What BT Managed SD-WAN services can you buy on Fortinet and Cisco Meraki?
You can buy BT Managed Meraki SD-WAN or BT Managed Fortinet SD-WAN. Both are sold as an Associated Service under BT's Managed Service Schedule. Each is a remotely managed, cloud-hosted overlay network, with BT providing the standard components and any Service Options named in the Order, up to a defined Service Management Boundary.
The platform choice sits inside the BT service design rather than being a standalone appliance purchase. The applicable Order determines exactly what BT installs, manages and bills for, so buyers should confirm the final scope against that document rather than relying on a general product description.
| Field | BT Managed Fortinet SD-WAN | BT Managed Meraki SD-WAN |
|---|---|---|
| Underlying platform | Physical or virtual Fortinet SD-WAN Devices | Cisco Meraki SD-WAN CPE Devices |
| Main buyer fit | Networking and security convergence, regulated workloads and a route towards FortiSASE | Standardised cloud-managed branch rollout with LAN and Wi-Fi in the service model |
| Customer visibility | Customer Portal through the Managed Service Portal | Managed Service Portal with up to five user accounts |
| Branch components | LAN switches and Wi-Fi are Service Options | LAN switches and Wi-Fi are Standard Service Components |
| Formal validation | Licence, security, PMS and FortiSASE location scope | Licence type, exact Order components and current service terms |
What is included with BT Managed Meraki SD-WAN?
BT Managed Meraki SD-WAN is a remotely managed, cloud-hosted overlay network. BT provides the equipment and the cloud-hosted control and reporting infrastructure, but manages the service only up to the Service Management Boundary.
Standard Service Components
- SD-WAN CPE Devices
- BT provides and installs the devices. An Advanced or Enterprise Licence is purchased per device; devices on the same site or network use the same licence type.
- LAN CPE Devices
- LAN switches and Wi-Fi access points, with their own software licences, are installed by BT as Standard Service Components.
- Cloud Hosted Control Infrastructure
- BT uses this to orchestrate delivery, monitor devices and data flows in real time, and identify and troubleshoot issues.
- Cloud Hosted Report Infrastructure
- The Managed Service Portal provides up to five user accounts for application performance, troubleshooting, data-flow visibility and reporting. Portal training is not included.
- Transport Independent VPN
- Creates encrypted corporate VPNs across sites and across internet transport.
- Application Aware Routing
- BT implements pre-agreed business-critical application categories. Category changes are handled as a Simple Service Request.
Service Options
- Mobile Data Access in Backup, Backup Plus, Active-Active or Prime form, with BT Managed or Customer Managed variants and external, internal-hub or SIM-only delivery.
- Virtual MX for AWS or Microsoft Azure, supporting up to 500Mbps. BT does not have access to the buyer’s AWS or Azure instance under this option.
Service management boundary
BT manages between the WAN and LAN ports of each SD-WAN CPE Device and LAN switch, and between the LAN port and Wi-Fi antennae of an access point. Customer SIM cards and Customer Managed Mobile Data Access sit outside the boundary. Service Levels and Service Credits apply to the Enabling Service carrying the overlay, not to the Meraki SD-WAN Service itself.
Who is it a good fit for?
Netify generally considers this route for organisations prioritising a consistent cloud-managed branch design, simpler day-to-day operation and combined WAN, LAN and Wi-Fi scope. Existing Meraki equipment cannot be assumed reusable in the BT managed service. BT's Rexel case study describes a 31-branch and four-logistics-centre deployment that retained MPLS for mission-critical traffic and routed other traffic over internet access. BT reports that the design freed 20% of Rexel's internal MPLS capacity and cut costs. Those outcomes are specific to that estate, not a general guarantee.
What is included with BT Managed Fortinet SD-WAN?
BT Managed Fortinet SD-WAN is a remotely managed network solution built around physical or virtual Fortinet SD-WAN Devices. It uses the same class of cloud-hosted control and reporting model as the Meraki service, with additional security and SASE options.
Standard Service Components
- SD-WAN Devices
- Physical or virtual devices. A Standard or Virtual Licence Subscription is purchased per device. The Security Licence Subscription is included with Standard and optional with Virtual.
- Cloud control and reporting
- BT provides orchestration, monitoring, troubleshooting and portal-based reporting. Access is through the Customer Portal; training is not included.
- Transport Independent VPN
- Creates encrypted corporate VPNs across sites and available transport.
- Application Aware Routing
- BT configures prioritisation for agreed business-critical applications through the Cloud Hosted Control Infrastructure.
Service Options
- LAN switches and Wi-Fi access points are optional rather than standard on this route.
- Mobile Data Access uses the Backup, Backup Plus, Active-Active and Prime model, as BT Managed or Customer Managed.
- Fortinet Security Options enable agreed security functions on the SD-WAN Device. BT does not proactively act on security alerts as standard.
- Protective Monitoring Service is an optional 24/7 service for High and Critical Security Events. It requires the Security Licence Subscription and SSL inspection. Remedial action follows the responsibilities and playbooks agreed with BT.
- FortiSASE requires ordered bandwidth and public-IP licences. Public IP licences are supplied in increments of four. Use is limited to documented SASE Service Locations and in-country points of presence.
- BT may manage an existing customer-provided Fortinet device after inventory, condition, licensing and fitness-for-purpose checks.
Service management boundary
Physical devices are managed between WAN and LAN ports. Virtual devices are managed within the Virtual SD-WAN Device, excluding the underlying virtual infrastructure. LAN switches are managed between their WAN and LAN ports; Wi-Fi is managed between the LAN port and antennae. Customer SIM cards and Enabling Services remain outside the boundary. BT also states that the Fortinet service cannot be guaranteed to detect, intercept or block every malicious threat.
Who is it a good fit for?
Netify generally considers Fortinet for security-focused organisations, IT and OT segmentation, regulated workloads and buyers planning a move towards BT's Fortinet-powered managed SASE service. Selecting Fortinet does not by itself achieve regulatory compliance; the formal BT design must map the ordered controls to the buyer's obligations.
How does BT managed SASE relate to Fortinet and Meraki?
BT's current documented managed SASE expansion is powered by Fortinet, adding cloud-delivered firewall-as-a-service, secure web gateway, CASB and ZTNA capabilities to the managed secure SD-WAN route. BT has not published an equivalent current managed SASE expansion based on Cisco Meraki. Buyers should still confirm the current product position, licence quantities and applicable service locations during formal BT design.
BT Fortinet versus BT Meraki: which should a buyer shortlist?
The useful comparison is not a generic vendor feature contest. It is the fit between the buyer's estate and the components, options, responsibilities and evidence documented for the two BT services.
| Decision factor | BT Managed Fortinet | BT Managed Cisco Meraki |
|---|---|---|
| Existing estate | Fits an existing Fortinet/FortiGate estate. Customer-Provided Device is available subject to BT checks. | Fits Cisco/Meraki operational skills, but no equivalent reuse option for existing Meraki equipment is documented. |
| Security convergence | Security Licence Subscription, Fortinet Security Options and optional Protective Monitoring Service. | No equivalent native 24/7 security-event monitoring option is documented within this service; BT must validate. |
| SASE requirement | Direct documented route through FortiSASE licences and BT’s current managed SASE expansion. | No current documented BT managed SASE route on Meraki; BT must validate before a buyer assumes otherwise. |
| Branch LAN and Wi-Fi | Available as an Order-dependent Service Option. | LAN switches and Wi-Fi access points are Standard Service Components. |
| IT and OT segmentation | Segmentation-relevant security configuration is available; the exact design remains a BT solution-design output. | Not documented at this level of specificity; BT must validate. |
| Operating model | WAN and security convergence may suit teams with Fortinet skills and a preference for fewer separate stacks. | Cloud control and a single portal suit teams prioritising standardisation and operational simplicity. |
| Named BT evidence | No comparable named public BT Fortinet customer case was located in the reviewed material. | Rexel: 31 branches and four logistics centres; BT reports that the design freed 20% of internal MPLS capacity and cut costs. |
What does BT manage and what remains with the customer?
BT manages the overlay, cloud-hosted control and reporting infrastructure and ordered equipment only up to the defined Service Management Boundary. The boundary should be confirmed against the site design and Order.
- BT manages
- Ordered SD-WAN devices, control and reporting infrastructure, orchestration, monitoring and troubleshooting of managed devices, plus BT Managed Mobile Data Access where selected.
- The customer manages
- Site preparation and power, connected customer equipment, customer-managed SIMs, credentials, readiness of the Enabling Service, and backups of customer-provided Fortinet configurations.
- Outside the boundary
- Enabling Service faults not caused by managed equipment, Customer Managed Mobile Data Access performance, underlying virtual infrastructure and anything not included in the Order.
What does Netify do in the buying process?
Netify records the estate requirements, including site count, existing platform investment, security and SASE needs, LAN/Wi-Fi scope and operating-model preference. We use that information to identify the likely BT platform route, coordinate formal design and quotation with BT, and support the commercial process through to contract.
Netify does not produce BT's formal solution design, set BT's prices or replace the applicable BT Order and Managed Service Schedule. The initial assessment is provided without charge or obligation. Netify may earn commission where an eligible service is contracted through the BT partner route.
Buying process
- Estate discovery: sites, footprint, current platforms, security, SASE and operating model.
- Requirements and platform assessment: Netify maps the estate against the documented Fortinet and Meraki routes.
- BT solution design: BT produces the formal design and confirms applicable Service Options.
- Quotation and contract review: BT issues pricing and terms; Netify supports the buyer's review.
- Implementation planning: BT and the buyer agree site readiness, scheduling and Service Start Dates.
What published evidence exists?
BT's published Rexel case study is the named public evidence located for the Meraki route. It describes 31 branches and four logistics centres, a hybrid MPLS and internet design, management-portal visibility, 20% of internal MPLS capacity freed and reduced costs. No comparable named public BT Fortinet customer case study was located in the material reviewed for this page. This evidence gap does not establish relative product performance, but it should be visible to buyers.
What must BT confirm before a buyer proceeds?
Before signing, the formal BT solution design and Order should answer the following questions for the actual estate:
- Exact components and Service Options included in the Order, including device models, LAN/Wi-Fi and Mobile Data Access variant.
- Licence type and quantity: Advanced or Enterprise for Meraki; Standard or Virtual plus Security Licence Subscription for Fortinet.
- Which Enabling Services will carry the overlay, and the SLA terms for each access circuit.
- Resilience design, including high availability, dual links, backup and failover at each site.
- Implementation timeline, Customer Committed Date and site-readiness dependencies.
- Security functions included versus optional, including Protective Monitoring Service.
- Telemetry Data handling and the FortiSASE Service Locations applicable to the estate.
- Portal user limits, reporting content, change control and the scope of a Simple Service Request.
- The Service Management Boundary and all exclusions for the buyer’s site design.
- Minimum Period of Service, Renewal Period, Termination Charges and re-platforming implications.
Sector relevance
Healthcare: assess segmentation, resilience and compliance against the formal solution design; neither platform delivers compliance automatically.
Manufacturing: validate IT/OT segmentation, industrial-site resilience and the precise Fortinet security configuration.
Retail: weigh Meraki's standard LAN/Wi-Fi components and branch-operating simplicity against security, POS and resilience requirements.
Financial services: treat ZTNA, Protective Monitoring and FortiSASE locations as Order-dependent and test them against regulatory and operational-resilience requirements.
Fortinet and Meraki by sector
Healthcare
- Fortinet:
- Stronger on segmentation depth, compliance-led architecture, secure clinical-device protection, and integrated security at every site.
- Meraki:
- Stronger on cloud-managed simplicity across distributed sites, smart facility visibility through cameras and sensors, and leaner IT operations.
- BT managed services:
- Managed rollout, continuous monitoring, service reporting and operational support across multi-site clinical estates.
Retail
- Fortinet:
- Stronger on secure SD-WAN across many branches, integrated PCI-aligned security posture, and governance consistency across the store estate.
- Meraki:
- Stronger on rapid store deployment, cloud-managed visibility, smart cameras and sensors for shrinkage and operations, and simplified retail IT.
- BT managed services:
- Service-led rollout across many stores, incident handling at scale, operational consistency and coordinated change management.
Manufacturing
- Fortinet:
- Stronger on OT security, segmentation between IT and plant networks, automated protection for industrial protocols, and cyber-physical risk reduction.
- Meraki:
- Stronger on cloud-managed oversight of distributed sites, smart site visibility with sensors and cameras, and rapid scaling of remote warehouses.
- BT managed services:
- Monitored operations, managed resilience, SLA-backed accountability for critical connectivity and support across UK and multinational plants.
Financial Services
- Fortinet:
- Stronger on security-led architecture, resilience, deep segmentation for regulated data and integrated networking-security fabric.
- Meraki:
- Stronger on smart branch operations, stable networking, lower operational friction, cameras and sensors for branch safety.
- BT managed services:
- Managed oversight, compliance-aligned reporting, incident handling and service accountability for regulated environments.
Glossary
- BT Managed Fortinet SD-WAN
- BT Business managed SD-WAN service running on Fortinet FortiGate. Security-led, integrated networking and security in one stack, suited to regulated environments and IT/OT convergence. BT delivers the managed service on top of the Fortinet platform.
- BT Managed Meraki SD-WAN
- BT Business managed SD-WAN service running on Cisco Meraki MX. Cloud-managed, fast to deploy, operationally simple. Smart cameras and sensors available across the same dashboard. BT delivers the managed service on top of the Meraki platform.
- BT Managed SASE
- BT Business Secure Access Service Edge offering. The latest documented managed SASE service, announced in November 2024, is powered by Fortinet and combines SD-WAN with cloud-delivered security under a single BT managed service.
- Service model
- The split of operational responsibility between the customer and the managed service provider. Three positions: self-managed (customer owns platform operations), co-managed (shared with BT), fully BT-managed (BT owns platform operations end to end).
- Openreach underlay
- The Openreach physical fibre and copper estate that underpins BT Business Broadband, BTnet and BT SD-WAN circuits. Openreach coordination and circuit lifecycle management are part of the BT managed service overlay.
- ZTNA (Zero Trust Network Access)
- Identity-based network access model where every request is authenticated, authorised and encrypted regardless of network location. ZTNA is named within BT's documented Fortinet-powered managed SASE service.
- IoMT (Internet of Medical Things)
- Connected medical devices that participate on the clinical network. Often cannot host security agents or support frequent patching, so segmentation and policy enforcement are handled at the network layer. Relevant to Healthcare SD-WAN and SASE designs.
- PCI-aligned
- Network and security architecture that meets the Payment Card Industry Data Security Standard for cardholder data environments. Fortinet is commonly chosen on multi-branch retail SD-WAN where PCI scope reduction is a primary driver.
- BT Authorised Partner
- The commercial relationship status BT grants to a named partner. Netify has held BT Authorised Partner status since 2012 and is listed on BT Business's authorised partners page.
- Two working days
- The standard Netify response window for buyers requesting platform-fit, service-model and indicative commercial guidance on BT Managed Fortinet or Cisco Meraki SD-WAN.
Frequently asked questions
Can I buy Fortinet SD-WAN as a managed service from BT?
Yes. BT Managed Fortinet SD-WAN is sold as an Associated Service under BT's Managed Service Schedule, with physical or virtual SD-WAN Devices, cloud-hosted management and reporting and Order-dependent security and FortiSASE options, up to a defined Service Management Boundary.
Can I buy Cisco Meraki SD-WAN as a managed service from BT?
Yes. BT Managed Meraki SD-WAN uses the same managed-service structure, with SD-WAN CPE Devices, LAN switches and Wi-Fi access points as Standard Service Components, plus cloud-hosted control and reporting infrastructure.
Does BT manage both the WAN and branch LAN?
On the Meraki route, LAN switches and Wi-Fi access points are Standard Service Components. On Fortinet they are Service Options. The exact equipment and management boundary must be confirmed in the buyer's Order.
Is BT's managed SASE service based on Fortinet or Cisco Meraki?
BT's current documented managed SASE expansion is powered by Fortinet, adding firewall-as-a-service, secure web gateway, CASB and ZTNA. No equivalent current BT managed SASE expansion based on Cisco Meraki was located in the material reviewed for this page.
Can existing Fortinet or Meraki equipment be used?
BT may manage customer-provided Fortinet equipment after inventory, condition, licensing and fitness-for-purpose checks. No equivalent documented option for reusing existing Meraki equipment was located; BT must validate the current position.
Who manages changes, incidents and reporting?
BT orchestrates, monitors and troubleshoots the ordered managed devices through the cloud-hosted control and reporting infrastructure, up to the Service Management Boundary. Category and minor changes can be handled as Simple Service Requests. Security-event response depends on the ordered Fortinet options and playbooks.
Can Netify help me buy the service directly from BT?
Yes. Netify has been a BT Authorised Partner since 2012. We assess the requirement, identify the likely route and coordinate formal design and quotation with BT. BT produces the formal design, Order and contract.
Does Netify charge the buyer for its initial assessment?
No. The initial Netify assessment is provided without charge or obligation. Netify may earn commission if an eligible service is contracted through the BT partner route.
What information is needed before BT can design and quote?
Site count and locations, existing Fortinet or Meraki investment, LAN and Wi-Fi scope, mobile-access requirements, underlay and resilience, security and SASE requirements, preferred operating model, timeline and contractual constraints.