The Real Cost of Enterprise Networking: Five-Year TCO Across Four Scenarios
A transparent bottom-up TCO model — from a 50-user branch to a 10,000-user global enterprise — comparing Cisco, HPE, Arista, Fortinet, Extreme, Huawei and Ubiquiti. Hardware is the smallest part of the bill.
"Which vendor is cheapest?" depends on the size of the estate and on what you count. This part uses a transparent, bottom-up model to compare five-year total cost of ownership across four realistic scenarios — and shows why the lowest hardware price rarely wins.
Key takeaways
- Hardware is the smallest part of TCO above branch size; subscriptions, support, NAC/SASE and operations labour dominate.
- Cisco carries the highest TCO in every scenario, about 25–45% above Fortinet (the lowest enterprise-grade stack) and ~15–18% above HPE.
- Negotiating renewal caps is worth more than the upfront discount, because recurring costs are ~45–55% of five-year TCO before labour.
How to read prices in this series. Confirmed / Public MSRP = published by the vendor or a named reseller's list price. Reseller price = advertised by a named authorised reseller on 8 October 2026. Market estimate = my street-price range for budgeting. Enterprise quote = not publicly disclosed; large deals typically land 30–60% below list. Planning rates: USD 1 = INR 95 = EUR 0.87.
The formula
TCO = Hardware + Software + Licensing + Support + Maintenance + Management + Security + Optics + Installation + Professional Services + Training + Migration + Operational Costs.
Model assumptions
| Assumption | Value used |
|---|---|
| Price basis | USD estimated street/partner prices (Market estimate) calibrated against the public reseller prices in Part 3; US pricing, excluding tax. |
| Capex components | Hardware + optics (2% branch; 7–12% campus/DC by vendor) + spares (5%) + installation/professional services/migration (10–20% of hardware) + training (one-off) + management platform (Scenarios C/D). |
| Opex components | Licences, cloud management, support/AMC, security subscriptions, NAC per endpoint, SASE per user, and operations labour. |
| Escalation | 4% per year on subscriptions/support from Year 2. |
| Operations labour | Network-engineer FTE at $140,000/yr fully loaded (US), multiplied by an operational-efficiency factor: Cisco 1.00, HPE 0.88 (Mist/Central AIOps), Arista 0.85, Fortinet 0.90, Extreme 0.95, Huawei 1.00, Ubiquiti 1.15. |
| Stacks | Arista and Extreme stacks include partner NGFW/SSE (FortiGate or Palo Alto) because they lack first-party NGFW. Huawei* shown for reference only. Ubiquiti lacks enterprise NAC, SASE and DC — modelled only for A and B and is not like-for-like. |
| Not included | WAN/DIA circuits (same for every vendor), power/cooling, hardware refresh beyond 5 years, Cisco-to-X retraining beyond the training line. |
Scenario A — Small branch (50 users)
Bill of materials: 1× branch SD-WAN/NGFW, 2× 24-port PoE access switch, 3× Wi-Fi 7 AP; cloud management. Operations labour: 0.05 FTE × $140,000 adjusted by vendor operational-efficiency factor.
| Vendor stack | Initial CAPEX | Year 1 OPEX | Year 2 OPEX | Year 3 OPEX | Year 4 OPEX | Year 5 OPEX | 3-Year TCO | 5-Year TCO |
|---|---|---|---|---|---|---|---|---|
| Cisco | $11,614 | $8,700 | $8,768 | $8,839 | $8,912 | $8,989 | $37,921 | $55,822 |
| HPE (Aruba + Juniper) | $11,250 | $7,750 | $7,814 | $7,880 | $7,949 | $8,020 | $34,693 | $50,662 |
| Arista (+ partner NGFW/SSE) | $12,668 | $7,900 | $7,978 | $8,059 | $8,143 | $8,231 | $36,605 | $52,980 |
| Fortinet | $7,875 | $7,290 | $7,330 | $7,371 | $7,414 | $7,458 | $29,865 | $44,737 |
| Extreme (+ FortiGate) | $10,509 | $7,970 | $8,023 | $8,078 | $8,135 | $8,194 | $34,580 | $50,909 |
| Huawei* | $7,875 | $7,630 | $7,655 | $7,681 | $7,709 | $7,737 | $30,842 | $46,287 |
| Ubiquiti | $4,127 | $8,110 | $8,112 | $8,115 | $8,117 | $8,120 | $28,464 | $44,702 |
| Vendor stack | Hardware (excl. services) | Annual subs + support (Y1) | Annual ops labour | 5Y TCO per site | 5Y TCO per user | 5Y TCO per device | Annualised TCO |
|---|---|---|---|---|---|---|---|
| Cisco | $8,700 | $1,700 | $7,000 | $55,822 | $1,116 | $9,304 | $11,164 |
| HPE (Aruba + Juniper) | $7,400 | $1,590 | $6,160 | $50,662 | $1,013 | $8,444 | $10,132 |
| Arista (+ partner NGFW/SSE) | $8,400 | $1,950 | $5,950 | $52,980 | $1,060 | $8,830 | $10,596 |
| Fortinet | $5,100 | $990 | $6,300 | $44,737 | $895 | $7,456 | $8,947 |
| Extreme (+ FortiGate) | $6,700 | $1,320 | $6,650 | $50,909 | $1,018 | $8,485 | $10,182 |
| Huawei* | $4,700 | $630 | $7,000 | $46,287 | $926 | $7,715 | $9,257 |
| Ubiquiti | $3,100 | $60 | $8,050 | $44,702 | $894 | $7,450 | $8,940 |
Lowest 5-year TCO in this scenario: Ubiquiti ($45k); highest: Cisco ($56k). Cisco vs. lowest: +25%.
Scenario B — Medium campus (500 users)
Bill of materials: 2× campus NGFW/SD-WAN, 10× 48-port PoE access switch, 2× core/distribution switch, 25× Wi-Fi 7 AP; NAC for 1,000 endpoints; cloud management. Operations labour: 0.5 FTE × $140,000 adjusted by vendor operational-efficiency factor.
| Vendor stack | Initial CAPEX | Year 1 OPEX | Year 2 OPEX | Year 3 OPEX | Year 4 OPEX | Year 5 OPEX | 3-Year TCO | 5-Year TCO |
|---|---|---|---|---|---|---|---|---|
| Cisco | $197,060 | $110,000 | $111,600 | $113,264 | $114,995 | $116,794 | $531,924 | $763,713 |
| HPE (Aruba + Juniper) | $169,595 | $92,600 | $93,840 | $95,130 | $96,471 | $97,866 | $451,165 | $645,501 |
| Arista (+ partner NGFW/SSE) | $186,890 | $94,250 | $95,640 | $97,086 | $98,589 | $100,153 | $473,866 | $672,607 |
| Fortinet | $113,420 | $80,500 | $81,200 | $81,928 | $82,685 | $83,473 | $357,048 | $523,206 |
| Extreme (+ FortiGate) | $137,941 | $89,100 | $90,004 | $90,944 | $91,922 | $92,939 | $407,989 | $592,850 |
| Huawei* | $103,550 | $84,000 | $84,560 | $85,142 | $85,748 | $86,378 | $357,252 | $529,379 |
| Ubiquiti | $32,012 | $81,060 | $81,082 | $81,106 | $81,130 | $81,155 | $275,260 | $437,545 |
| Vendor stack | Hardware (excl. services) | Annual subs + support (Y1) | Annual ops labour | 5Y TCO per site | 5Y TCO per user | 5Y TCO per device | Annualised TCO |
|---|---|---|---|---|---|---|---|
| Cisco | $145,500 | $40,000 | $70,000 | $763,713 | $1,527 | $19,582 | $152,743 |
| HPE (Aruba + Juniper) | $121,500 | $31,000 | $61,600 | $645,501 | $1,291 | $16,551 | $129,100 |
| Arista (+ partner NGFW/SSE) | $133,000 | $34,750 | $59,500 | $672,607 | $1,345 | $17,246 | $134,521 |
| Fortinet | $82,000 | $17,500 | $63,000 | $523,206 | $1,046 | $13,416 | $104,641 |
| Extreme (+ FortiGate) | $97,700 | $22,600 | $66,500 | $592,850 | $1,186 | $15,201 | $118,570 |
| Huawei* | $73,500 | $14,000 | $70,000 | $529,379 | $1,059 | $13,574 | $105,876 |
| Ubiquiti | $25,010 | $560 | $80,500 | $437,545 | $875 | $11,219 | $87,509 |
Lowest 5-year TCO in this scenario: Ubiquiti ($438k); highest: Cisco ($764k). Cisco vs. lowest: +75%.
Scenario C — Large enterprise (5,000 users)
Scenario C – Large enterprise (5,000 users, 3 campuses + DC + 10 branches)
Bill of materials: 6× campus NGFW/SD-WAN, 10× branch SD-WAN/NGFW, 110× 48-port PoE access switch, 6× core/distribution switch, 8× DC leaf, 2× DC spine (400G), 2× DC firewall, 220× Wi-Fi 7 AP; NAC for 10,000 endpoints; SASE/SSE for 5,000 users; on-prem/hybrid management platform. Operations labour: 4 FTE × $140,000 adjusted by vendor operational-efficiency factor.
| Vendor stack | Initial CAPEX | Year 1 OPEX | Year 2 OPEX | Year 3 OPEX | Year 4 OPEX | Year 5 OPEX | 3-Year TCO | 5-Year TCO |
|---|---|---|---|---|---|---|---|---|
| Cisco | $1,989,880 | $1,512,000 | $1,550,080 | $1,589,683 | $1,630,871 | $1,673,705 | $6,641,643 | $9,946,219 |
| HPE (Aruba + Juniper) | $1,643,070 | $1,281,400 | $1,312,944 | $1,345,750 | $1,379,868 | $1,415,350 | $5,583,164 | $8,378,382 |
| Arista (+ partner NGFW/SSE) | $1,764,100 | $1,416,000 | $1,453,600 | $1,492,704 | $1,533,372 | $1,575,667 | $6,126,404 | $9,235,443 |
| Fortinet | $1,195,050 | $1,125,600 | $1,150,464 | $1,176,323 | $1,203,215 | $1,231,184 | $4,647,437 | $7,081,836 |
| Extreme (+ FortiGate) | $1,370,528 | $1,274,700 | $1,304,408 | $1,335,304 | $1,367,436 | $1,400,854 | $5,284,940 | $8,053,231 |
| Huawei* | $1,015,800 | $1,201,300 | $1,226,952 | $1,253,630 | $1,281,375 | $1,310,230 | $4,697,682 | $7,289,288 |
| Vendor stack | Hardware (excl. services) | Annual subs + support (Y1) | Annual ops labour | 5Y TCO per site | 5Y TCO per user | 5Y TCO per device | Annualised TCO |
|---|---|---|---|---|---|---|---|
| Cisco | $1,409,000 | $952,000 | $560,000 | $710,444 | $1,989 | $27,325 | $1,989,244 |
| HPE (Aruba + Juniper) | $1,179,000 | $788,600 | $492,800 | $598,456 | $1,676 | $23,018 | $1,675,676 |
| Arista (+ partner NGFW/SSE) | $1,270,000 | $940,000 | $476,000 | $659,675 | $1,847 | $25,372 | $1,847,089 |
| Fortinet | $855,000 | $621,600 | $504,000 | $505,845 | $1,416 | $19,456 | $1,416,367 |
| Extreme (+ FortiGate) | $981,600 | $742,700 | $532,000 | $575,231 | $1,611 | $22,124 | $1,610,646 |
| Huawei* | $716,000 | $641,300 | $560,000 | $520,663 | $1,458 | $20,026 | $1,457,858 |
Lowest 5-year TCO in this scenario: Fortinet ($7.08M); highest: Cisco ($9.95M). Cisco vs. lowest: +40%.
Scenario D — Global enterprise (10,000 users, 50 sites)
Bill of materials: 10× campus NGFW/SD-WAN, 45× branch SD-WAN/NGFW, 300× 48-port PoE access switch, 100× 24-port PoE access switch, 16× core/distribution switch, 24× DC leaf, 4× DC spine (400G), 4× DC firewall, 600× Wi-Fi 7 AP; NAC for 20,000 endpoints; SASE/SSE for 10,000 users; on-prem/hybrid management platform. Operations labour: 10 FTE × $140,000 adjusted by vendor operational-efficiency factor.
| Vendor stack | Initial CAPEX | Year 1 OPEX | Year 2 OPEX | Year 3 OPEX | Year 4 OPEX | Year 5 OPEX | 3-Year TCO | 5-Year TCO |
|---|---|---|---|---|---|---|---|---|
| Cisco | $5,259,040 | $3,472,000 | $3,554,880 | $3,641,075 | $3,730,718 | $3,823,947 | $15,926,995 | $23,481,660 |
| HPE (Aruba + Juniper) | $4,360,165 | $2,944,250 | $3,012,740 | $3,083,970 | $3,158,048 | $3,235,090 | $13,401,125 | $19,794,263 |
| Arista (+ partner NGFW/SSE) | $4,709,290 | $3,198,500 | $3,278,840 | $3,362,394 | $3,449,289 | $3,539,661 | $14,549,024 | $21,537,974 |
| Fortinet | $3,170,555 | $2,570,750 | $2,623,180 | $2,677,707 | $2,734,415 | $2,793,392 | $11,042,192 | $16,570,000 |
| Extreme (+ FortiGate) | $3,699,770 | $2,914,000 | $2,977,360 | $3,043,254 | $3,111,785 | $3,183,056 | $12,634,384 | $18,929,225 |
| Huawei* | $2,665,200 | $2,735,050 | $2,788,452 | $2,843,990 | $2,901,750 | $2,961,820 | $11,032,692 | $16,896,261 |
| Vendor stack | Hardware (excl. services) | Annual subs + support (Y1) | Annual ops labour | 5Y TCO per site | 5Y TCO per user | 5Y TCO per device | Annualised TCO |
|---|---|---|---|---|---|---|---|
| Cisco | $3,772,000 | $2,072,000 | $1,400,000 | $469,633 | $2,348 | $21,289 | $4,696,332 |
| HPE (Aruba + Juniper) | $3,150,500 | $1,712,250 | $1,232,000 | $395,885 | $1,979 | $17,946 | $3,958,853 |
| Arista (+ partner NGFW/SSE) | $3,413,000 | $2,008,500 | $1,190,000 | $430,759 | $2,154 | $19,527 | $4,307,595 |
| Fortinet | $2,290,500 | $1,310,750 | $1,260,000 | $331,400 | $1,657 | $15,023 | $3,314,000 |
| Extreme (+ FortiGate) | $2,669,000 | $1,584,000 | $1,330,000 | $378,584 | $1,893 | $17,162 | $3,785,845 |
| Huawei* | $1,904,000 | $1,335,050 | $1,400,000 | $337,925 | $1,690 | $15,318 | $3,379,252 |
Lowest 5-year TCO in this scenario: Fortinet ($16.57M); highest: Cisco ($23.48M). Cisco vs. lowest: +42%.
How to interpret the numbers
-
Lowest hardware price ≠ lowest TCO. Ubiquiti has the lowest capex in A/B by a wide margin, but its 5-year TCO advantage narrows because operational labour dominates and it lacks NAC, SASE and enterprise TAC.
-
Subscriptions dominate from the medium campus upward. In Scenario C, recurring licences, support, NAC and SASE are ~45–55% of the 5-year TCO for every vendor (rising to ~80–85% once operations labour is added); negotiating renewal caps is worth more than the upfront discount.
-
Cisco premium is roughly 25–45% versus the lowest enterprise-grade stack (Fortinet) and ~15–18% versus HPE; it buys skills availability, ecosystem breadth and lowest migration risk.
-
Fortinet is consistently lowest among enterprise-grade options because security, SD-WAN and LAN/WLAN management share one licence and OS — but its data-center fabric is weaker, so Scenario D assumes a less capable DC design.
-
HPE Networking sits roughly mid-way between Fortinet and Cisco while offering the closest functional parity with Cisco.
The same stacks in India and Europe
Scenario B — 500-user campus
| Vendor stack | US 5Y TCO (USD) | India 5Y TCO (INR, excl. GST) | India (USD equiv.) | Europe 5Y TCO (EUR, excl. VAT) | Europe (USD equiv.) |
|---|---|---|---|---|---|
| Cisco | $763,713 | ₹487.8 lakh | $513,427 | €621,309 | $714,149 |
| HPE (Aruba + Juniper) | $645,501 | ₹404.2 lakh | $425,497 | €522,327 | $600,376 |
| Arista (+ partner NGFW/SSE) | $672,607 | ₹438.2 lakh | $461,298 | €549,285 | $631,363 |
| Fortinet | $523,206 | ₹280.4 lakh | $295,107 | €409,175 | $470,316 |
| Extreme (+ FortiGate) | $592,850 | ₹335.3 lakh | $352,947 | €468,902 | $538,967 |
| Huawei* | $529,379 | ₹260.8 lakh | $274,553 | €407,114 | $467,947 |
| Ubiquiti | $437,545 | ₹132.2 lakh | $139,120 | €312,067 | $358,697 |
Regional factors used: India — hardware ×1.12 (duty/logistics net of deeper discount), subscriptions ×0.95, labour ×0.25; Europe — hardware ×1.05, subscriptions ×1.05, labour ×0.80. GST/VAT excluded because they are normally recoverable. Market estimates, not quotations.
Scenario C — 5,000 users
| Vendor stack | US 5Y TCO (USD) | India 5Y TCO (INR, excl. GST) | India (USD equiv.) | Europe 5Y TCO (EUR, excl. VAT) | Europe (USD equiv.) |
|---|---|---|---|---|---|
| Cisco | $9,946,219 | ₹7432.4 lakh | $7,823,588 | €8,475,566 | $9,742,030 |
| HPE (Aruba + Juniper) | $8,378,382 | ₹6183.2 lakh | $6,508,585 | €7,115,774 | $8,179,051 |
| Arista (+ partner NGFW/SSE) | $9,235,443 | ₹7031.5 lakh | $7,401,568 | €7,916,752 | $9,099,715 |
| Fortinet | $7,081,836 | ₹4904.6 lakh | $5,162,703 | €5,919,635 | $6,804,178 |
| Extreme (+ FortiGate) | $8,053,231 | ₹5715.4 lakh | $6,016,159 | €6,776,119 | $7,788,642 |
| Huawei* | $7,289,288 | ₹4875.5 lakh | $5,132,109 | €6,047,807 | $6,951,502 |
India's lower labour cost means subscriptions and hardware form a larger share of TCO — so in India, licence negotiation is the biggest lever. More on regional factors in Part 5.
Using this in your own business case
- Replace the market estimates with formal quotes from at least two partners per region.
- Keep the structure: every line priced separately, 4% annual escalation on subscriptions and support from Year 2.
- Adjust the operations-labour factor to your team — AIOps and automation savings only materialise if you invest in training (5–10% of capex).
Research date: 8 October 2026. Vendor-neutral and independent — no vendor sponsorship. Prices, licences and product names change frequently; re-validate every figure with at least two authorised partners per region before purchasing. TCO figures are illustrative models built on stated assumptions, not quotations. Gartner content is cited via vendor and press announcements. Not legal, tax or investment advice.
The full series: Enterprise Network Vendors 2026
📄 Prefer one document? Download the full 44-page report (PDF)
- The market after HPE–Juniper and Arista–VeloCloud
- Products and technical capabilities compared
- Licensing, pricing and support decoded
- Five-year TCO across four enterprise scenarios (you are here)
- India, Europe and the US: regional realities
- Choosing, migrating and negotiating
Next: Part 5 — India, Europe and the US: regional realities →
- #TCO
- #Vendor Analysis
- #Cost Optimisation
- #Business Case
- #Cisco
- #Fortinet
- #Enterprise Network Vendors 2026
Related reading
Network Licensing Decoded: Cisco vs Competitors on Licences, Prices and Support
Hardware ≠ licence ≠ cloud management ≠ support ≠ security subscription. How Cisco, HPE, Juniper, Arista, Fortinet, Palo Alto and others really charge — with real reseller prices from October 2026.
Beyond Cisco: The Enterprise Networking Market in 2026
Two 2025 deals redrew the map: HPE now owns Juniper and Arista owns VeloCloud. Part 1 of a vendor-neutral, 19-vendor analysis — who really competes with Cisco, and in which category.
Enterprise Network Vendors Compared: Products and Technical Capabilities
Switching, routing, Wi-Fi 7, SD-WAN, NGFW, SASE, data-center fabrics and automation — a side-by-side view of what Cisco and 13 alternatives actually offer, plus a 24-row feature matrix.
Let's talk
Have a technology initiative, a project, or a career question?
Tell me a little about it. I read every message and usually reply within two working days.