Network & SASENote
5 of 7 firewalls already include SD-WAN; the real purchase is a second line
TechBag’s count of where SD-WAN sits across 13 firewall and 20 SASE products, Gartner’s 2028 forecast, and the Indian price, RBI and CERT-In hooks, as of September 2026.
Five of the seven next-generation firewalls in TechBag’s firewall guide run SD-WAN inside the same product, and one of them, Fortinet, documents it at no separate licence.1 That is the answer to the question this piece asked in 2021. SD-WAN is important to a business in the way a second broadband line is important: not as a product you go shopping for, but as a feature you very probably own already and have not switched on. The purchase, if there is one, is the second circuit and the hours to configure the steering policy, and the saving is the MPLS port.
01Where SD-WAN went: into the firewall and into the bundle
TechBag’s firewall and network security guide compares 13 products by SKU, verified against vendor documentation on 22 August 2026.1 Seven of them are next-generation firewalls. In five, SD-WAN is a function of the same product: FortiGate (built into FortiOS, no separate SD-WAN licence), Palo Alto’s PA-Series, Sophos Firewall, Barracuda SecureEdge and Versa’s NGFW. In the other two it is a separate product from the same vendor: Check Point sells Quantum SD-WAN as a software blade subscription on Quantum gateways, and Cisco sells SD-WAN apart from Secure Firewall.1 The other half of the story is the SASE guide, where 6 of 20 products include the network half and 14 are security-only; the guide’s warning to a buyer who needs only the security half is “You will be quoted SASE.”2
SD-WAN is a line on a licence you probably hold: five of seven firewalls carry it, and Gartner expects seven in ten purchases to arrive inside SASE by 2028
TechBag counts from its firewall and SASE guides (vendor documentation, August 2026) and Gartner's 2025 forecast
71.4%
Next-generation firewalls with SD-WAN inside the same product
5 of 7; Check Point and Cisco sell it separately
30%
SASE-guide products that include the network half
6 of 20; 14 are SSE-only
70%
SD-WAN purchases Gartner expects inside single-vendor SASE by 2028
From 25% in 2025
Source: TechBag firewall & network security guide (13 products) and SASE & SSE guide (20 products); Gartner, Magic Quadrant for SASE Platforms 2025, as quoted by Softprom · as of 30 September 2026 · Integrated means the same product, not necessarily the same price: Fortinet documents no separate SD-WAN licence; check the quote for the rest
02What is left to buy, and what it saves
Gartner’s forecast, in its 2025 Magic Quadrant for SASE Platforms, is that 70% of SD-WAN purchases will be part of a single-vendor SASE offering by 2028, up from 25% in 2025.3 Read as a buyer, that means the standalone SD-WAN appliance is a shrinking category and the decision has moved: either you switch on the SD-WAN in the firewall you renew every year, or you buy it inside a SASE contract priced per user. The second is the right answer only when the security half is also being replaced, which is the overspend the SASE guide warns about.2 What the feature saves is the circuit. In the worked example in the companion piece on this blog, a 10 Mbps MPLS port at the carriers’ published rate for exchange members is ₹27,100 a month, against ₹4,400 for two 300 Mbps broadband lines and a FortiGate 40F at the branch, a ratio of about six to one before GST.4
03If you are buying this in India
The hardware is cheap and the circuits are rupee-billed. A FortiGate 40F for a small branch lists at about ₹22,000 plus a Unified Threat Protection subscription of about ₹9,000 a year through Indian resellers, before 18% GST, with SD-WAN in FortiOS at no extra licence.5 The 6 SASE bundles are quoted mostly per user and in US dollars; three carry a list figure in the guide: FortiSASE from US$8, Check Point Harmony SASE from about US$10 and Coro at US$10.50 a user a month.2 For a bank or NBFC the second line is an obligation: RBI’s Master Direction on IT Governance, Risk, Controls and Assurance Practices of 7 November 2023, in force from 1 April 2024, requires BCP and DR capability in critical interconnected systems and networks and DR drills at least half-yearly, and a branch on one MPLS port is a single point of failure by definition.6 CERT-In’s Directions of 28 April 2022 require ICT logs to be kept for 180 days within India, so if the steering and inspection move to a SASE point of presence, ask in writing where those logs go.7 TechBag quotes branch firewalls and SSE seats in INR with GST and will check your current licence tier for SD-WAN before quoting anything new.
Sources
- TechBag, Firewall & network security: how to choose (13 products by SKU; SD-WAN integrated, separate or absent per record) — vendor documentation verified 22 August 2026
- TechBag, SASE and SSE: how to choose, and which half (20 products by SKU; 6 include SD-WAN) — vendor documentation verified 22 August 2026
- Softprom, Cloudflare, Cisco and Fortinet recognised in the 2025 Gartner Magic Quadrant for SASE Platforms (quoting Gartner's 2028 forecast) — 15 August 2025 Gartner's report itself was not read.
- TechBag blog, MPLS costs 6× broadband plus SD-WAN: a 40-branch Indian worked example (₹27,100 against ₹4,400 a branch a month) — December 2025, facts checked September 2026
- Cloudfy Systems, Fortinet FortiGate pricing in India (40F to 100F, UTP bundles, 18% GST) — 11 June 2026
- Reserve Bank of India, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107) — 7 November 2023; in force 1 April 2024
- CERT-In, Directions under section 70B(6) of the IT Act (180-day log retention within India) — 28 April 2022
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
