Palo Alto Networks, Fortinet, and Check Point topped Gartner's latest Magic Quadrant for Network Firewalls report this month. The three vendors were classified as leaders in the market.

Rather than rank vendors on market share or revenues, Gartner's Magic Quadrant aims to provide something akin to a report card on the industry. Vendors are placed into one of four categories — niche players, visionaries, challengers, and leaders — based on the completeness of their vision and their ability to meet enterprise demands.

Gartner's latest report evaluated 17 security vendors on the merits of their hardware, software, or firewall-as-a-service offerings.

Leading the Pack

In the report, Palo Alto received praise for the breadth of its product offering — which spans hardware, virtual appliances, and cloud-based firewalls — the granularity of its application-based policy enforcement, and the company's strong focus on cloud security. Gartner also called out the acquisition of SD-WAN vendor CloudGenix, which Palo Alto bought this spring for $420 million.

"Palo Alto Networks' firewall is a good shortlist candidate for clients looking for a firewall with premium subscriptions at a premium price," the report's authors wrote.

However, premium pricing proved to be a sticking point for many Gartner clients who expressed concerns with the company's high subscription renewal costs. Gartner also called out the lack of a cloud-based management console and possible issues with the company's Prisma Access secure access service edge (SASE) product.

"Clients have reported scalability issues with large Prisma Access deployments beyond 60,000 users," the authors wrote.

Competitive pricing, centralized management, and strong integration with the company's SD-WAN product offering kept Fortinet in the leader's group. Gartner also noted the addition of SASE cloud provider Opaq, which Fortinet acquired this summer for an undisclosed sum, highlighted support for Kubernetes, and the launch of the company's NP7 security ASIC.

While Fortinet scored favorably in Gartner's evaluation, analysts called out the lack of automation features and cloud-based firewalls, as well as frequent updates to the management interface, which can cause problems for day-to-day management.

Check Point Security also received high marks for its cloud-security offerings and centralized management, which launched in April.

"Smart-1 Cloud offers feature parity with the Smart-1 on-premises console," analysts wrote. "Check Point Smart-1's console appeals especially to managed security service provider customers and prospects and distributed enterprises."

However, the report found Check Point lagged behind competitors in its ability to sell enterprise-level agreements to large customers. And like Palo Alto, Gartner reported a "sizable amount of reports regarding dissatisfaction with pricing."

Analysts also warned that Check Point's decision to partner with SD-WAN vendors rather than purchase or develop an in-house SD-WAN puts the company at a disadvantage compared to other vendors moving into the SASE space.

Huawei, Juniper, Cisco Challenge the Market

Huawei, Juniper Networks, and Cisco were ranked challengers in this year's report. “Challengers” in Garter’s report have demonstrated the ability to execute on customer needs and have long-term viability in the market, but haven’t proven their ability to drive innovation.

While Gartner praised Cisco's diverse product portfolio, Talos threat research, and robust VPN capabilities, analysts warned that Cisco's product lines are lead by different teams and often require different management consoles leading to confusion.

Likewise, Juniper was praised for its support for public cloud providers and Junos Space Security policy orchestrator but called out for its network-centric focus and poor application visibility.

Finally, Huawei received props for its cloud-access security broker (CASB)-like functionality and competitive pricing. However, Gartner warned customers that Huawei lacked a cloud-based firewall capability and support for security and networking partners.

Forcepoint, Sophos Push Cloud Native, SASE

Rounding out the visionary quadrant were Forcepoint and Sophos. Both companies were praised by Gartner for their innovative product offerings.

"Forcepoint firewalls are good shortlist candidates for distributed office use cases where clients are looking for mature SD-WAN, VPN, centralized management capabilities and [firewall as a service]," analysts wrote.

However, analysts criticized Forcepoint's branch-heavy approach, which resulted in lackluster performance and features in the data center and lack of endpoint protection capabilities.

Meanwhile, Gartner highlighted Sophos' strong extended detection and response (XDR) capabilities, performance, and cloud-native policy controls, but called out the lack of cloud-based firewalls and support for public cloud.

A Crowded Niche

The remaining nine vendors — Hillstone Networks, WatchGuard, Sangfor, Barracuda, SonicWall, H3C, Venustech, Stormshield, and Microsoft — were ranked niche players.

Gartner defines niche players as having a near-complete product offering but have not shown the ability to transform the market or maintained sustained execution.