This small business firewall comparison has a short answer. For a 10 to 250 person office with no dedicated network engineer, FortiGate is usually the easiest fit. Choose Juniper SRX when you already run Junos or need real routing on the edge. Choose Palo Alto when threat prevention and audit evidence matter more than the quote.
That answer is honest about Juniper. An SRX is often the wrong box for a small office whose only IT person works in a GUI. It is the right box when the same team already runs EX or MX, writes config in set format, and wants one operating model from branch to core.
This guide uses published datasheet figures, not street prices. Prices move by reseller and region, so we do not print them. CLI examples are written against the Junos OS 23.4 train on the SRX300 line. Treat them as a starting point to check in your own lab, not as tested production config.
Company Context Before You Buy
Juniper Networks is no longer an independent company. HPE completed its acquisition of Juniper in July 2025. The DOJ settlement required HPE to license the Juniper Mist AIOps source code to a third party through an auction. Check the current status before you rely on Mist in a procurement argument.
For an SRX buyer the practical question is roadmap. HPE now owns two security portfolios. In its 2026 SASE report, as summarised by SDxCentral, Gartner expects HPE to fold the SRX stack into its SASE platform. Ask your account team for the SRX300 line roadmap in writing. The same advice applies to any five-year firewall purchase.
Read the Right Row of the Datasheet
Most firewall comparisons go wrong on one number. The headline figure on every vendor datasheet is large-packet stateful throughput. Nobody runs a small office on 1,518-byte UDP packets. The number that predicts your experience is the one measured with inspection turned on.
The Juniper SRX300 line datasheet shows the gap clearly. The figures below come from that datasheet, in Mbps unless stated.
| Model | Stateful firewall (1,518 B) | Stateful firewall (IMIX) | IPsec VPN (1,400 B) | NGFW | Max sessions |
|---|---|---|---|---|---|
| SRX300 | 1,900 | 600 | 336 | 226 | 64,000 |
| SRX320 | 1,900 | 600 | 336 | 226 | 64,000 |
| SRX340 | 4,700 | 1,100 | 733 | 420 | 256,000 |
| SRX345 | 5,000 | 1,500 | 977 | 430 | 375,000 |
| SRX380 | 20,000 | 6,500 | 4,400 | 2,500 | 380,000 |
Look at the SRX345. Its headline is 5 Gbps. With firewall, application security and IPS enabled, Juniper publishes 430 Mbps. That is roughly a twelfth of the headline, and it is the figure that matters on a 500 Mbps internet circuit.
This is not a Juniper weakness. Every vendor has the same gap, because deep inspection is expensive per byte and branch hardware is sized for price. The trap is comparing one vendor's headline with another vendor's inspected number. A community thread on truthful SRX branch throughput shows how often engineers discover this after purchase.
Each vendor measures inspected throughput differently
| Vendor | Inspected metric | Services enabled in the test, as each vendor states |
|---|---|---|
| Juniper SRX300 line | Next-generation firewall | Firewall, application security and IPS, 64 KB transactions |
| Fortinet FortiGate | Threat protection | Firewall, IPS, application control and malware protection |
| Palo Alto PA-400 | Threat prevention | App-ID, IPS, antivirus, anti-spyware, WildFire, DNS Security, file blocking and logging, 64 KB transactions |
The service lists differ, so the numbers are not directly comparable. Pull the current datasheet for each shortlisted model and write the inspected figure next to your circuit speed. If the inspected number is below your circuit, move up a model. We do not reproduce FortiGate or PA-400 figures here, because they change between hardware revisions and software releases.
Small Business Firewall Comparison: Where Each Platform Fits
Juniper SRX: the router that is also a firewall
The SRX300 line runs the same Junos OS as Juniper routers and switches. The datasheet lists OSPF, BGP, IS-IS, multicast, MPLS with RSVP and LDP, and Layer 3 VPNs on these branch boxes. No other platform in this comparison gives a small office that much routing on the same appliance.
The operational model is the real draw. Candidate configuration, commit check, commit confirmed and rollback make change control safer than most GUIs. Management options include J-Web on the box, Security Director Cloud, and Mist WAN Assurance.
The costs are skills and polish. J-Web works, but most admins who choose SRX end up in the CLI. IPS, content security and Advanced Threat Prevention are separately licensed, so check exactly which subscriptions a quote includes.
Fortinet FortiGate: integration and price for small teams
FortiGate wins many small-office deals on bundled value. FortiOS includes SD-WAN, and the Security Fabric manages FortiSwitch and FortiAP from the firewall. For a site with one generalist admin, one console for wired, wireless and security is a genuine operational saving.
The trade-off is patch discipline. In its 2026 SASE assessment, Gartner noted that the large Fortinet installed base makes its firewalls a frequent target, which drives frequent patching. A FortiGate that is not upgraded promptly is a liability. Licensing bundles also differ in content, so compare line items rather than bundle names.
Palo Alto PA-400: when threat prevention is the requirement
Palo Alto built its reputation on App-ID, which classifies traffic by application rather than port. Policy becomes allow this application for this group, instead of a list of port ranges. WildFire sandboxing and the threat prevention subscriptions are the core of its pitch.
Price is the usual objection. Gartner cited reportedly expensive pricing among the reasons Palo Alto slipped in its 2026 SASE ranking. SD-WAN exists on PAN-OS firewalls and as the separate Prisma SD-WAN product, so confirm which one your quote includes.
Total Cost of Ownership: What to Model
We do not publish five-year cost tables, because any figure we printed would be wrong for your region and reseller. Instead, get every vendor to quote the same line items for years one to five. The list below is ordered by where quotes most often diverge, in our experience.
- Security subscription renewals. IPS, URL filtering, anti-malware and sandboxing renew every year. Ask for years two to five in writing, not just year one.
- Support renewal. Hardware replacement and software access are usually a separate contract from security services.
- High availability. A second unit for a chassis cluster or HA pair may need its own subscriptions. Ask how the vendor licenses the secondary.
- Central management. Security Director Cloud, FortiManager and Panorama or Strata Cloud Manager each carry their own pricing.
- Staff time. A platform your team already knows costs fewer hours per change. This line most often favours SRX in a Junos shop and FortiGate everywhere else.
- Refresh timing. Check the published end-of-life policy for each model. A cheap model near the end of its sale life can cost more than a newer one.
Evaluating an SRX in a Trial
If SRX is on your shortlist, borrow a unit and run it inline for a week. Start with these operational commands. They show what is licensed, how busy the box is, and whether IPS signatures are current.
user@srx-branch> show system license
user@srx-branch> show chassis routing-engine
user@srx-branch> show security flow session summary
user@srx-branch> show security idp security-package-version
user@srx-branch> show security policies hit-countA minimal internet-edge baseline for the trial is below. It assumes ge-0/0/0 faces the ISP and ge-0/0/1 faces the LAN. On an SRX300 with factory-default config, the LAN ports sit in a VLAN with irb.0. Either remove that, or put the trust addressing on irb.0 instead. Use commit confirmed 5 and keep console access, because a mistake here cuts off management.
set interfaces ge-0/0/0 unit 0 family inet address 203.0.113.2/30
set interfaces ge-0/0/1 unit 0 family inet address 192.0.2.1/24
set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1
set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh
set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ping
set security nat source rule-set TRUST-TO-UNTRUST from zone trust
set security nat source rule-set TRUST-TO-UNTRUST to zone untrust
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-ALL match source-address 0.0.0.0/0
set security nat source rule-set TRUST-TO-UNTRUST rule SNAT-ALL then source-nat interface
set security policies from-zone trust to-zone untrust policy ALLOW-OUT match source-address any
set security policies from-zone trust to-zone untrust policy ALLOW-OUT match destination-address any
set security policies from-zone trust to-zone untrust policy ALLOW-OUT match application any
set security policies from-zone trust to-zone untrust policy ALLOW-OUT then permit
set security policies from-zone trust to-zone untrust policy ALLOW-OUT then log session-close
commit confirmed 5This policy permits all outbound traffic and logs each session. It does not inspect content, block applications or protect inbound services. Add IPS and application policy only after the baseline works. That way you can measure the throughput cost of each feature on your own traffic.
Verification: What Healthy and Broken Look Like
After a day of real traffic, the session summary should look broadly like this. The numbers are illustrative, and the field list varies slightly by release.
user@srx-branch> show security flow session summary
Unicast-sessions: 1487
Multicast-sessions: 0
Failed-sessions: 0
Sessions-in-use: 1512
Valid sessions: 1487
Pending sessions: 0
Invalidated sessions: 25
Sessions in other states: 0
Maximum-sessions: 375000Two broken patterns matter in a trial. If Failed-sessions climbs steadily, the box is refusing sessions, often because of a policy or resource limit. If show security policies hit-count shows zero on ALLOW-OUT while users are browsing, traffic is not entering the zones you expect. Check interface-to-zone bindings first.
Watch Sessions-in-use against Maximum-sessions at your busiest hour. A small office rarely approaches the limit, but guest Wi-Fi and IoT devices can surprise you. The datasheet session figure is a ceiling, not a target.
Which Firewall Should You Buy?
- Under 50 users, one generalist admin, no Junos skills: start with FortiGate. Juniper is usually the wrong answer here, because the operating model you pay for goes unused.
- Existing EX, QFX or MX estate and staff who work in the Junos CLI: size an SRX340, SRX345 or SRX380 on its NGFW figure against your circuit. One operating model across the network saves real hours.
- Branch needs BGP, OSPF or MPLS on the edge appliance: SRX is the strongest routing platform of the three at this size.
- Regulated industry where auditors or insurers ask about threat prevention: shortlist Palo Alto first, then justify any alternative on paper.
- Many small sites and plans for cloud-delivered security: read our guide to what SASE changes for branch firewalls before choosing hardware.
If you choose SRX and need to join sites, our SRX site to site VPN guide walks through a route-based IKEv2 build. More SRX material lives in the Security and Firewalls hub.
Juniper, Junos, MX, SRX, EX and QFX are trademarks of Juniper Networks, Inc. FortiGate is a trademark of Fortinet, Inc. PAN-OS and App-ID are trademarks of Palo Alto Networks, Inc. juniperclient.com is independent and unaffiliated.
Frequently Asked Questions
Juniper SRX vs FortiGate: which is better?
Neither is better in general. FortiGate usually wins on bundled features and ease of use for small teams, while SRX wins on routing depth and the Junos commit model. Pick the one your staff can operate safely during an outage.
Do you see Juniper SRX becoming competitive with Palo Alto and Fortinet?
At the branch, SRX already competes where routing and Junos consistency matter. As the main perimeter firewall for security-first buyers, Palo Alto and Fortinet remain more common in our experience. The HPE integration roadmap is the variable to watch.
What is a good multi-site firewall that is not Palo Alto?
FortiGate and SRX are both common answers. FortiGate suits teams that want SD-WAN, switching and wireless in one console, and SRX suits teams that want Junos everywhere with Mist or Security Director Cloud on top. Size each site on the inspected throughput figure, not the headline.
What is the real SRX branch throughput with security turned on?
Use the next-generation firewall row of the datasheet. Juniper publishes 430 Mbps for the SRX345 and 2,500 Mbps for the SRX380 with firewall, application security and IPS enabled. Confirm it on your own traffic during a trial with show security flow session summary and interface counters.
How do I check which security licenses an SRX has?
Run show system license in operational mode. It lists installed licenses, the features they enable and their expiry dates. Check it before and after every subscription renewal.
Discussion (0)