In short
A business firewall appliance sits between your network and the internet, controlling traffic and VPNs and, with a security subscription, blocking intrusions, malware and risky websites. Small offices suit desktop models such as the FortiGate 50G or WatchGuard T125; head offices suit rack-mount models. Security services are subscriptions bought with the hardware. We quote by part number and can install.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
What a next-generation firewall appliance does
Every firewall here is a next-generation firewall (NGFW): as well as allowing or blocking traffic by address and port, it recognises applications, inspects traffic for intrusions and malware, filters websites, and terminates site-to-site and remote-access VPNs. Most also route between your internal networks and manage more than one internet line (SD-WAN), so a branch can fail over from fibre to 4G or 5G.
The appliance is the hardware and the operating system: FortiOS on FortiGate firewalls, Threat Defense or ASA on Cisco, Fireware on WatchGuard Firebox and Junos on Juniper SRX. The threat feeds that keep IPS signatures, antivirus and web categories up to date are subscriptions, bought for 1, 3 or 5 years with the hardware and renewed after that.
Which range suits which site
A first pass at the shortlist. Each range page has every model and part number:
| Your site | Ranges to look at | Why |
|---|---|---|
| Small office, shop or home office on one broadband line | FortiGate 30G, 40F and 50G; Cisco Secure Firewall 220; WatchGuard T115-W and T125; Juniper SRX300 | Desktop units, several with built-in Wi-Fi, DSL or 4G/5G versions |
| Office that needs PoE for phones or an access point, or two internet lines | FortiGate 50G-SFP-POE, 70G-POE, 80F-POE; Cisco 240P and 1210CP; WatchGuard T185; SRX320-POE and SRX380 | PoE ports on the firewall itself, plus separate WAN ports for failover |
| Larger branch or small head office | FortiGate 70G, 80F and 90G; Cisco 1220CX to 1240; WatchGuard T175, M295 and M395; SRX340, SRX345, SRX400 and SRX440 | More throughput with security services on, 10G SFP+ ports on some models, high availability pairs |
| Head office or campus edge with 10G or faster links | FortiGate 120G, 200G and the 400F to 900G; Cisco 1250 and 3100; WatchGuard M495 to M6850; SRX1600 and SRX2300 | Rack-mount appliances with SFP+, SFP28 or faster ports, redundant power on many models |
Already running one vendor's switches or access points? It often pays to stay with that vendor: a FortiGate firewall manages FortiSwitch and FortiAP from the same screens, and WatchGuard manages its access points from WatchGuard Cloud.
Compare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
Sizing: compare throughput with security services on
The headline firewall figure on any data sheet is measured with inspection turned off. Size on the figure measured with the security services you will actually run. Each vendor names it differently, so the figures are not like-for-like across vendors:
| Vendor | Figure to size on | What the vendor measures |
|---|---|---|
| Fortinet | Threat protection throughput | Firewall, IPS, application control and malware protection enabled (Fortinet data sheets) |
| Cisco | FW + AVC + IPS throughput | Firewall, application visibility and control, and IPS (Cisco data sheets) |
| WatchGuard | UTM (full scan) | WatchGuard's UTM figure with its security services scanning; WatchGuard also publishes an 'Ideal for' user count |
| HPE Juniper Networking | NGFW or IPS throughput, IMIX | Figures in HPE's SRX hardware guides, with IMIX traffic where stated |
Then add headroom for growth, for faster internet lines you may take later, and for VPN and HTTPS inspection, which cost the most processing. The small business firewall guide walks through it, and the FortiGate product matrix puts the FortiGate figures side by side.
The subscription you buy with the firewall
- Fortinet: FortiGuard bundles (ATP, UTP or Enterprise Protection, or the SD-WAN bundle) with FortiCare support, or hardware-plus-bundle part numbers that buy both in one line. See FortiGuard bundles.
- Cisco: Threat Defense feature licences per appliance, T (threat/IPS), TC (plus URL filtering), TM (plus malware) or TMC (all three), for 1, 3 or 5 years. Cisco says "Threat/IPS (T) License is a requirement for the use of Malware (M) or URL (C) license features".
- WatchGuard: Standard Support, or the Basic, Prime or Total Security Suite. WatchGuard offers Prime only on its models launched after 2025.
- HPE Juniper Networking SRX: Junos Software Base or Enhanced (included in the system part numbers), then optional Advanced or Premium security subscriptions and HPE Mist WAN Assurance.
Our basket asks for the subscription when you add the firewall, and we confirm the tier and term at quote.
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
Desktop or rack-mount, single or HA pair
- Desktop (tabletop) units sit on a shelf or wall; most take an optional rack tray or rack kit. They suit offices without a comms cabinet.
- Rack-mount (1U and larger) appliances go in a 19-inch cabinet and usually add SFP+ or faster fibre ports, more interfaces and, on larger models, dual power supplies.
- High availability (HA) joins two identical firewalls so one takes over if the other fails. FortiGate firewalls have dedicated -HA pair part numbers on several desktop models; Cisco needs a subscription on each unit of the pair; WatchGuard datasheets list active/passive and active/active HA, and the larger Juniper SRX models have dedicated HA ports.
Built-in Wi-Fi (FortiWiFi, WatchGuard -W models), PoE ports, DSL and 4G or 5G modems are options on some desktop models, which can save a separate router or access point in a small office.
Firewalls by range
| Range | Vendor | Models | Examples |
|---|---|---|---|
| Cisco Secure Firewall 200 Series | Cisco | 2 | CSF220, CSF240P |
| Cisco Secure Firewall 1200 Series | Cisco | 6 | CSF1210CE, CSF1210CP, CSF1220CX, CSF1230, CSF1240, CSF1250 |
| Cisco Secure Firewall 3100 Series | Cisco | 5 | FPR3105, FPR3110, FPR3120, FPR3130, FPR3140 |
| Cisco Secure Firewall 4200 Series | Cisco | 3 | FPR4215, FPR4225, FPR4245 |
| Cisco Firepower 1000 Series | Cisco | 5 | FPR1010, FPR1010E, FPR1120, FPR1140, FPR1150 |
| FortiGate/FortiWiFi 30G Series | Fortinet | 4 | FG-30G, FG-31G, FWF-30G, FWF-31G |
| FortiGate 40F Series | Fortinet | 2 | FG-40F, FG-40F-3G4G |
| FortiGate/FortiWiFi 50G Series | Fortinet | 13 | FG-50G, FG-51G, FWF-50G, FWF-51G, FG-50G-SFP, FWF-50G-SFP and more |
| FortiGate 60F Series | Fortinet | 2 | FG-60F, FG-61F |
| FortiGate/FortiWiFi 70G Series (and FortiGate 71F) | Fortinet | 8 | FG-70G, FG-70G-POE, FG-71G, FG-71G-POE, FWF-70G, FWF-70G-POE and more |
| FortiGate 80F Series | Fortinet | 7 | FG-80F, FG-81F, FG-80F-POE, FG-81F-POE, FG-80F-DSL, FWF-80F-2R and more |
| FortiGate 90G Series | Fortinet | 2 | FG-90G, FG-91G |
| FortiGate 120G Series | Fortinet | 2 | FG-120G, FG-121G |
| FortiGate 200G Series | Fortinet | 2 | FG-200G, FG-201G |
| FortiGate Mid-Range: 400F, 400G, 700G and 900G Series | Fortinet | 8 | FG-400F, FG-401F, FG-400G, FG-401G, FG-700G, FG-701G and more |
| Juniper SRX300 line (SRX300, SRX320, SRX340, SRX345, SRX380) | HPE Networking | 5 | SRX300, SRX320, SRX340, SRX345, SRX380 |
| Juniper SRX400 and SRX440 | HPE Networking | 2 | SRX400, SRX440 |
| Juniper SRX1600, SRX2300, SRX4120, SRX4200 and SRX4300 | HPE Networking | 5 | SRX1600, SRX2300, SRX4120, SRX4200, SRX4300 |
| Juniper SRX4600 and SRX4700 | HPE Networking | 2 | SRX4600, SRX4700 |
| WatchGuard Firebox tabletop appliances (T Series) | WatchGuard | 7 | Firebox T115-W, Firebox T125 , Firebox T145 , Firebox T175, Firebox T185, Firebox NV5 and more |
| WatchGuard Firebox rackmount appliances (M Series) | WatchGuard | 8 | Firebox M295, Firebox M395, Firebox M495, Firebox M595, Firebox M695, Firebox M4850 and more |
Managed firewall, cloud firewall or Cyber Essentials?
This shop sells the appliances and can set them up. If you would rather we ran the firewall for you day to day, see managed firewall services (opens in a new tab) on mssp.org.uk. Virtual and cloud firewalls are on cloud-security.cloud (opens in a new tab), and the firewall rules Cyber Essentials asks for are on cyber-essentials-uk.net (opens in a new tab). For the Cisco software side (Threat Defense, ASA and Management Center), see Cisco Secure Firewall (opens in a new tab) on ciscosecure.co.uk, and for how a firewall compares with SASE, SASE vs firewall (opens in a new tab) on ztna.org.uk.
How to order a firewall
How ordering works. Press Add next to a part number and it goes into your basket; where a security subscription or support contract goes with the firewall, you choose it in the same step. Add any accessories, then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the firewalls, VPNs and policies as a project, with the scope confirmed at quote (see network installation).
Not sure which model fits? Contact us with your user count, internet lines and the services you want to run, and we will suggest a model and subscription.
Explore Firewalls
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is a hardware firewall?
A dedicated appliance that sits between your network and the internet and decides what traffic may pass. Business models add VPNs, routing, SD-WAN and, with a subscription, intrusion prevention, malware scanning and web filtering.
Do business firewalls need a subscription?
The security services do. FortiGuard bundles, Cisco Threat Defense licences, WatchGuard security suites and Juniper SRX security subscriptions keep signatures and threat feeds current, for 1, 3 or 5 years. We quote the hardware and the subscription together.
Which firewall is best for a small business?
It depends on users, internet speed and the services you run. Desktop models such as the FortiGate 50G or 70G, Cisco Secure Firewall 220 or 1210CE and WatchGuard T125 or T145 are typical. Tell us about your site and we will suggest one.
What throughput figure should I compare?
The figure measured with security services on: Fortinet threat protection, Cisco FW + AVC + IPS and WatchGuard UTM full scan. Plain firewall throughput is measured with inspection off and is much higher.
Can you install the firewall?
Yes. We can design, supply, stage, install and configure the firewall, VPNs and policies, with the scope confirmed at quote.
Ready to order?
Build your basket and check out when you are ready.