+ + +

Comparison matrix

-

Let's start with a basic feature comparison between Defguard and Fortinet, then we'll go into greater detail.

+

Let's start with a high-level feature comparison between Defguard and Fortinet, then we'll dive into the critical details.

- + - - - - - - - - - - - - + + - - + + - - - + + + - - - + + + + + + + + - - + + - - - + + + - - - + + + - - + +
Feature Defguard Fortinet (FortiGate & FortiClient)
MFA EnforcementWireGuard VPN Protocol-level MFA - Every connection authenticated - No - 2FA enabled throgh FortiToken and FortiAuthenticator -
Inspectability & VerifiabilityFull - open code and open source project evailable on GitHubNone - Proprietary closed-source solution
VPN ProtocolWireGuard® - Fast, stateless, resilientIPsec & SSL VPN - Slower, stateful, legacyWireGuard® - Fast, stateless, minimal attack surface.IPsec & SSL VPN - Slower, stateful, legacy protocols.
ArchitectureMicroservices divided into network segments, control plane in the Intranet segment is not accessible from public networksAppliance-centric - Centralized, some components publicModern Microservices - Segregated control & data planes.Appliance-Centric Monolith - Centralized, public-facing components.
OnboardingUser-centric & automated - Token-based self-serviceAdministrator-driven & manual - Per-user configurationPost-Breach ResilienceHigh - Designed to resist persistent threats.Critically Low - Documented malware (COATHANGER) survives patches and reboots.
PerformanceSuperior - High throughput, low latency peer to peerVariable - Depends on protocol and hardware offloadingMFA EnforcementProtocol-level MFA - Built-in, every connection authenticated.Application-level 2FA - Requires costly add-ons like FortiToken.
Open SourceYes - Fully open-source, written in Rust for verifiable security.No - Proprietary, closed-source system.
Identity ManagementBuilt-in OIDC IdP and external IdP integration (Microsoft, Google etc.)Part of broader suite - External IdPs, proprietary ecosystemBuilt-in IdP & simple SSO integration (Microsoft, Google, Okta).Requires separate ecosystem components (FortiAuthenticator).
Security & TransparencyOpen-source & auditable - Rust-based, minimal dependenciesProprietary - Closed-source, larger attack surfaceOnboardingUser-centric & automated - Self-service via enrollment tokens.Administrator-driven & manual - Complex, per-user configuration.
Open sourceYes - Fully open-source, written in RustNo - Proprietary closed-source solutionPerformanceSuperior - High throughput, low latency via peer-to-peer connections.Variable - Centralized gateway bottlenecks.
CostSubscription-based - No hardware required, simple pricing based on number of users and locationsComplex pricing depending on the number of components and features. Additional high costs for MFA and HASimple & Predictable - Subscription-based, all features included.Complex & Opaque - Multiple hidden license fees.
- + - -
-

Defguard vs Fortinet architecture overview and performance implications

-

- Fortinet's FortiClient VPN uses a traditional client-server or hub-and-spoke model. A typical setup requires FortiClient, - the endpoint agent, and FortiGate—FortiClient and FortiGate are not the same. FortiGate began as the "hub" hardware - offering that acts as a firewall, gateway, and policy enforcement point. -

-

- Remote users connect to a FortiGate gateway using FortiClient. All traffic goes through a FortiGate access proxy, - which also acts as an enforcer of access policies to internal applications. In other words, the control plane and - data plane both flow through FortiGate. -

-

- Fundamentally, Fortinet's design choice impacts speed and performance. The farther the client device is from the gateway, - the greater the impact. To counteract this, more FortiGate enforcement points can be set up, adding more management required. -

+ +
+

Defguard vs. Fortinet: Architecture & Performance

- In contrast to Fortinet, Defguard does not use a traditional model, instead employing a secure microservice architecture - with an internal Core and external stateless Proxy. The Core operates exclusively within your internal network, making it - inaccessible from the internet. Remote connections are handled by the secure, stateless Proxy component. + Fortinet's FortiClient VPN relies on a traditional client-server model. All traffic is funneled through a central FortiGate appliance. + This monolithic architecture, where dozens of services are bundled into the FortiOS codebase, creates a single, massive point of + failure and a performance bottleneck. For a Head of IT, this means any attack on the gateway can bring the entire remote access + infrastructure down.

- Because WireGuard is built into the kernel or runs in a high-efficiency module, it is capable of high throughput with - low overhead. Furthermore, the distributed nature of this data plane means there is no single bottleneck like a gateway. - Traffic takes the shortest path available, improving reliability and latency. + In stark contrast, Defguard employs a modern microservice architecture that segregates the control and data planes. The control plane operates + exclusively within your internal network, inaccessible from the public internet. The data plane, built on WireGuard®, is decentralized, + enabling direct connections that eliminate bottlenecks, improve latency, and enhance reliability.

@@ -167,7 +182,7 @@ const tags = [
Click to zoom

- Defguard's secure microservice architecture: Internal Core (eg. deployed in intranet and not) and external stateless Proxy (public-facing) + Defguard's secure microservice architecture: Internal Core and external stateless Proxy (public-facing) ensure sensitive data never leaves your internal network while providing secure remote access.