思科拥有广泛的网络和安全解决方案。Gartner认为，供应商热情地在其产品中推广集成和自动化路线图，这是一种强有力的营销和销售策略，也引起了终端用户的共鸣。对于希望向单个供应商合并的客户来说，这也是一个有吸引力的建议。
• During inquiries, Gartner clients mention the Cisco integration story among the different Cisco products as a primary reason for the purchase.
• 在询问中，Gartner的客户提到了思科不同产品之间的集成故事，这是购买的主要原因。
• Capability: Customers and resellers continue to give high scores to Talos threat research and to advanced malware protection (AMP) features available on Firepower. Existing Sourcefire customers also like the IDPS integration on Firepower.
• 能力:客户和经销商继续给予高度评价Talos威胁研究和先进的恶意软件保护(AMP)功能可用的火力。现有的Sourcefire客户也喜欢集成在“火力”上的IDPS。
• Capability: Cisco Meraki MX appeals to distributed organizations looking for ease of deployment and maintenance. Cisco Meraki MX’s proprietary auto-* and SD-WAN simplify site-to-site deployments when using only Meraki devices.
• 能力:Cisco Meraki MX呼吁寻求部署和维护的简便性的分布式组织。Cisco Meraki MX的专有自动和SD-WAN在仅使用Meraki设备时简化了站点到站点的部署。
• Feature: The Cisco AnyConnect client offers support for most mobile devices and their OSs. Gartner constantly receives inquiries in which clients rate the offered by the vendor as higher compared to other vendors. They state that the tunnels are stable and users do not experience disconnected sessions. Many Gartner clients that replace their Cisco ASAs with a firewall from a different vendor continue to use ASAs for only.
• 特点:思科AnyConnect 客户端为大多数移动设备及其操作系统提供支持。Gartner经常收到客户的询问，其中客户对供应商提供的的评价高于其他供应商。他们表示隧道是稳定的，用户不会经历断开的会话。许多Gartner的客户用来自不同供应商的防火墙替换了他们的Cisco as，他们仍然只将ASAs用于*。
Cautions
• Project Execution: While Cisco has made progress on its competitive positioning, it struggles to win firewall evaluation against other competitors in pure firewall deals based on technical evaluation alone. This puts Cisco in a difficult spot when the three vendors offer similar prices, which is more frequent than in the past due to recent pricing strategy changes from Cisco and its competitors.
• 项目执行:虽然思科在竞争定位上取得了进展，但在纯粹的基于技术评估的防火墙交易中，思科很难从其他竞争对手那里赢得防火墙评估。当这三家供应商提供类似的价格时，思科陷入了一个困难的境地。由于思科及其竞争对手最近改变了定价策略，这种情况比以往更加频繁。
• Product Execution: Cisco clients that have purchased multiple Cisco security products with Cisco Firepower firewall to utilize integration and automation capabilities, as highlighted by the vendor at the time of sales, are often disappointed when they don’t work in their environment. Gartner clients often cite the lack of automation between Cisco ISE (NAC solution) and Cisco Firepower as quite frustrating. Gartner highly recommends that clients evaluate the integration capabilities between different Cisco products before purchase.
• 产品执行:Cisco的客户购买了多个Cisco安全产品，并使用了Cisco的“火力防火墙”来利用集成和自动化功能，正如供应商在销售时强调的那样，当他们不能在自己的环境中工作时，常常会感到失望。Gartner的客户经常说，思科的ISE (NAC解决方案)和思科的“火力”之间缺乏自动化是非常令人沮丧的。Gartner强烈建议客户在购买之前评估对比不同思科产品之间的集成能力。
• Product Execution: Cisco Meraki MX, Firepower and, increasingly, Viptela can be relevant in overlapping use cases for distributed organizations with SD-WAN requirements. As the three solutions do not have full feature parity, prospective clients and Cisco resellers struggle to build an architecture when it needs to combine multiple solutions. CDO is still a work in progress and lacks fully featured unified management, which could help with the issue.
• 产品执行:Cisco Meraki MX、和Viptela在具有SD-WAN需求的分布式组织的重叠用例中可能越来越重要。由于这三种解决方案没有完全的功能对等，潜在客户和思科经销商在需要组合多个解决方案时，很难构建架构。CDO还在进行中，缺乏全功能的统一管理，这有助于解决问题。
• Capabilities: Cisco Firepower lacks SD-WAN features and zero-touch deployment. Gartner observes that Cisco clients are less likely to use application control, TLS decryption and URL filtering features. Surveyed customers also express frustration with the lack of comprehensive real-time logging and reporting solutions.
• 能力:思科火力缺乏SD-WAN功能和零接触部署。Gartner指出，思科客户不太可能使用应用程序控制、TLS解密和URL过滤功能。被调查的客户还对缺乏全面的实时日志记录和报告解决方案表示失望。
• Geographic Strategy: Gartner is noticing declining visibility of Cisco firewalls in pure firewall deals outside North America in client inquiries. The vendor is more visible in other regions as part of large Cisco infrastructure deals. Gartner has also observed more focus by the vendor on expanding the Cisco Meraki MX product line in the U.S. and U.K.
• 地理战略:Gartner注意到，思科防火墙在北美以外的客户咨询业务中，纯防火墙业务的可看性正在下降。作为思科大型基础设施交易的一部分，思科在其它地区的知名度更高。Gartner还注意到，思科更加注重在美国和英国扩展思科Meraki MX产品线
• Capabilities: Cisco clients continue to complain about their inability to effectively deploy Firepower virtual machines on IaaS platforms. They mention stability issues and feature inconsistencies. Gartner also does not see Cisco being deployed on public cloud, compared to competitors.
• 功能:思科客户继续抱怨他们无法有效地在IaaS平台上部署火力虚拟机。他们提到稳定性问题和特性的不一致性。与竞争对手相比，Gartner也认为思科不会部署在公共云上。
• Customer Experience: Cisco scored lower than average on surveyed customers’ satisfaction with quality of support. This aligns with what Gartner analysts observe during client inquiries, where the ability to get timely answers has been reported as degrading over time, especially when facing issues with centralized management features.
• 客户体验:思科在客户对支持质量的满意度调查中得分低于平均水平。这与Gartner分析师在客户咨询过程中观察到的情况一致，据报道，及时获得答案的能力会随着时间的推移而下降，尤其是在集中管理功能出现问题时。
• Capability: Cisco Firepower’s management API lags in maturity behind its direct competitors. This has noticeable consequences, such as delays in support from network security policy management tools (NSPM), and the absence of integration, notably with any third-party endpoint detection and response (EDR) tools.
• 能力:思科“火力”的管理API在成熟度上落后于其直接竞争对手。这带来了明显的后果，比如网络安全策略管理工具(NSPM)的支持延迟，以及缺乏集成，特别是与任何第三方端点检测和响应(EDR)工具的集成。
F5
F5, based in Seattle, Washington, is a leading data center application delivery controller vendor. It continues to focus on data center and CSP use cases for its firewall module deployment. Clients using F5 or procuring application delivery products for the vendor should consider using the firewall module offered by the vendor. The primary use case for using the vendor’s firewall is vendor consolidation, higher throughput requirements and advanced routing capabilities.
位于华盛顿州西雅图的F5是一家领先的数据中心应用程序交付控制器供应商。它继续专注于数据中心和CSP用例的防火墙模块部署。使用F5或为供应商采购应用程序交付产品的客户应考虑使用供应商提供的防火墙模块。使用供应商防火墙的主要用例是供应商整合、更高的吞吐量需求和高级路由功能。
F5’s Advanced Firewall Manager (AFM) module, as a part of its BIG-IP appliances, is sometimes visible in the vendor’s quotations with other products offered. Gartner comes across existing F5 clients that want to evaluate the firewall capabilities offered by the vendor with other firewall vendors in the market. F5 firewalls have limited visibility in data centers and large enterprise deployment.
F5的高级防火墙管理器(AFM)模块作为其BIG-IP设备的一部分，有时可以在供应商提供的其他产品的报价中看到。Gartner遇到过一些现有的F5客户端，他们希望与市场上的其他防火墙供应商一起评估该供应商提供的防火墙功能。F5防火墙在数据中心和大型企业部署中可见性有限。
F5’s security portfolio includes a WAF solution, access policy manager (APM), web fraud protection (WebSafe), and a DDoS mitigation solution, DDoS Hybrid Defender (DHD). Under the Silverline brand, F5 delivers a cloud WAF and DDoS protection. Its firewall product relies on the BIG-IP appliances (21 models, from 5 Gbps up to 320 Gbps) and VIPRION chassis (six models, up to 1.2TB throughput) hardware platforms, running the F5 Traffic Management Operating System (TMOS). F5 also offers 11 virtual appliances (F5 Virtual Editions [VE]) and centralized management (BIG-IQ) for its BIG-IP solutions.
F5的安全组合包括WAF解决方案、访问策略管理器(APM)、web欺诈保护(WebSafe)和DDoS缓解解决方案、DDoS混合防御器(DHD)。在Silverline品牌下，F5提供了云WAF和DDoS保护。其防火墙产品依赖于大ip设备(21个型号，从5 Gbps到320 Gbps)和VIPRION底盘(6个型号，最高1.2TB吞吐量)硬件平台，运行F5流量管理操作系统(TMOS)。F5还为其BIG-IP解决方案提供11个虚拟设备(F5虚拟版本[VE])和集中管理(BIG-IQ)。
Recent product news includes multiple enhancements related to routing, traffic inspection and DDoS mitigation.
最近的产品新闻包括与路由、流量检查和DDoS缓解相关的多个增强。
Strengths
• Product Strategy: F5’s software is optimized for data center and ISP infrastructure protection use cases with its highly scalable architecture, native load balancing support and focus on carrier-grade issues such as carrier-grade network address translation (CGNAT) and DDoS capabilities.
• 产品策略:F5的软件针对数据中心和ISP基础设施保护用例进行了优化，具有高度可伸缩的体系结构、本地负载平衡支持，并专注于电信级问题，如电信级网络地址转换(CGNAT)和DDoS功能。
• Feature: The vendor offers strong load balancing and DDoS mitigation capabilities. This offers clients the ability to consolidate firewall functionality with mature application delivery and security capabilities. However, all the features come as separate products with dedicated subscriptions.
• 特性:该供应商提供强大的负载平衡和DDoS缓解功能。这为客户提供了利用成熟的应用程序交付和安全功能来整合防火墙功能的能力。但是，所有的功能都是单独的产品，并且有专门的订阅。
• Customer Experience: F5’s customers report better-than-average satisfaction with the vendor’s technical support. Customers also report above-average performance of the F5 firewall, and cite performance and throughput as key deciding factors when selecting F5 for their firewall.
• 客户体验:F5的客户对供应商技术支持的满意度高于平均水平。客户还报告说F5防火墙的性能高于平均水平，并将性能和吞吐量作为选择F5作为防火墙的关键决定因素。
• Product Strategy (IaaS): F5 partners with multiple public IaaS cloud service providers including Alibaba, AWS, Azure, Google Cloud Platform, IBM and Oracle, making it a desirable shortlist candidate for mutlicloud deployments.
• 产品战略(IaaS): F5与多个公共IaaS云服务提供商合作，包括阿里巴巴、AWS、Azure、谷歌云平台、IBM和Oracle，使其成为多云部署的理想候选。
• Product: F5 offers strong TLS decryption in its BIG-IP appliance, as well as a dedicated TLS decryption appliance (SSL Orchestrator). F5 fully supports RFC 8446 TLS 1.3 decryption in TMOS 14.1.0.1 and higher, well ahead of many other firewall vendors, making SSL decryption capabilities stronger than the competitors.
• 产品:F5在其大ip设备中提供强大的TLS解密，以及专用的TLS解密设备(SSL编制器)。F5完全支持TMOS 14.1.0.1及更高版本的RFC 8446 TLS 1.3解密，远远领先于许多其他防火墙厂商，使SSL解密能力强于竞争对手。
• Geographic Presence: F5 is a long-established application delivery vendor with a large, loyal global channel. The vendor also has a direct presence through regional offices worldwide. This makes it a strong global vendor.
• 地理位置:F5是一个历史悠久的应用程序交付供应商，拥有一个大型的、忠诚的全球渠道。该供应商还通过全球区域办事处直接开展业务。这使它成为一个强大的全球供应商。
Cautions
• Sales Execution: F5 rarely appears on Gartner client competitive shortlists for enterprise firewall selection, and often complements other firewalls rather than replacing them. In addition, there has been significant turnover in its sales leadership, impacting reseller relationships over the past year.
• 销售执行:F5很少出现在Gartner客户端竞争企业防火墙的候选名单上，通常是对其他防火墙的补充，而不是取代它们。此外，在过去的一年里，其销售领导层出现了很大的人员流动，影响了经销商之间的关系。
• Customer Experience: F5’s customers generally report satisfaction with its product, but are reluctant to provide unqualified recommendations of it due to a lack of common firewall features, which prevents it from being used in certain use cases such as end-user perimeter firewalls. Surveyed clients have reported more reliance on the vendor’s professional services because of a lack of sufficient product documentation and steep learning curve as product limitations.
• 客户体验:F5的客户通常对其产品表示满意，但不愿提供不合格的建议，因为缺乏通用的防火墙功能，这阻止了它在某些用例中被使用，比如终端用户周边的防火墙。被调查的客户报告更多地依赖于供应商的专业服务，因为缺乏足够的产品文档和陡峭的学习曲线作为产品的局限性。
• Product: The F5 firewall lacks advanced threat detection features such as anti-malware and sandboxing, native or third-party endpoint security integration, and support for SD-WAN, which are commonly provided by vendors competing in the enterprise firewall market.
• 产品:F5防火墙缺乏先进的威胁检测功能，如反恶意软件和沙箱、本地或第三方端点安全集成，以及对SD-WAN的支持，这些功能通常由企业防火墙市场上的竞争厂商提供。
• Product Strategy: F5 does not offer a set of low-end appliances, a multitenant FWaaS option, NAC integration or cloud-based management consoles, and tends to focus its products on carrier-grade networks and large enterprise internal data center use cases. Unlike other vendors in the market, the network team is most likely to manage F5 due to its integration with the application delivery controller and, therefore, may not be managed or considered by security teams for firewall use cases.
• 产品策略:F5不提供一组低端设备、多租户FWaaS选项、NAC集成或基于云的管理控制台，其产品往往集中于电信级网络和大型企业内部数据中心用例。与市场上的其他供应商不同，网络团队最有可能管理F5，因为它与应用程序交付控制器集成，因此，对于防火墙用例，安全团队可能不会管理或考虑F5。
• Market Responsiveness: F5 includes an IDPS feature based on a limited number of SNORT signatures. Gartner advises that customers looking for high-security, network-based intrusion prevention solutions augment the F5 IDPS because it is not as robust or mature as other offerings seen in the network firewall market today.
• 市场响应性:F5包含一个基于有限数量的SNORT签名的IDPS特性。Gartner建议，寻求高安全性、基于网络的*防御解决方案的客户会增加F5的IDPS，因为它不像目前网络防火墙市场上看到的其他产品那样健壮或成熟。
Forcepoint准能科技
Forcepoint is a security vendor headquartered in Austin, Texas. Its firewalls continue to be visible primarily in distributed office use cases where clients are looking for mature SD-WAN, and centralized management capabilities. Gartner sees good potential in the firewall to meet other use cases, but sees a delay in market responsiveness and a lack of focus to expand the customer base beyond distributed office use cases by Forcepoint.
Forcepoint是一家总部位于德克萨斯州奥斯汀的安全供应商。它的防火墙仍然主要出现在分布式办公用例中，在这些用例中，客户正在寻找成熟的SD-WAN、和集中式管理功能。Gartner认为防火墙具有满足其他用例的良好潜力，但它认为市场响应能力较差，并且缺乏通过Forcepoint将客户基础扩展到分布式办公用例之外的重点。
The vendor offers a firewall (Forcepoint NGFW), web and email security gateways (Forcepoint Web Security and Forcepoint Email Security), data loss prevention (Forcepoint DLP), an insider threat solution (Forcepoint Insider Threat), a cloud access security broker (Forcepoint CASB), and user and entity behavior analytics (Forcepoint UEBA). It also offers government-specific security solutions.
供应商提供防火墙(Forcepoint NGFW)、web和电子邮件安全网关(Forcepoint web安全和Forcepoint电子邮件安全)、数据丢失预防(Forcepoint DLP)、内部威胁解决方案(Forcepoint内部威胁)、云访问安全代理(Forcepoint CASB)和用户和实体行为分析(Forcepoint UEBA)。它还提供针对政府的安全解决方案。
Virtual Forcepoint firewalls offer support for Azure and AWS, where they are available, as pay as you go as well.
Virtual Forcepoint防火墙提供了对Azure和AWS的支持，只要你愿意，随时都可以使用它们。
Forcepoint’s recent news includes the introduction of five new compact desktop models. Other updates include support for new, compact desktop models (33x and 5x series), and feature enhancements for SD-WAN and networking. Support for auto-scaling and management for its visual firewalls with virtualized environments (AWS, Azure, VMware, etc.) is available.
Forcepoint的最新消息包括推出五款新的小型台式电脑。其他更新包括对新的、紧凑的桌面模型(33x和5x系列)的支持，以及对SD-WAN和网络的功能增强。支持使用虚拟环境(AWS、Azure、VMware等)自动扩展和管理其可视化防火墙。
Strengths
• Market Execution: The majority of the installed base for Forcepoint firewalls with mature and SD-WAN capabilities is in distributed office use cases. Even the vendor is keen to focus on this use case by continually introducing more enhancements for and SD-WAN.
• 市场执行:具有成熟和SD-WAN功能的Forcepoint防火墙的安装基础主要是在分布式办公用例中。甚至供应商也热衷于关注这个用例，不断地为和SD-WAN引入更多的增强功能。
• Product: Security Management Center (SMC), which is the vendor’s centralized management offering, is very intuitive and easy to use. SMC is available as a management appliance, management appliance ISO image and software.
• 产品:安全管理中心(SMC)，是供应商的集中管理产品，非常直观，易于使用。SMC是一种可用的管理设备，管理设备ISO映像和软件。
• It offers features such as drag and drop, which is very smooth. SMC provides granular administrator access control. Administrator roles can be defined, and mapped with select NGFWs, access control lists and Domains. There is also an administrator privilege for approving pending changes with features such as drag and drop. Surveyed clients have also highly rated SMC and scored it higher in ease of management.
• 它提供了拖放等功能，非常平滑。SMC提供细粒度的管理员访问控制。管理员角色可以通过选择NGFWs、访问控制列表和域来定义和映射。管理员还可以使用拖放等特性批准挂起的更改。接受调查的客户也对SMC给予了很高的评价，并在管理便利性方面给予了更高的分数。
• Feature (IDPS): The vendor has a legacy reputation of mature IDPS offers. Forcepoint utilizes threat intelligence from McAfee GTI and the Lastline reputation service, in addition to Forcepoint TI. Forcepoint firewalls offers best-of-breed firewall clustering capabilities, with a mature load balancing capability between different appliance models and running different firmware. Surveyed clients have also highly rated the firewall clustering capabilities, which are easy to manage and failover is transparent to the network.
• 特性(IDPS):该供应商拥有成熟IDPS产品的传统声誉。Forcepoint利用来自McAfee GTI和Lastline声誉服务的威胁情报，此外还有Forcepoint TI。Forcepoint防火墙提供了最好的防火墙集群功能，在不同的设备模型和运行不同的固件之间具有成熟的负载平衡功能。被调查的客户还高度评价了防火墙的集群功能，这些功能易于管理，而且故障转移对网络是透明的。
• Automation: Forcepoint offers cloud provisioning tools and automated scripts for DevOps use cases. The vendor offers public GitHub project SMC Python and SMC integration for Ansible.
• 自动化:Forcepoint为DevOps用例提供云供应工具和自动化脚本。供应商为Ansible提供公共GitHub项目SMC Python和SMC集成。
• Feature (): Forcepoint firewalls offer easy-to-configure templates. The vendor has a large installed base of multiple branch office use cases. The UI offers easy-to-monitor-and-manage multiple tunnels.
• 特性(): Forcepoint防火墙提供易于配置的模板。该供应商拥有一个庞大的多分支机构用例的安装基础。UI提供了易于监视和管理的多个隧道。
• Capability: The vendor offers built-in UEBA capabilities, bringing advanced threat detection capabilities beyond network sandboxing without the need for an additional subscription. The Forcepoint firewall platform collects data from network engines (physical/software/virtual/cloud variants), endpoint intelligence agents and via Syslog feeds from other third-party solutions deployed within an organization.
• 功能:该供应商提供内置的UEBA功能，带来了超越网络沙箱的高级威胁检测功能，不需要额外的订阅。Forcepoint防火墙平台从网络引擎(物理/软件/虚拟/云变体)、端点情报代理和组织内部署的其他第三方解决方案的Syslog提要收集数据。
Cautions
• Market Execution: Forcepoint sells multiple product lines, out of which Web Security, its SWG product, seems to be the primary product where most R&D work is focused. Gartner finds that the vendor focuses less on its firewall product line as a result, keeping it confined to distributed office use cases. While Gartner thinks that Forcepoint has good experience and a good R&D team, the firewall has the potential to be one of the industry leaders if the vendor focused more toward this product line.
• 市场执行:Forcepoint销售多个产品线，其中其SWG产品Web Security似乎是大多数研发工作重点关注的主要产品。Gartner发现，供应商因此较少关注其防火墙产品线，从而将其限制在分布式办公用例中。虽然Gartner认为Forcepoint有良好的经验和良好的研发团队，但如果供应商更关注这个产品线，防火墙有潜力成为行业领导者之一。
• Marketing: Forcepoint lacks strong marketing of its firewall products; as a result, it does not have much visibility on client shortlists. Despite the firewall offering mature threat detection capabilities, the marketing team markets its SD-WAN and capabilities most of the time, resulting in a lack of awareness within the end-user base.
• 营销:Forcepoint防火墙产品营销力度不够;因此，它在客户入围名单上的可见度不高。尽管防火墙提供了成熟的威胁检测功能，但营销团队大部分时间都在推销其SD-WAN和功能，导致终端用户缺乏意识。
• Offering: The vendor lacks EDR client integration capabilities. It also lacks firewall integration with third-party EDR clients.
• 产品:该供应商缺乏EDR客户端集成功能。它也缺乏与第三方EDR客户端的防火墙集成。
• Product Strategy: Despite having a strong client base and a focus on distributed office use cases, the vendor does not offer a cloud-based management portal, as offered by most competitors. The vendor also lacks FWaaS, despite offering multiple other cloud-based product lines.
• 产品策略:尽管拥有强大的客户基础和对分布式办公用例的关注，但是该供应商并没有像大多数竞争对手那样提供基于云的管理门户。该供应商还缺乏FWaaS，尽管提供了多个其他基于云的产品线。
• Customer Feedback: Surveyed clients have reported that the vendor’s Level 1 support is not competent enough to deal with common support issues and escalates them further, creating longer escalation cycles.
• 客户反馈:接受调查的客户报告称，供应商的一级支持不足以处理常见的支持问题，并将其进一步升级，从而形成更长的上升周期。
Fortinet 飞塔
Fortinet is a network and security player, headquartered in Sunnyvale, California. This year, Fortinet firewalls continue to be visible in distributed office deals where integrated SD-WAN is the primary selection criterion. They are also seen as replacing dedicated routers and act as an edge appliance with firewalls. Fortinet is also a favorable firewall shortlist for customers that cite pricing as an important selection criterion. The vendor offers a range of firewall models to meet multiple firewall deployment use cases. It also offers support for bare metal and virtual firewalls for Alibaba Cloud, AWS, Azure, Google Cloud Platform, IBM Cloud and Oracle OCI IaaS platforms.
Fortinet是一家网络和安全公司，总部位于加州森尼韦尔。今年，在集成SD-WAN为主要选择标准的分布式办公协议中，Fortinet防火墙继续可见。它们也被视为替代专用路由器，并充当防火墙的边缘设备。对于那些将价格作为重要选择标准的客户来说，Fortinet也是一个不错的防火墙候选名单。该供应商提供了一系列防火墙模型，以满足多个防火墙部署用例。它还为阿里巴巴提供裸金属和虚拟防火墙支持
The other products in Fortinet’s portfolio cover network security, endpoint security, security information and event management (SIEM), NAC, wireless access points and switches. FortiGate firewalls are still the vendor’s most popular and best-selling product.
Fortinet的其他产品包括网络安全、端点安全、安全信息和事件管理(SIEM)、NAC、无线接入点和交换机。FortiGate防火墙仍然是该供应商最受欢迎和最畅销的产品。
In 2018 and 2019, Fortinet introduced new FortiGate models 6000F, 3600E, 3400E, 600E and 400E Series. It also had two major firmware releases with enhancements for the FortiGate firewall, new SD-WAN ASIC, virtual security processors, and centralized management and reporting software. It continues to work toward integration through APIs and security fabric.
在2018年和2019年，Fortinet推出了新的防御模型6000F、3600E、3400E、600E和400E系列。它还发布了两个主要的固件版本，其中增强了防御防火墙、新的SD-WAN ASIC、虚拟安全处理器以及集中管理和报告软件。它继续通过api和安全结构进行集成。
Strengths
• SD-WAN: Fortinet offers integrated SD-WAN capabilities within its E-Series firewalls, which makes it a favorable shortlist candidate for distributed enterprise use cases. It comes with capabilities like application-based routing, especially for SaaS applications like Office 365 that are easy to configure. The vendor also offers features such as multipath automated failover for specific applications based on health performance, latency, jitter and packet loss, which enhance the performance of the applications.
• SD-WAN: Fortinet在其e系列防火墙中提供了集成的SD-WAN功能，这使它成为分布式企业用例的理想候选。它具有基于应用程序的路由等功能，特别是对于易于配置的SaaS应用程序(如Office 365)。该供应商还提供基于健康性能、延迟、抖动和包丢失的特定应用程序的多路径自动故障转移等特性，这些特性增强了应用程序的性能。
• SSL Decryption: This year, Fortinet introduced support for TLS 1.3 in the FortiOS 6.2 release. This feature enhances existing deeper inspection capabilities for the Web Filter profile with flow-based inspection mode enabled and for the SSL/SSH Inspection profile.
• SSL解密:今年，Fortinet在FortiOS 6.2版本中引入了对TLS 1.3的支持。该特性通过启用基于流的检查模式增强了Web筛选器概要文件和SSL/SSH检查概要文件现有的更深层次的检查功能。
• Integration: Fortinet continues to extend integration capabilities using security fabric and APIs with AWS, Azure, Google Cloud Platform and Alibaba, and develops tools to offer automation. Some of the capabilities include security fabric integration using AWS Lambda, and automatically updating dynamic addresses for AWS using Fabric Connectors. The vendor also offers playbooks for integration of Ansible and Terraform modules.
• 集成:Fortinet继续使用安全架构和api与AWS、Azure、谷歌云平台和阿里巴巴进行集成，并开发提供自动化的工具。一些功能包括使用AWS Lambda的安全fabric集成，以及使用fabric连接器为AWS自动更新动态地址。供应商还提供了Ansible和Terraform模块集成剧本。
• Geographic Presence: FortiGate firewalls continue to be visible on Gartner client firewall shortlists in different regions, competing with regional players. Regional players have also citied Fortinet as one of the top three competitors for them locally.
• 地理位置:在不同地区的Gartner客户端防火墙候选名单上，加强防火墙仍然可见，与地区玩家竞争。区域玩家也认为Fortinet是他们在当地的三大竞争对手之一。
• Sales Execution: Fortinet works closely with many MSSPs globally that are offering Fortinet firewalls as hosted services to their clients. The vendor has specific licensing models for its VM-Series appliances specific to MSSPs. FortiManager and FortiAnalyzer also offer multiple multitenancy features that can be extended using APIs.
• 销售执行:Fortinet与全球许多mssp密切合作，为其客户提供Fortinet防火墙托管服务。供应商为其特定于mssp的vm系列设备提供特定的许可模型。FortiManager和FortiAnalyzer还提供了多种可以使用api扩展的多租户特性。
• Licensing: While the majority of Gartner clients generally complain about complex licensing by most enterprise-grade firewall vendors, Fortinet has maintained its simpler licensing by offering bundle-based licensing, which is easier to understand and renew for end users.
• 授权许可:尽管Gartner的大多数客户通常抱怨大多数企业级防火墙供应商提供的复杂授权许可，但Fortinet通过提供基于捆绑的授权许可来保持其更简单的授权许可，这对终端用户来说更容易理解和更新。
Cautions
• Visibility: Despite support for multiple cloud IaaS platforms, FortiGate is not visible on Gartner client shortlists as a preferred firewall on IaaS platforms, compared to prominent competitors that have more visibility in this use case.
• 可见性:尽管支持多种云IaaS平台，但在Gartner客户端候选名单上，FortiGate作为IaaS平台上的首选防火墙是不可见的，相比之下，在这个用例中，一些著名的竞争对手有更多的可见性。
• Product: Although Fortinet offers security fabric and API integration capabilities for integration of its products, it lacks mature direct integration capabilities of its firewalls with other security products in the portfolio for threat correlation.
• 产品:虽然Fortinet提供了用于集成其产品的安全结构和API集成功能，但它缺乏将其防火墙与投资组合中的其他安全产品进行直接集成以进行威胁关联的成熟功能。
• The vendor offers basic visibility into infected hosts and their vulnerabilities through FortiClient as a dashboard widget, but lacks mature direct threat correlation capabilities with FortiGate. FortiManager and FortiManager Cloud lack the management controls of FortiWeb, FortiSIEM and FortiCASB.
• 该供应商通过FortiClient作为一个仪表板小部件提供受感染主机