Fortinet Secure SD-WAN, Cisco Catalyst SD-WAN, and Palo Alto Prisma SD-WAN are the three platforms 90% of UK multi-site SD-WAN refresh decisions consider. All three deliver SD-WAN + integrated security. The differentiators are commercial model (Fortinet bundles security free; Cisco + Palo Alto charge separately), management plane sophistication, and which platform your security team already operates.
The short answer
Fortinet Secure SD-WAN = best value for UK mid-market. SD-WAN built into FortiGate (no separate licence), FortiGate range covers branch through data centre, deepest UK skills market.
Cisco Catalyst SD-WAN (formerly Viptela) = right for existing Cisco-shop customers. Same vManage + Catalyst SD-WAN Manager console as the rest of the Cisco stack. Migration from Viptela is a defined practice.
Palo Alto Prisma SD-WAN (formerly CloudGenix) = best for organisations adopting Prisma Access SASE in parallel. ION appliances + Prisma Access cloud edge under one console.
Where Fortinet wins
SD-WAN is built into FortiOS — no separate licence. For a 50-site UK retail or manufacturing org, this is a £30-80k/year saving over a separate SD-WAN platform.
Single appliance for branch — FortiGate 60F, 100F, 200F handle firewall + IPS + SSL inspection + SD-WAN + ZTNA + LAN switching + Wi-Fi controller in one box. Single SLA, single TAC, single firmware track.
NSE-certified engineers in the UK are now common. Easier to hire, easier to outsource.
See our NGFW buyer's guide for the broader Fortinet position.
Where Cisco Catalyst SD-WAN wins
Existing Cisco estate alignment. If your switches are Catalyst, your APs are Meraki, your firewalls are Cisco Firepower or Catalyst NGFW, your AAA is ISE — Catalyst SD-WAN keeps the relationship single-vendor.
Catalyst 8000 edge platform — Cisco Catalyst 8200 (branch) through 8300 (mid-tier) — is the SD-WAN platform Cisco is investing in long-term.
Cisco TAC + Cisco Validated Designs. For risk-averse industries (banking, public sector) Cisco TAC + reference designs are still the standard.
See our migration playbook for moving from Viptela.
Where Palo Alto Prisma SD-WAN wins
Prisma Access SASE integration. If you're adopting Palo Alto Prisma Access SASE, Prisma SD-WAN gives you SD-WAN + SASE under one Strata Cloud Manager console. The integration is seamless.
Application Performance Insights (APP-ID-aware SD-WAN). The same App-ID engine from PAN-OS NGFW informs SD-WAN routing — you route Salesforce traffic differently from generic SaaS because the platform actually identifies it.
ION (Instant-On Network) appliances — ION 1200 through 3200/4200/9200 — for branch through hub.
Comparison at the branch tier (typical 100-user UK office)
Fortinet: FortiGate 100F + UTM bundle + FortiCare — typically £3-5k hardware + £1.5-3k/year subscription including SD-WAN.
Cisco: Catalyst 8200 + Catalyst SD-WAN subscription + DNA Essentials/Advantage + Smart Net — typically £4-7k hardware + £2-4k/year subscription.
Palo Alto: ION 1200 + Prisma SD-WAN subscription + Prisma Access SASE (often bundled) — typically £5-9k hardware-equivalent + £3-5k/year subscription.