Directory › Guides › Fortinet Secure SD-WAN vs. HPE EdgeConnect

Fortinet Secure SD-WAN vs. HPE Aruba EdgeConnect (2026): An SD-WAN Comparison for IT Leaders

Last reviewed: October 21, 2026 · Published October 21, 2026 · By RackGuide

If you're replacing MPLS or a pile of aging branch routers, the SD-WAN shortlist often comes down to two very different designs: Fortinet Secure SD-WAN, which is a feature of the FortiGate firewall, and HPE Aruba Networking EdgeConnect (formerly Silver Peak), which is a WAN-first platform with its own orchestrator and an optional WAN optimization pack. Both can run a branch on broadband. The right pick depends on whether your branch edge is really a security decision or a WAN-performance decision.

This comparison is written by someone who has run SD-WAN on both platforms in production. Every product fact below links to the vendor's own documentation, and nothing here is a pricing quote: both vendors sell through partners, so get current numbers from your reseller.

The short answer

• Pick Fortinet Secure SD-WAN when you want one box per branch that is your firewall and your SD-WAN, managed alongside the rest of your FortiGate estate, and you'd rather not license by bandwidth.
• Pick HPE EdgeConnect when WAN performance is the priority: you have latency-sensitive or replication traffic between sites, long-distance links, or lossy broadband, and you want path conditioning and optional WAN optimization built into the edge.
• Either works for the common case of replacing MPLS with dual broadband plus LTE at a set of mid-size branches. In that case, your existing firewall standard and your team's skills usually decide it.

Side-by-side comparison

How Fortinet Secure SD-WAN works

Fortinet describes Secure SD-WAN as networking and security converged on one operating system, FortiOS, managed with one console. In practice, SD-WAN is a configuration area on a FortiGate rather than a separate product. If you already standardize on FortiGate firewalls, your branches get SD-WAN on the same hardware you'd deploy anyway.

The configuration has three parts, as laid out in Fortinet's SD-WAN architecture guide:

1. SD-WAN members and zones. Almost any interface can join: physical ports, VLANs, LAGs, IPsec or GRE tunnels, and FortiExtender interfaces.
2. Performance SLAs. Health-check probes (Ping, HTTP, TCP/UDP echo, TWAMP, or DNS) measure latency, jitter, and packet loss on each path. Per Fortinet's performance SLA documentation, a link that fails all of its health checks has its routes pulled from the SD-WAN group until it recovers.
3. SD-WAN rules. These match traffic by address, application, internet service, user, or DSCP, then pick a path with one of four strategies: Best Quality, Lowest Cost (SLA), Maximize Bandwidth (SLA), or Manual.

The rules are evaluated top-down, like firewall policies. Fortinet's framing is useful when you design them: firewall policies decide how traffic is secured, and SD-WAN rules decide which path it takes. Because both use the same application and internet-service databases, you can steer and secure traffic using the same objects.

For fleets, FortiManager pushes SD-WAN templates and rules to many FortiGates at once. Plan for it from the start if you have more than a handful of sites; managing SD-WAN box by box gets messy fast.

How HPE EdgeConnect works

EdgeConnect came from Silver Peak, which HPE finished acquiring on September 21, 2020, and is now sold as HPE Networking EdgeConnect. HPE positions it as a secure WAN edge that combines SD-WAN, firewall, routing, and WAN optimization, and as the base for its SASE architecture.

HPE's EdgeConnect Validated Solution Guide describes the core pieces:

• Orchestrator is the central policy, monitoring, and reporting console. It can run as HPE-hosted SaaS, in your own cloud, or as an on-premises VM, and HPE's guide recommends the SaaS option.
• Business Intent Overlays let you create a separate overlay per group of applications, such as voice, critical business apps, and guest internet. Each overlay has its own link-bonding policy, which transports it may use, its QoS class, firewall zone, topology (full mesh, hub-and-spoke, or regional hub-and-spoke), and whether WAN optimization is on.
• Path conditioning adds forward error correction, which rebuilds lost packets without TCP retransmission, and packet order correction, which reorders packets that arrive out of sequence when traffic is spread across providers.
• First-Packet iQ classifies applications on the first packet so a flow lands on the right overlay or internet breakout immediately.
• WAN Optimization (formerly called Boost) is an optional pack in the same software image. It adds TCP acceleration and data reduction through compression and deduplication, and you turn it on per overlay.

The WAN optimization piece is the real differentiator. If you replicate backups or VM snapshots between sites, or have users opening large files over long-distance links, it can matter more than any steering feature.

Licensing models

This is where the two differ most, so read the vendor terms before you build a cost model.

• Fortinet: Fortinet's Secure SD-WAN page says the product has no bandwidth licensing, data transfer charges, or services tiering. Your costs follow the FortiGate hardware, FortiGuard security bundles, support, and FortiManager.
• HPE EdgeConnect: HPE's EdgeConnect SD-WAN QuickSpecs describe a software subscription in two tiers, Foundation and Advanced, in 1, 3, 5, or 7-year terms and multiple bandwidth tiers, with a cloud-hosted Orchestrator included. Every appliance in a fabric must run the same tier. The Foundation tier supports hub-and-spoke topologies with a limited number of VRFs; the Advanced tier supports any topology and up to 64 VRFs. Threat defense (IDS/IPS and DDoS protection) and WAN Optimization are optional add-on licenses, and WAN Optimization is sold in 100 Mbps or 10 Gbps blocks.

The practical takeaway: with EdgeConnect, size the bandwidth tier for each site's real WAN capacity and decide early whether you need the Advanced tier, because you can't mix tiers in one fabric. With Fortinet, the FortiGate model and its security bundle drive the cost, so size the firewall for inspection throughput, not just link speed.

Which one fits your environment

Questions to ask in the evaluation

1. What does our traffic actually look like? Pull a few weeks of flow data before choosing: voice and video, SaaS, site-to-site replication, and guest traffic behave very differently.
2. Where does security inspection happen today, and where should it happen after the change: at the branch, in the data center, or in a cloud security service?
3. How will we manage the fleet? Price FortiManager or the right Orchestrator option in from day one.
4. What happens on our worst circuit? Run a proof of concept at your most problematic site, not your best one.
5. How do we cut over? Plan routing interoperability with the existing MPLS and the data center core so you can migrate site by site with a rollback path.
6. What's the voice plan? If you're moving analog lines or SIP trunks onto the new WAN at the same time, test QoS and failover with real calls before go-live.

Comparing the hardware too? See the Network Gear & Wi-Fi and Firewalls & Network Security categories on RackGuide, and the Cisco ASA to FortiGate migration checklist if FortiGate is replacing an older firewall at the same time.