Firewall Alternative to Fortinet, Cisco and Palo Alto
Firewall, VPN, intrusion detection and high availability with OPNsense, on appliances or standard hardware.
Fortinet, Cisco, Palo Alto Networks, SonicWall and WatchGuard are US vendors. Many of their firewalls require annual subscriptions for updates and intrusion detection.
OPNsense from the Netherlands is an open source firewall with VPN, intrusion detection and high availability. It runs on the vendor’s appliances, on standard hardware or virtualized.
BARNICOM plans the switch, transfers rules and VPNs and manages the firewalls in day-to-day operation.
Why companies look for alternatives
Subscriptions for core features
Many vendors tie updates, intrusion detection and support to annual subscriptions. When the subscription lapses, important features are missing.
Closed systems
With proprietary firewalls you cannot see how the software works. Vulnerabilities can only be fixed by the vendor.
Cloud management
Central management often runs through the vendor’s cloud. Configurations and logs then sit outside the company.
What replaces what
Typical functions of US firewalls and their counterparts in OPNsense. Which setup fits is something we work out together.
| Area | Fortinet | Cisco | European alternatives |
|---|---|---|---|
| Firewall and routing | FortiGate | Firepower, Meraki MX | OPNsenseNetherlands |
| Site-to-site and remote VPN | FortiClient VPN | AnyConnect | WireGuard, IPsec and OpenVPN in OPNsenseNetherlands |
| Intrusion detection | FortiGuard IPS | Snort, Talos | Suricata in OPNsenseOpen source |
| High availability | FortiGate HA | HA cluster | OPNsense with CARP failoverNetherlands |
| Hardware | FortiGate appliances | Cisco appliances | Deciso appliances or standard hardwareNetherlands |
Origin refers to the vendor’s headquarters. OPNsense is open source, the Business Edition and vendor support contracts are optional.
How the switch works
-
Assessment
Which rules, VPNs, sites and add-on features are in use? The result is a plan with effort and timeline.
-
Concept
Rules, VPN connections and network segments are migrated and cleaned up along the way.
-
Cutover
The new firewall goes live in a maintenance window, with the old one kept ready as a fallback.
-
Operations
We take care of updates, monitoring, backup and support, with a service level agreement on request.
When the alternative is not a fit
Switching does not make sense in every case. We point out limitations beforehand, for example with:
- large SD-WAN environments with dozens of sites and a central vendor portal
- requirements that mandate a specific product certification
- running contracts with a long remaining term
Frequently asked questions
What is OPNsense?
OPNsense is an open source firewall by Deciso B.V. in the Netherlands. It offers firewall, routing, VPN, intrusion detection and high availability through a web interface.
Is an open source firewall secure?
The source code is open to review and security updates are released regularly. What matters is clean configuration and well-maintained operation, which we take care of.
Can we migrate our rules?
Yes. Rules, objects and VPN connections are transferred. Outdated entries usually come to light, and we clean them up with you.
Is there hardware for it?
Yes. Deciso offers its own appliances, but OPNsense also runs on standard hardware or as a virtual machine.
What does the switch cost?
It depends on the number of sites, the hardware and the availability required. You receive a proposal after the assessment.
From our projects
More alternatives for infrastructure
Review your firewall
We review your networks and rules and tell you whether and when switching pays off.