Arista SD-Branch Part 11: Arista vs Fortinet, Cisco and Juniper for the Branch
This series has been about one vendor’s branch stack. To close it, here is how that stack compares to the other three I have covered on this site. It is a comparison of architecture and product shape from public documentation, not a test result, and I have not run any of these side by side.
The comparison
| Arista | Fortinet | Cisco | Juniper | |
|---|---|---|---|---|
| Switching | 710P and other EOS switches | FortiSwitch | Catalyst | EX |
| Wireless | Wi-Fi 7 APs under CV-CUE | FortiAP | Catalyst and Meraki APs | Mist APs |
| Management | CloudVision (CVaaS or on-prem), CV-CUE | FortiGate via FortiLink, FortiManager | Catalyst Center, Meraki | Mist cloud |
| Network access control | AGNI | FortiNAC | ISE | Mist Access Assurance |
| Switch to NAC transport | RadSec | RADIUS | RADIUS, with RadSec support | RADIUS |
| Control point | CloudVision and AGNI | The FortiGate | Catalyst Center and ISE | The Mist cloud |
The last row is the useful one. Each vendor puts the brain somewhere different, and that shapes everything else.
Where the Arista approach is different
Switches stand alone. A FortiSwitch is managed through the FortiGate over FortiLink, as I covered in pairing a FortiGate and FortiSwitch. An Arista switch runs full EOS and CloudVision is a management layer on top, not a requirement for the switch to function. That is better for a branch where the firewall is someone else’s product.
Policy is separate from the firewall. In the Fortinet design the FortiGate is both the firewall and the controller for the access layer. With Arista, access policy lives in AGNI and firewalling stays wherever you already have it. That is more moving parts, and more flexibility.
Studios and change control. CloudVision’s workspace, review and change control flow is closer to a code review than to a settings page. Teams used to a template-push model, such as FortiManager, will recognise the intent and find the review step stricter.
NAC is cloud-native. AGNI is a cloud service priced by concurrent devices. ISE and FortiNAC are typically deployed as appliances or virtual machines you run yourself, and Mist Access Assurance is also cloud delivered. If a branch has no place to put a NAC server, a cloud service removes that problem and adds an internet dependency for authentication.
Honest limits
- AGNI is newer. Cisco ISE and FortiNAC have long deployment histories and wider third-party integration. AGNI covers the main authentication methods and integrations, but I am relying on the datasheet and not on years of field use.
- Some documentation is gated. Arista’s community knowledge base articles on RadSec and wired EAP-TLS need a login, which made parts of this series harder to source. Public EOS configuration references for newer features are thinner than for the data centre line.
- The cloud dependency is real. RadSec to a cloud NAC means a WAN outage affects new authentications. Plan for local fallback behaviour and test it.
- Everything here is documented, not run. Check the config in Parts 7 and 8 against your EOS release.
A design checklist
- Decide where management-plane authentication lives, and keep it separate from port access.
- Size PoE against port ceilings, not average draw (Part 2).
- Onboard with tokens or ZTP, and record which RADIUS and TACACS+ accounts must exist first (Part 3).
- Express port behaviour in port profiles and change control, not per-switch CLI (Part 4).
- Give every switch and AP a RadSec certificate, and track expiry (Parts 7 and 9).
- Limit MAC fallback to registered clients and use profiling (Part 8).
- Use UPSK for devices that cannot do 802.1X, and a real guest VLAN or tunnel for guests (Part 9).
- Test upgrades on one branch before the fleet (Part 10).
Where this leaves Arista’s NAC story
In Five Minutes and an Empty Port Part 10 I said Arista’s NAC story was the least mature of the four. AGNI changes that picture. It gives Arista a purpose-built NAC with a built-in PKI, device profiling and guest access, and the RadSec design is stronger by default than most RADIUS deployments. What it has not yet is the long track record of ISE or FortiNAC. For a branch that wants one vendor for switching, wireless and access control, it is now a credible option, and worth a proof of concept.