Updated September 2026 · Pricing from published UK/US reseller listings, checked 17 September 2026 — all figures ex VAT and indicative; vendor pricing moves, so treat these as dated ballparks.
The sticker price is the small number
Most business firewalls are sold like printers: the box is only the beginning. SonicWall, WatchGuard and FortiGate appliances need an annual security subscription — SonicWall's Protection Service Suites, WatchGuard's Total Security Suite, Fortinet's FortiGuard bundles — to do the job you bought them for. Typical UK renewal pricing for a small-business model is £500–£600 every year, and when the subscription lapses, the intrusion prevention, content filtering and malware protection stop. The box keeps passing traffic; the security switches off.
Netgate appliances work the other way round: pfSense® Plus is included for the life of the device — IDS/IPS, content and threat-feed blocking, unlimited VPN with no per-user fees, and software updates. Support (Netgate TAC, or our UK managed service) is there if you want it, and genuinely optional if you don't. That single difference rewrites the three-year maths.
Feature & licensing comparison
Netgate + pfSense+
SonicWall TZ
WatchGuard Firebox T
FortiGate F/G
Mandatory annual subscription
None — ever
Protection Service Suite, ~£540–£570/yr
Total Security Suite, ~£595/yr
FortiGuard UTP bundle, typically £450–£600/yr
If you stop paying
Everything keeps working
Security services stop
Security services stop
Security services stop
Intrusion detection / prevention
Included (Suricata / Snort)
Subscription
Subscription
Subscription
Content & threat-feed blocking
Included (pfBlockerNG)
Subscription
Subscription
Subscription
VPN (site-to-site & remote)
Included — IPsec, OpenVPN, WireGuard, no per-user fees
Included; SSL-VPN user licences extra
Included
Included
Software updates
Included for the life of the device
Requires active support
Requires active support
Requires active FortiCare
Per-user licensing
Never
Some features per-user
No
Some features per-user
Cloud fleet management
Basic (Netgate Nexus, optional)
Strong (NSM/Cloud)
Strong (WatchGuard Cloud)
Strong (FortiManager)
Vendor-certified UTM stack
Open-source engines, curated by Netgate
Yes
Yes
Yes
Support
Netgate TAC optional · our UK managed service from £49/mo
Via subscription
Via subscription
Via FortiCare
Being fair: the three commercial vendors earn their keep in large distributed fleets — single-console cloud management and one-vendor SLAs are real strengths at scale. For a typical UK SME with one to a handful of sites, they're expensive strengths.
Worked example: 3-year cost, typical 20-person UK business
Netgate 4200 MAX
SonicWall TZ-series
WatchGuard Firebox T
FortiGate 50G
Hardware + year 1
£675 (4200 MAX, nothing else to buy)
≈ £981 (TZ380 TotalSecure bundle)
≈ £940 (Firebox + 1-yr TSS)
≈ £915 (50G + 1-yr UTP, US street)
Year 2 subscription
£0
≈ £540–£570
≈ £595
≈ £450–£600
Year 3 subscription
£0
≈ £540–£570
≈ £595
≈ £450–£600
3-year total (ex VAT)
≈ £675
≈ £2,060–£2,120
≈ £2,130
≈ £1,850–£2,100
Year 4 onwards, per year
£0
≈ £540–£570
≈ £595
≈ £450–£600
Sources: published reseller listings for SonicWall TZ380 TotalSecure / TZ-series Protection Service Suite, WatchGuard Firebox T25 Total Security Suite, and FortiGate-50G UTP bundles, checked 17 September 2026. Competitor hardware pricing is also rising with 2026 component costs — the gap moves, the shape doesn't. Optional extras on our side: professional setup from £149 (one-off), managed firewall care from £49/month — both your choice, never a condition of the firewall working.
Year four, and every year after
The three-year table understates it, because subscriptions never finish. By year five, a subscription firewall has typically cost £3,000–£3,500 against the Netgate's original £675 — and when the commercial vendor declares your model end-of-life, the renewal quote usually arrives alongside a hardware "trade-up" quote. With Netgate, year four costs what year two cost: nothing you didn't choose.
What about DrayTek?
DrayTek deserves a different answer, because the Vigor is the honest budget option: no mandatory subscription, dependable routing, and for a small office with simple needs it's fine — that's why it's everywhere in the UK. The comparison with DrayTek isn't money, it's capability: a Vigor has no real intrusion prevention, thin logging, and it struggles to honestly tick the boxes on Cyber Essentials and cyber-insurance questionnaires. If that's the conversation you're having, our replacing-a-DrayTek guide covers it properly — including keeping the Vigor as a bridge-mode modem.
Sick of replacing your firewall? Think cloud. ☁️
If your workloads live in AWS or Azure, pfSense® Plus runs there as a virtual firewall — no hardware to buy, ship, or replace, and completely immune to the component-cost increases pushing hardware prices up across the industry. Your office edge still wants a box; your cloud estate doesn't have to.
Why do SonicWall, WatchGuard and FortiGate firewalls need an annual subscription?+
Their security features — intrusion prevention, content filtering, anti-malware, application control — are licensed as an annual service. The hardware works without it, but most of the security you bought it for stops when the subscription lapses. Typical UK renewal pricing is £500–£600 per year for a small-business model, every year, for the life of the device.
Does a Netgate pfSense+ firewall have any mandatory annual costs?+
No. pfSense+ software is included with every Netgate appliance for the life of the device — including firewalling, IDS/IPS, content blocking, VPN with no per-user fees, and software updates. Netgate TAC support plans are available but optional. If you never pay Netgate another penny, your firewall keeps doing everything it did on day one.
What does a firewall cost a UK small business over three years?+
Using published reseller pricing (September 2026): a Netgate 4200 MAX is £675 ex VAT with no mandatory subscription — about £675 over three years. A comparable SonicWall TZ-series runs roughly £980 for hardware plus year one, then £540–£570 per year after — around £2,100 over three years. WatchGuard and FortiGate equivalents land in the same £1,900–£2,200 range.
Are there things SonicWall, WatchGuard or FortiGate do better than pfSense?+
Yes, and it's fair to say so: managing large fleets from a single vendor cloud console, vendor-certified UTM stacks, and single-vendor support SLAs are genuine strengths, particularly for large distributed enterprises. For most UK SMEs those benefits rarely justify £500+ per year per site — and our optional UK-based managed service covers the support gap for a fraction of it.
Can I avoid buying firewall hardware altogether?+
If your workloads live in AWS or Azure, yes — pfSense+ runs as a virtual firewall in the cloud, with no hardware to buy, ship or replace, and no exposure to hardware price increases. An office still needs an edge device, but cloud infrastructure can be protected entirely without one. Ask us about cloud deployment options.
Where do these competitor prices come from?+
Published UK and US reseller listings for current SonicWall TZ, WatchGuard Firebox T and FortiGate bundles and renewals, checked on 17 September 2026. Vendor pricing moves constantly — including hardware increases driven by 2026 component costs — so treat every figure as a dated ballpark and check current pricing before deciding. We re-check and update this page regularly.