It looks like a question of price. In fact it's a question of operating model: who manages the device, how often, and what happens when that person is on holiday.
Two different philosophies
Mikrotik gives you a complete network operating system, RouterOS, on cheap hardware. It does almost anything — routing, firewall, VPN, QoS, hotspot, BGP — but it assumes you know what you're doing. It won't stop you from shooting yourself in the foot with the firewall.
Fortinet gives you a subscription firewall, where the intelligence lives in continuously updated security services: antivirus signatures, web filtering, IPS, application detection. You pay for someone else to keep up with the threats.
That difference explains almost everything that follows.
Comparison
| Aspect | Mikrotik | Fortinet |
|---|---|---|
| Upfront cost | Low. A capable router costs about as much as a good dinner | Significantly higher for equivalent hardware |
| Recurring cost | Practically zero. The RouterOS licence is perpetual | Annual FortiGuard subscription, required for real protection |
| Content filtering, antivirus, IPS | Rudimentary. That's not what it's for | Its strength. Continuously updated |
| Advanced routing | Excellent — BGP, OSPF, MPLS, all of it | Good, but not its centre of gravity |
| Learning curve | Steep. The interface assumes networking knowledge | Gentler. Many things have sensible defaults |
| What happens if you don't touch it for a year | It stays as you left it. Including the vulnerabilities | Signatures update on their own |
| Audit reporting | Has to be built | Included, exportable |
When we choose Mikrotik
When the problem is the network, not the threats. You have several sites to connect, VLANs to separate, traffic to prioritise, tunnels to set up. Mikrotik does all of that flawlessly, at a fraction of the price.
It also works very well when there is someone — in-house or external — who actually manages the device. A well-configured, up-to-date Mikrotik is a serious piece of equipment. One forgotten in a cupboard for three years is a problem waiting to happen.
Mikrotik has had vulnerabilities exploited at scale, in campaigns that enrolled tens of thousands of routers into botnets. Not because the product is weak, but because so many are left unpatched for years. If you choose Mikrotik, updating isn't optional — it's part of the cost.
When we choose Fortinet
When you have users who open attachments. It sounds simple, but that's the real dividing line.
An accounting firm with fifteen people receiving invoices by email every day has a completely different risk profile from a warehouse with three computers. In the first case, content filtering and traffic inspection genuinely save the day. In the second, you're paying for something that never triggers.
The second reason is more mundane: reporting. If you need to show someone — an auditor, a large client, an insurer — what traffic came in and what was blocked, Fortinet gives you that from the interface. With Mikrotik, you build it yourself.
The cost you don't see in the quote
The price gap between the two closes faster than it seems, if you count properly.
A Mikrotik needs hours of initial configuration and hours of yearly maintenance. If you pay an external provider for them, add the real cost. If someone in-house does it, it still costs — it just doesn't show up on an invoice.
A Fortinet needs a subscription but fewer hours. And, importantly, it transfers part of the risk: when a new threat appears, the signature arrives automatically. With Mikrotik, you are the update mechanism.
The rule we go by: under ten users and no sensitive data, a well-managed Mikrotik is enough. Over fifteen users, or with client data at stake, a subscription firewall pays for itself at the first incident avoided.
The combination that often works
You don't have to pick just one. An architecture we implement frequently:
- Fortinet at the network edge — where internet traffic comes in and where inspection matters.
- Mikrotik inside — for inter-VLAN routing, site-to-site links, segmentation.
You pay a subscription for a single device, where it actually adds value, and use Mikrotik for what it does best. It's often cheaper than putting Fortinet everywhere and much safer than putting Mikrotik everywhere.
What we ask before recommending
- How many people use the network and what do they do on it?
- Is there client data that would trigger a breach notification to the data protection authority if it leaked?
- Who looks after the device after installation — and how often?
- Do you need to show someone what happened on the network?
- How many locations need to be connected?
The answers to these decide more than any spec sheet.
Need a second opinion on your infrastructure? We look at your actual situation and tell you what makes sense — including when the answer is "don't change anything right now".
Book a call arrow_forward