Published 12 November 2026 · Rathish Kumar, Invitty
Palo Alto's PA-500 series brought its firewalls down to small-office and branch size, so the comparison with Fortinet's FortiGate G-series is now a real one. On published figures, the PA-520 lists 1.8 Gbps of threat prevention and the FortiGate 70G lists 1.3 Gbps. The tests behind those numbers differ, and for most buyers the decision turns on management and three-year cost.
Published throughput, side by side
| Model | Firewall throughput | Threat protection or prevention |
|---|---|---|
| Palo Alto PA-505 | 1.2 Gbps (appmix) | 0.8 Gbps |
| Palo Alto PA-510 | 1.8 Gbps (appmix) | 1.2 Gbps |
| Palo Alto PA-520 | 2.8 Gbps (appmix) | 1.8 Gbps |
| Palo Alto PA-540 | 3.8 Gbps (appmix) | 2.2 Gbps |
| FortiGate 50G | 5 Gbps | 1.1 Gbps |
| FortiGate 70G | 10 Gbps | 1.3 Gbps |
| FortiGate 90G | 28 Gbps | 2.2 Gbps |
What each number actually includes
The firewall throughput columns are not alike. Palo Alto measures firewall throughput with App-ID and logging on, using application-mix traffic. Fortinet's headline firewall figure uses large UDP packets, which is why it looks several times higher. Ignore that column when comparing these two brands.
The threat columns are closer but still not equal. Palo Alto's threat prevention figure is measured with App-ID, IPS, antivirus, anti-spyware, WildFire, file blocking and logging all on, on PAN-OS 12.2. Fortinet's threat protection figure covers firewall, IPS, application control and malware protection on its enterprise mix. Palo Alto switches on more during its test, so its smaller-looking number is not the weaker result it appears to be.
Management and the platform you are buying into
Palo Alto's strength is consistency. If head office already runs Palo Alto, a PA-500 at each branch gives you the same App-ID policy model and logging, managed through Strata Cloud Manager or Panorama. The datasheet also notes that the PA-500 series is ready for post-quantum cryptography with PAN-OS 12.1, which matters to some BFSI and government buyers on long hardware cycles.
FortiGate's strength is breadth for the price. SD-WAN is built in, and FortiSwitch and FortiAP can be run from the firewall itself. For an Indian SMB with a handful of branches on mixed links, that single box doing firewall, SD-WAN and switch control is often the deciding factor.
Both need firmware discipline
Neither vendor is immune to serious flaws. In November 2026 alone we covered critical FortiOS and FortiManager fixes and a PAN-OS data leak with no workaround. Whichever you choose, budget for someone to apply firmware on a schedule. An unpatched premium firewall is worse than a patched budget one.
The three-year bill
Palo Alto quotes usually separate more of the security services into individual subscriptions, while Fortinet sells them in bundles. Ask both for three years of comparable protection, itemised with GST, so you compare like with like. Our renewals desk can lay out both side by side.
Next step
Tell us your sites, links and what head office runs today. We will propose one Palo Alto and one FortiGate design against the same requirement, so the choice is about fit, not sales pressure.
Frequently asked questions
Is Palo Alto worth the higher price for a small office?
Can FortiGate and Palo Alto run side by side?
Which PA-500 model matches a FortiGate 70G?
Sources
Figures in this guide come from these vendor pages, checked on 12 November 2026. Vendors update datasheets, so confirm the current figures before you order.