I’m just suggesting, but as a MSP we generally go Fortigates managed with fortimanager. That is, hundreds of Fortigates managed in customer specific administrative domains.

I use a combination of device manager, policy manager, and vpn manager to automate deployment of the underlay sdwan (ha Internet with priority rules) , then add templated vpn tunnels. So adopting another Fortigate is basically, add it to fortimanager, add the device settings, add the vpn policy, add the firewall policy. You can direct cli to the Fortigates from fortimanager if you need to. This is the only way I can consider getting like hundreds of vpns managed…

Additionally, for compliance and security your may add as required storage and fortianalyzer licensing which means all traffic logs can be stored to your fortimanager.

Fortimanager also manages fortinet switches and aps if there’s a Fortigate on that site. Personally though we often use Aruba InstantON or instead ubiquiti switches and APs for small clients.

I can recommend this since it makes sense administratively, but it’s not cheap, it’s overall cheaper than Meraki but you must keep licenses on many parts at once. I like the security features and by centralising the policies and policy objects to fortimanager, you only generally update an object, say a new application or new port once, and install it everywhere. Dynamic objects allow it to use the same rule but translated to the individual devices.

Fortimanager isn’t easy though. It’s very powerful and doesn’t hold much back. So you can feel overwhelmed. If your firewall networking is strong you should be fine.