In short
For a small business, choose a firewall on its throughput with security services switched on, measured against your internet speed and user count, plus the ports, Wi-Fi, PoE or 4G/5G you need. Security features are a 1, 3 or 5-year subscription bought with it. Desktop FortiGate, Cisco Secure Firewall and WatchGuard models suit most offices. We quote and can install.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
What a small business firewall needs to do
Most small offices want the same core jobs from one desktop box:
- Protect the internet connection: intrusion prevention, antivirus and sandboxing on traffic, and application control.
- Filter the web: block malicious and unwanted website categories (and, on some models, DNS and video filtering).
- Connect people: remote-access VPN for home workers and site-to-site VPN to other offices.
- Keep the office online: a second WAN port or a built-in 4G or 5G modem for backup, with SD-WAN choosing the best line.
- Simplify the cabinet: built-in Wi-Fi or PoE ports on some models can save a separate access point or switch.
If you also need to meet Cyber Essentials, its firewall requirements are explained on cyber-essentials-uk.net (opens in a new tab).
Shop firewalls
See all 18 productsSizing: use the figure measured with security on
A data sheet's headline firewall throughput is measured with inspection turned off. Size on the figure the vendor measures with its security services running, compare it with your internet line, and leave room to grow:
- Fortinet publishes threat protection throughput (firewall, IPS, application control and malware protection on).
- Cisco publishes FW + AVC + IPS throughput (firewall, application visibility and control, and IPS).
- WatchGuard publishes UTM (full scan) throughput, plus an "Ideal for" user count per model.
The three are measured differently, so they are not like-for-like across vendors. As a rule of thumb we look for a security-on figure comfortably above the speed of your fastest internet line, then check VPN numbers if many people work from home, and HTTPS inspection if you want it, which costs the most processing.
Ports, Wi-Fi, PoE and backup internet
- Ports: count the internal devices that plug straight into the firewall, plus WAN ports for each internet line. Many offices only need a few, with a switch behind the firewall.
- Built-in Wi-Fi: FortiWiFi models (part numbers starting FWF, UK versions ending -E) and WatchGuard -W models have Wi-Fi built in. Fine for a small space; larger offices are better served by separate wireless access points.
- PoE: the FortiGate 50G-SFP-POE and 70G-POE, the Cisco Secure Firewall 240P and 1210CP and the WatchGuard T185 can power a phone or an access point from the firewall. The PoE budget guide shows how to check the power.
- Backup internet: the FortiGate 40F-3G4G and 50G-5G and the WatchGuard T45-CW have mobile modems built in; any model with two WAN ports can use a separate 4G or 5G router or a second line.
- High availability: two identical firewalls, one taking over if the other fails. FortiGate firewalls have -HA pair part numbers on several desktop models, and WatchGuard datasheets list active/passive and active/active HA.
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
The subscription is part of the cost
The security services are subscriptions, bought for 1, 3 or 5 years with the hardware and renewed after that:
- Fortinet: FortiGuard bundles, Advanced Threat Protection (ATP), Unified Threat Protection (UTP) or Enterprise Protection, with FortiCare support included. See FortiGuard bundles compared.
- Cisco: Threat Defense feature licences per appliance (T, TC, TM or TMC). Cisco says "Threat/IPS (T) License is a requirement for the use of Malware (M) or URL (C) license features".
- WatchGuard: Standard Support, or the Basic, Prime or Total Security Suite. WatchGuard offers Prime only on its models launched after 2025.
Looking for the cheapest small business firewall? The box is only part of the cost; the subscription tier and term make the difference over the years. Ask us for a quote on two or three options side by side and we will show the hardware and subscription lines together.
Models to shortlist
Desktop models that suit most small offices, with the security-on figure each vendor publishes (credited to its data sheet; not comparable across vendors):
| Model | Figure to size on (vendor's own measure) | Ports and options | Part number | Basket |
|---|---|---|---|---|
| FortiGate 30G | Threat protection 500 Mbps | 4 x GE RJ45; FortiWiFi version with Wi-Fi 6 | FG-30G | |
| FortiGate 40F | Threat protection 600 Mbps | 5 x GE RJ45; 3G4G version with built-in LTE | FG-40F | |
| FortiGate 50G | Threat protection 1.1 Gbps | Wi-Fi, SFP, PoE+, DSL and 5G versions | FG-50G | |
| FortiGate 70G | Threat protection 1.3 Gbps | 10 x GE RJ45; PoE and FortiWiFi versions | FG-70G | |
| Cisco Secure Firewall 220 | FW + AVC + IPS 1.5 Gbps | 4 x 1000BASE-T, 1 x 1G SFP; needs a Threat Defense licence (T, TC, TM or TMC), chosen in the next step | CSF220-TD-K9 | |
| Cisco Secure Firewall 240P | FW + AVC + IPS 3 Gbps | 8 x 1000BASE-T, 2 x 1G SFP, 4 PoE+ ports; needs a Threat Defense licence, chosen in the next step | CSF240P-TD-K9 | |
| Cisco Secure Firewall 1210CE | FW + AVC + IPS 6.0 Gbps | 8 x 1000BASE-T, compact desktop; 1210CP adds PoE; needs a Threat Defense licence, chosen in the next step | CSF1210CE-TD-K9 | |
| WatchGuard Firebox T125 | UTM full scan 510 Mbps; WatchGuard: ideal for 25 users | 1 x 2.5 GbE, 4 x 1 GbE | Confirmed at quote | |
| WatchGuard Firebox T145 | UTM full scan 710 Mbps; WatchGuard: ideal for 50 users | 1 x 2.5 GbE, 4 x 1 GbE, 1 x SFP/SFP+ | Confirmed at quote | |
| WatchGuard Firebox T185 | UTM full scan 1.83 Gbps; WatchGuard: ideal for 100 users | 4 x 1 GbE, 4 x 2.5 GbE (2 PoE+ PSE, 802.3at), 1 x SFP/SFP+ | Confirmed at quote |
WatchGuard does not publish public part numbers, so its lines are confirmed at quote. For more FortiGate models side by side, see the FortiGate product matrix; for the vendors compared, see Fortinet vs WatchGuard.
Compare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
Management and who looks after it
Each of these firewalls can be managed from its own web interface, and centrally from the vendor's tools: FortiManager or FortiManagement Cloud for FortiGate firewalls, Firewall Device Manager, Management Center or Security Cloud Control for Cisco Threat Defense, and WatchGuard Cloud for Firebox appliances.
We can set the firewall up for you, with VPNs, policies and web filtering configured and documented at handover. If you would rather have the firewall run for you day to day, see managed firewall services (opens in a new tab) on mssp.org.uk.
How to order
How ordering works. Press Add next to a part number and it goes into your basket; where a subscription or support contract goes with the hardware, you choose it in the same step. Then View basket and Request a quote. We check every line, quantity and term against your sites and send back a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the equipment, with the scope confirmed at quote (see network installation).
Not sure which to pick? Contact us with your user count, internet speed and the services you want, and we will suggest two or three models with their subscriptions.
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is the best firewall for a small business?
There is no single best one: the right model depends on your internet speed, users, VPN needs and whether you want Wi-Fi, PoE or 4G/5G built in. Desktop FortiGate, Cisco Secure Firewall and WatchGuard Firebox models all suit small offices; we suggest a shortlist from your details.
Which Fortinet firewall suits a small business?
Fortinet's Entry-Level (Branch) desktop models, from the FortiGate 30G and 40F for very small offices to the 50G, 70G and 80F for growing ones. Size on the threat protection throughput in each data sheet.
What is the cheapest Fortinet firewall?
The FortiGate 30G is the smallest model in Fortinet's current range. The total cost depends on the FortiGuard bundle and term as well as the hardware, so ask us for a quote that shows both.
Do I need a subscription with a small business firewall?
For the security features, yes: intrusion prevention, malware protection and web filtering need a current FortiGuard bundle, Cisco Threat Defense licence or WatchGuard suite. The basic firewall and VPN keep working without one, but without the threat updates.
How do I size a firewall?
Compare the vendor's security-on throughput (Fortinet threat protection, Cisco FW + AVC + IPS, WatchGuard UTM full scan) with your fastest internet line, add headroom, and check VPN numbers for home workers.
Can you install it?
Yes. We can design, supply, stage, install and configure the firewall, VPNs and web filtering, with the scope confirmed at quote.
Ready to order?
Build your basket and check out when you are ready.