What would you replace Fortinet firewalls with?

Take a look at Sophos XGS, or pfSense on Netgate hardware if you're comfortable managing that style of firewall. Both are worth evaluating against the actual site requirements rather than buying purely on appliance price.

For either option, check the exact VPN client, MFA method, and Active Directory integration you plan to use before committing. A small pilot with a few Windows users should reveal whether the login and support experience is workable.

Don't rule out replacing the unsupported boxes with newer Fortinet hardware. The recurring cost isn't just a reseller contract. Depending on the package, it can cover security updates, threat intelligence, and a support escalation path when something breaks.

Compare the full cost and support terms with the alternatives. If the frustration is with the current provider's contract, changing the provider and keeping the platform may also be worth investigating.

UniFi wireless doesn't have to determine the firewall choice. You can use its access points and keep a separate firewall that meets the VPN and security requirements.

Opinions on UniFi gateways vary. Some people find them sufficient even in sizable networks, while others prefer a dedicated firewall platform for broader security features and support. Compare the specific features you need rather than assuming either that UniFi is inadequate or that it will match Fortinet feature for feature.

I'd revisit the VPN design before picking the box. SSL VPN isn't the only way to give Windows users remote access. Look at IKEv2 and the built-in Windows VPN client, as well as options such as Tailscale if an always-on style of access fits the workflow.

Make MFA a requirement, not just a nice-to-have. Also test how authentication ties into Active Directory, what users need to install, and how access is removed when someone leaves. Don't assume every product supports the same combination out of the box.

Palo Alto is another option if the budget supports it. Meraki also comes up, though opinions on it differ and its cost is worth checking carefully. Get quotes for the hardware and ongoing services, then compare them with the VPN and support requirements.