Fortinet FortiWeb Reviews

We have websites that clients access from the internet, so we use it to protect these websites and to load balance between the backend servers.

We have FortiGate firewalls with IPS sensors and so on.

The WAF profiles has been most effective at mitigating web-based threats – probably something standardized, but again, we haven't tested it on heavily used websites. The websites that we use it for so far are just average websites. It can likely protect from some requests like bots and stuff like that.  

The AI/ML-based detection in FortiWeb has enhanced our web security posture to some extent. It's good with general stuff. Again, it's not specialized. So, standard WAF threats, like bots, it can detect those faster. It's good for the average website, average requests, and the average security setup. But we have other malicious requests that are probably outside the typical OWASP threats – they're specialized for our organization.

For example, if you have the FIX protocol, the financial protocol... if attackers can get into it with a targeted client ID... these threats aren't in the standard OWASP list because they're not general attacks that everybody faces. They're very specific. Now, many companies use the FIX protocol on private circuits, so they're protected outside of breach attempts. But, believe it or not, we have FIX open on the public internet for some websites, and those need protection. They need something outside the WAF that FortiWeb doesn't have. You can try to apply the WAF, and it might catch a threat if it originated from a bot. But if somebody is malicious enough to go under the bot detection radar, they could still process it.

So, for known threats, like bots, the detection is good. For APIs, it's also good because it can detect anomalies with standard API attacks. Again, these are mostly average, non-targeted attacks.

If an attacker specifically targets your organization, understands your protocols and business model... the standard protection is good because it detects things that aren't coming from a browser – it recognizes that it's not normal user activity or anomalies on your website. That's beneficial.

Most bot-generated attacks don't come from a browser. I did notice that it can detect when the request is not coming from a browser – it recognizes that it's not normal user activity on your website. It can detect anomalies publicly, which is good.

So, what would be good is this: put FortiWeb in front as the first line of defense. It can take care of a lot of the average user traffic and filter it out. You can keep that for your average applications, but when you have specialized applications behind that, then we need specialized protection for those applications – whether it's F5 or something else.

I like the integration with our existing Fortinet infrastructure. It's easy to integrate, and it's easy to make policy-driven. That's the feature I like – usability, simplicity, and ease of use.

I'd like more customization. I'm not sure if everyone would agree, as it might add complexity. But for advanced users, it would be really useful to have access and the ability to manipulate packets. 

If we can access and manipulate the contents of packets, even encrypted packets... that would be powerful. Since we're looking at packets arriving at our network, we would have the private key to access those packets and their information. 

For example, I have an encrypted packet, and I have the private key for the certificate provided in that client. If I could tell FortiWeb, "After the packet is decrypted, if you see this thing, do that thing," that would be beneficial for advanced users. 

It would open up the possibilities for load balancing and specialized protection that we need but might be outside of the standard feature set. 

Maybe we need to manipulate a variable with a specific name that's only relevant to our security needs. That customization would be very beneficial.

I have been using it for a year now. We use Fortinet solution – firewall, then FortiWeb, and all that. We have versions six and seven deployed since we're a global company with many different sites.

In my experience, it's mostly stable. But, when new versions come out, we've found issues. It seems like new versions fix some problems from older releases, but they also introduce new issues that we have to discover later. So, I'm not a big fan of always going to the latest and greatest version, particularly with Fortinet, since this might be a newer product area for them. 

I need to be very careful with availability and reliability when upgrading versions. In comparison to vendors who have been in the business longer – like AWS WAF, or even desktop solutions with more experience – those tend to be more stable. They've been around longer, they've seen more issues, and they've fixed them. 

So, FortiWeb's stability is a bit… it depends on how you use it. Let me put it that way. If you want to use something more advanced, be prepared for potential issues.

I would rate the stability a five out of ten because we've encountered a few issues that weren't great. We only discovered later that they were bugs in the system that would get fixed in future updates. So, Fortinet needs to work on that in my opinion. There wasn't the level of thoroughness I would have expected. 

It's not very scalable. I would put it on the low end of the scale. But again, that's my opinion because I work with a different business model where we use more advanced products – not just F5, but others as well. 

F5 is the main comparison point for FortiWeb. We also use other protection solutions, and those are more scalable. So, I would rate FortiWeb's scalability as low. However, that might be an advantage for some people. If you have an average model and are protecting an average website, that's exactly what you need. You don't want a product with so many features that someone could accidentally misconfigure it and bring everything down.

In that scenario, it could take hours to get it back online, and there would be significant financial losses.

So, overall, I would rate the scalability a four out of ten. We have five endpoints for this solution in our company.

The customer service and support are very good. They're responsive.

We switched from Check Point to FortiWeb. There were two main reasons behind it:

1. FortiNet offers more options when compared to Check Point. 
2. Also, support is cheaper. Like support-wise, it's significantly cheaper to get support from Fortinet.

Those were the main reasons. 

We actually considered Palo Alto. I have lots of experience with Palo Alto, but we ended up not going with them because it's more expensive. The expense is not just in terms of support, but also the hardware itself. Check Point is more expensive in terms of support. 

Fortinet wins in terms of lower cost, both for support and comparable hardware. And they have more options – a broader product line. It seems like Fortinet is trying to cover everything in the network. Check Point specifically focuses on firewalls. 

Palo Alto offers broader security coverage than Check Point, but not as much as FortiNet, and they're the most expensive option. So, Check Point is just a standard firewall company – not flexible and very expensive for support.

We're still evaluating FortiWeb. In my opinion, it's a good solution for simple websites that you can set up and then mostly leave alone. 

If it's an average website without advanced features or one that won't be developed into something more complex, then FortiWeb fits well. This simplicity could be an advantage for some users. I try not to rate things as simply good or bad – it depends on how you use them. It's a good product, especially since we have a lot to handle. If I have an average website, the last thing I want is someone making a wrong configuration change or an application update crashing everything. That would waste our department's time and money to troubleshoot. 

FortiWeb is actually ideal if I have a small website with basic features – a place where people can go to read, post text, and maybe make simple purchases.

I would set it up and then mostly forget about it. It's great when it gives you no headaches and works reliably. It's like using the right vehicle for the job. You don't want a huge truck to go grocery shopping. You need a small, efficient car. But if you're in the moving business, a truck is what you want. So again, it's a tool for its purpose. I don't see it as good or bad, but rather if it's good for this specific thing. I do see scalability as a limitation, but it's scalable for its intended use. It's a great tool for what it's designed to do.

We might use it more in the future, likely as a result of more website development, not driven by our IT plans. Our websites might evolve as the market does. I'd put FortiWeb on our standard user sites. I'm happy with that. But if we need specialized features, then we'll need a specialized solution. That's just my opinion. 

Ultimately, how FortiWeb evolves depends on business needs and justification. If something new and big comes along in the market – something that needs to move huge amounts of data – we might need different tools. Or, if the market just demands short video clips, then maybe FortiWeb is fine.

There are limited options with FortiWeb, and there's not much you can configure incorrectly. So it's easier in that sense – you go next, next, next, and it works.

So, the initial setup was pretty easy. I would rate my experience with the initial setup an eight out of ten, with ten being easy to set it up. That's really what I like about it.

In my understanding, I'd position FortiWeb as a first line of defense, a tier-one solution. It would remove all the known attacks easily. I set it up once, and it handles probably 80% to 90%of undesirable traffic. But then, for the remaining ten percent, where specialized attacks require more tailored protection, I'd need a second line of defense – something more specialized. 

It passed all the standard attacks; now I need to detect those malicious actors who are deliberately trying to stay under the radar of published detection mechanisms.

That's something FortiWeb could improve upon for advanced users. And it's really about advanced features for specialized applications or specific business models. It's for those companies where they need deeper protection.

I didn't deploy it myself. We received a solution where our firewall was changed, and FortiWeb was included. We migrated policies, so our situation was different. However, something like this could be deployed over a weekend. If you have a Fortinet firewall and want to add FortiWeb for protection, it's likely a weekend project. That's just my opinion.

I don't think this solution needs dedicated maintenance. But with any product like this, you need someone to monitor it. It depends on your company's model. If you're a 24/7 operation, you probably need 24/7 support.

From a technical perspective, it's been reliable for average applications and doesn't consume a lot of our time for management. 

The support is handled by Fortinet, so our administrative overhead is low, which seems like an acceptable return.

The pricing is in the middle. I would rate the pricing a five out of ten. It feels like a justified cost for the features, but it might get more expensive in the future. Also, keep in mind that Check Point's support contracts are particularly expensive.

In general, there is additional cost for support. But Fortinet support is generally cheaper than Check Point support. Palo Alto is even more expensive. This information is publicly available – you can compare comparable hardware and support contracts on their websites. 

Check Point tends to be the most expensive. This is just general information, and my understanding might not be perfectly accurate.

We also use F5. What happened is that we used Check Point as well. So when we replaced Check Point, we were offered this product with FortiWeb. So, we use it for some websites, but we have another solution we use for web applications. We want to test how FortiWeb works before potentially replacing F5. That's the advantage. We offered to use it with that POC first, and then we rolled it to a few of our websites since we have many different websites in the organization.

In my personal experience, F5 gives us more flexibility to do whatever we want. Fortinet FortiWeb is very restricted. We have templates and some profiles, but there's limited customization. 

F5 is a more open platform. You can customize how you want to handle requests and what you want the device to do. FortiWeb is an easy solution to implement; F5 is not as easy. 

I find F5 easy because I've been working with it for a long time. If you're a newcomer without experience, it would be easier for you to get FortiWeb working than F5, definitely. There are limited options with FortiWeb, and there's not much you can configure incorrectly. So it's easier in that sense – you go next, next, next, and it works.

To summarize my personal opinion, I see FortiWeb as targeting people who don't want to spend a lot of time configuring or customizing. If you need something quick and not very customizable, FortiWeb is an option. You don't need people with lots of experience with it because there aren't many choices. It seems, and this is again my personal opinion, that the people who designed FortiWeb are the same people who designed their firewall, which makes sense.

With the Fortinet NG firewall, you have a GUI to allow traffic from point A to point B – anyone can do this from the get-go. It's the same concept with FortiWeb, but it's very limited in what you can do. It's restricted, so it's ideal for somebody who just has a classic website without many options and they have average clients accessing it from the Internet. You don't have many options to make a mistake. But for our organization, and others with in-house developed products, you need something more flexible.

Fortinet won't cut it if you need people to come in and log in to trade stocks or exchange data using custom-built clients. You want to restrict and control these things. You have to go with something like F5 because it gives you that flexibility. With F5, you can capture a packet and rewrite it – it's programmable. You cannot do that with Fortinet.

Another limitation is with load balancing. FortiWeb gives you limited options, good for someone who has three or four servers and wants to load balance between them. F5 has a plethora of load-balancing algorithms, plus you can create your own.

To give examples, we have applications with a set of servers in different sites. We use geolocation, but also user behavior. Based on where the user is coming from and what they do on the site, we direct them to different servers. Fortinet FortiWeb doesn't have that flexibility, F5 does. Those are the main differences from my perspective.

So, FortiWeb is good for somebody who wants something to turn on, doesn't have a lot of experience, and just needs to protect a couple of servers behind a load balancer. If something goes wrong, troubleshooting is easier, and you can raise a ticket with Fortinet. With F5, you need to go deeper into troubleshooting code if you have complex configurations.

FortiWeb is good for classic websites. We do use it for situations like a couple of servers, or three or four servers – even seven in certain data centers – where we need to load balance between them, protect them, and have web access from the internet for public access. Your average users and average requests, it works fine. You turn it on, you don't touch it, and it works fine. But if we want something with a lot of products that we develop in-house, you can't do all these things. You need different load balancing algorithms because of specific use cases.

For example: We also have users uploading a lot of data. We can't just put them with many other users because they cause congestion. So, we need to load balance them – when they do normal requests, send them to the regular servers, but when they do bulk data transfers, we want to send them elsewhere. We need to do this, and these requests come from the same users on the same webpage, but they're clicking a different button. So we need to intercept that and say, "Oh, now the user wants to do this, let's send them there."

I can't give general advice because I work with medium to large-scale organizations – my perspective is different from someone who uses a few servers in a data center. So, my advice for larger companies is that you need to have a very clear analysis of your specific needs. Each configuration option can make or break your business at that scale.

In my opinion, FortiWeb would be a good fit for load balancing between three or four servers in a single physical data center location. And if you primarily want protection from standard, known web threats – OWASP type of stuff. If you have an application in one place and don't need to do specialized manipulation of requests to the website, then it's a good solution.

Overall, I would rate the solution a five out of ten because it lacks advanced options and isn't very scalable. It seems suitable for average websites – that's my personal opinion.

My company is a Fortinet partner and specializes in FortiWeb. We often compete against cloud-native solutions like Azure Application Gateway WAF. We typically conduct proof-of-concept tests for potential clients. They are usually looking for API protection and bot mitigation, which FortiWeb excels at. We take responsibility for implementing and supporting the solution for our customers.

We also conduct simulation tests and review feedback from colleagues and customers. Customers often seek solutions for bottlenecks, especially regarding machine learning. We can do a detailed review of the WAF services and provide a report for the customer.

If a customer has a website, a firewall alone is not enough. While a firewall can act as an application firewall, it may not be sufficient. If we have a firewall at layer four and layer seven, and the customer needs protection against OWASP Top 10 vulnerabilities or requires IT audits, a web application firewall becomes crucial. 

Additionally, if DDoS protection is a concern, it often comes integrated with WAF. For networking, some WAFs can even provide load-balancing functionality.

In my experience, we put my customer's website in monitor mode, not protect mode. So, we initially set up FortiWeb in monitor mode to avoid disruptions to the customer's website.

While in monitor mode, machine learning observed the web application. Once machine learning had enough data to analyze, we discussed unusual traffic patterns with the customer. 

FortiWeb identified potential DDoS attacks and suspicious domain activity, showcasing the value of its machine-learning capabilities.

The price could be close to Imperva; Imperva is the number one firewall.

FortiWeb cannot do some kind of ADC solution, like load balancing. I hope they improve that.

I'm looking for the ADC solution, the load balancing solution. Because application firewalls with multiple line solutions do come with it. So, I think it should be integrated within FortiWeb WAF.

I used it for two years. I started working with it when a client company moved their web application to the cloud (Azure or AWS) and needed protection. We implemented a FortiWeb solution as their WAF.

I have used Check Point for email security. 

For security products, from my experience, customers will compare costs if they have been attacked. They may consider insurance. If you provide more protection, the return on investment is the compromise to use the application.

This product offers two pricing options: a standard package and an advanced package. The advanced package includes credential stuffing protection, while the standard package includes automatic application learning, bot mitigation, and web application protection. 

If you simply need to protect your website, the standard package is sufficient. However, if you need credential stuffing protection, the advanced package is necessary. This is the key difference between the two packages.

Overall, I would rate the solution an eight out of ten. 

I use the solution in my company, as we mostly load some web applications at our data center and use it to ensure that the web pages are properly secured.

Actually, most of the features of the tool are really good, but I would like to emphasize the importance of its machine learning features, as it can be implemented smoothly in Fortinet FortiWeb, and it is very helpful for our company.

Though the reporting is a nice aspect associated with the tool, I feel that it has certain shortcomings and can be made better. The reporting part can provide more information and be more specific.

Fortinet FortiWeb's admin guide could offer more, like, examples or features on how to implement the tool. It can provide information on how a user can make use of it in different usages, and that can help a lot. The admin guide is satisfactory, and it meets our company's needs.

Actually, my company would like it if the product could implement scanning attachments for exchange for assets or exchange needs. The aforementioned area consists of the feature that my company wants to apply, but it is not supported in Fortinet yet. My company needs the product to support us in the aforementioned area, and it can help us a lot by providing a layer of security that can check files and attachments in emails and other stuff, which would be great.

I have been using Fortinet FortiWeb for three years. I am an end user of the solution.

Stability-wise, I rate the solution an eight out of ten.

In terms of stability, it is a good solution that is easy to use and has many features and resources. The support offered by the product is good, especially since the support team responds on time, keeps you informed, and even follows up. Generally, it is a good solution to have and use.

My company has not experienced any downtime while using the product.

In our company, we have not implemented the product on a large scale.

Around 2,000 people per month use the product in our company.

Every single day, the tool is used to host web applications.

If our company needs to implement more hosted web servers, we will use Fortinet FortiWeb, but if not, then it will remain at the current number. Increasing the use of the tool is not my decision, and I just accommodate the needs of the organization.

The solution's technical support is good. When my company faced some problems with the product, I found the solution's support team to be very supportive and helpful. I rate the technical support a nine out of ten.

Positive

On a scale of one to ten, where one is difficult and ten is easy, I rate the product's initial setup phase as eight or nine.

The product's initial setup phase was straightforward, and since our company didn't have any problems with it, we didn't encounter many problems with the tool. Maybe our company encountered some problems with the product's setup because we used to use it to set up the servers or stuff, which took time, but now Fortinet FortiWeb handles everything smoothly and easily.

The solution is deployed on an on-premises version.

The solution can be deployed in a week.

If my company did not have Fortinet FortiWeb, then I believe that we would have had to host some of the services in an external data center with extra fees and there we would have had to pay for the web services, but we don't need that anymore because now, we have an on-prem web service that can promote us to be able to host as much as we need of web services.

On a scale of one to ten, where one is zero percent and ten is a hundred percent, I rate the ROI as an eight.

If one is very cheap and ten is very expensive, I rate the product price as three or four. The tool is cost-effective and offers value for money. I didn't mean it was very expensive. The price is fixed, but some features need an extra license.

My company was considering F5, but you actually went for Fortinet FortiWeb after considering the cost aspect.

My company doesn't specifically host e-commerce platforms since we offer mainly government services.

The security part has been satisfactory till now, and we haven't faced any problems yet.

FortiGate FortiWeb's features that have been most effective in mitigating web-based threats are possible because of the signatures. My company doesn't need to enforce a lot of policies or stuff. Fortinet FortiWeb has a lot of internal databases that can help you, and you can use whatever platform you are hosting your web applications through whichever software you use. it can build up a web protection profile that matches your needs, making it a very helpful tool.

Speaking about how machine learning features enhance our security posture, I would say that some aspects of the website are not normally clear for our company, and machine learning helps in such areas. It just traces the normal usage of the web applications along with the websites or links most users visit while also checking which URLs are mostly used, after which the tool differentiates between the normal usage and any abnormalities, based on which it builds the model that can be used to improve the security. Sometimes, a person cannot do things manually and is not sure about all the aspects of our web applications because many are not developers. Machine learning comes into the picture because one may not know all the stuff associated with the product.

A team of four or five people is enough to deploy the tool. Maintaining the tool is actually not a very big task and not many people are required for it.

The integration capabilities of the product with other security tools have benefited our company's security strategy as it sits smoothly in our network. The tool doesn't cause any problems with the integration part.

I would recommend that users use the tool's high availability. With the tool, one box is not enough, so there is a need to have a cluster of two boxes. Users need to measure their needs regarding the logging process and everything else, including processing. Even before starting to use it, we have to set up everything, or you would be confused about how to use the tool in the future, and it would be difficult to figure out how much retention log retention we would need in our company. It is important to set up everything related to the users' needs so that they don't need to change a lot of settings in the future.

I rate the tool an eight out of ten.

We use FortiWeb as our web application firewall. 

FortiWeb provides the level of security we need at an excellent price point. It's easy to deploy and operationally efficient. FortiWeb enables us to streamline tasks. It's a robust solution that's effortless to configure. The AI and machine learning features help us block unknown threats. 

We can bring our web applications online faster because FortiWeb shortens the time needed to bring any application into production. Compared to other application firewalls, FortiWeb has a smoother process for bringing applications online. 

FortiWeb has few false positives. It's more accurate than other solutions, so we also see fewer alerts. FortiWeb has helped free up IT staff for other projects. You don't need to spend much time getting applications ready for the web, so IT staff can use this time to manage other things. 

The AI engine and machine learning features distinguish FortiWeb from other solutions. It has a robust UI. FortiWeb is solidly accurate and provides excellent protection against zero-day attacks using machine learning. It appears to be effective because we've never experienced a breach from a zero-day attack. 

We use almost all of the features, including analytics, malware detection, bot mitigation, and API discovery.

I think customers have the impression that FortiWeb is primarily for SMEs, but FortiWeb should work to expand its market share and adjust its branding. F5 and some other firewalls are easier to customize. FortiWeb could be more flexible and customizable. The documentation could also be improved because many of the advanced features aren't fully documented. 

We have used FortiWeb for around a year.

FortiWeb is highly stable. We haven't seen any bugs. The solution is reliable once configured properly.

FortiWeb isn't difficult to scale.

I rate Fortinet support six out of 10. The documentation and support need improvement. 

Neutral

We have used Citrix WAF and the F5. FortiWeb offers most of the same features at a better price. 

I have done on-prem, hybrid, and cloud deployments of FortiWeb. The deployment was straightforward for most features, but a few features require some customization and configuration in the console. That's where we ran into problems because the documentation isn't thorough in some areas.

It takes around three or four days to deploy FortiWeb for a simple website. It takes longer for a complex website, but it depends on the level of complexity. We deployed FortiWeb in-house with two people and some help from Fortinet support. It's deployed across multiple data centers and locations.

The price-performance ratio is good. The time to value is quick because it's easy to deploy and the ML engine doesn't take long to adjust and apply the correct rules. 

FortiWeb offers these services at a price that SME customers can afford, but it's also suitable for large enterprises. Still, they need to put in more work to gain a greater share of enterprise business because they face stiff competition in this segment from F5, Cloudflare, and some others. 

I rate Fortinet FortiWeb eight out of 10. FortiWeb is a suitable product for SMEs. I recommend a proof of concept before going forward with any project.

FortiWeb is used for protecting against malicious activities, such as SQL injections, for outward-facing web forms.

The most valuable features of FortiWeb include its dashboard and out-of-the-box integrations with other Fortinet products, which enhance its effectiveness. FortiWeb's position as part of the Fortinet platform makes it particularly beneficial for Fortinet customers, offering seamless integration and operational cost savings.

There is room for improvement in the portability on multi-cloud environments. Enhanced DDoS integration to make FortiWeb more unified with other Fortinet products could be beneficial.

I have personally been working with FortiWeb for approximately two years.

I would rate the stability of FortiWeb as nine out of ten, indicating highly stable performance.

I would rate the scalability of the product a seven out of ten. While it is multicloud-enabled, there is more automation in other products that may better suit complex environments.

I would rate the customer service and support as nine out of ten.

Positive

Our team, consisting of three certified Fortinet engineers, handles the deployment, although globally, Exclusive Networks has a large team of certified engineers.

Operational costs decrease when using FortiWeb within the Fortinet stack due to integrated assessments and security event management.

I would rate the licensing cost as seven out of ten, considering it good value for money. The price is affordable and reasonable for the features offered.

We also work with other vendors such as F5, Proofpoint, and Palo Alto, however, Fortinet stands out for its holistic vision of cybersecurity.

Overall, I would rate FortiWeb an eight out of ten for existing Fortinet customers due to its seamless integration and good value for money.

We use FortiWeb to connect external APIs to our on-prem data center solutions.

We use FortiWeb for extended protection profiles to mitigate SQL injection and other web application threats. It is effective against web application threats and helps with our API protection and load balancing. 

Additionally, it is cost-effective compared to other solutions.

They could integrate some kind of machine learning and AI facilities to automate workflows. We need to update regular patches frequently, and it requires regular installation and testing of these patches.

We have been working with FortiWeb for almost five years.

It is stable for us, showing good performance in handling web security.

I would rate its scalability at six because we have to increase our CPU and memory capacities, as it is confined to CPU and memories.

I would rate the customer service and technical support between eight and nine out of ten.

Positive

The setup is easy to manage.

It helps us save costs, about 20% to 30%.

In comparison to other solutions, the price is reasonable.

FortiWeb is suitable for medium-scale companies. I recommend using this solution.

I'd rate the solution nine out of ten.

Fortinet FortiWeb's use case is associated with WAF or web application firewall. Before a platform faces the internet, Fortinet FortiWeb inspects the traffic.

Fortinet FortiWeb is much cheaper compared to other solutions like the ones from F5 Networks, which have more capabilities. I think Fortinet FortiWeb is not as capable as F5 Networks, but it is cheaper. The key point for Fortinet FortiWeb is that when I give it to the customers, I see it is cheaper than F5 Networks.

All the players in the market are already using AI. In the AI area, I don't find any specific feature for Fortinet FortiWeb that is special compared to the other products in the market.

Fortinet FortiWeb's ML features are good, but they do not make the tool any special because all the products in the market, like F5 Networks, already use AI features. The AI feature does not make Fortinet FortiWeb any special.

The tool's WAF or web application firewall area has certain aspects that can be improved. I cannot find what features superficially can be improved in the WAF area of the tool.

Fortinet FortiWeb can be applicable for small or big networks. In my opinion, Fortinet FortiWeb can manage or improve its log management capabilities. As far as I know, FortiGate has a limit, which means it can be used for logging for seven days, and maybe it is because Fortinet wants to speed up the selling of another product called FortiAnalyzer. FortiAnalyzer is a device dedicated to logging analytic solutions. Fortinet may limit the capability of logging in Fortinet devices so that customers buy FortiAnalyzer for log analytics.

I have been using Fortinet FortiWeb for three years. My company is a reseller of the solution.

I don't know about the tool's scalability.

I rate the technical support a nine out of ten.

Positive

I also use FortiAuthenticator.

The product's initial setup phase can be somewhat complex depending on what software needs to be protected by Fortinet FortiWeb. If the web application is simple, the configuration can be made simple. If there is any specific need to protect the area in the web application, it is more tricky to configure Fortinet FortiWeb. It depends on what kind of web application needs to be protected by Fortinet FortiWeb. Overall, the tool's configuration is neither easy nor difficult.

If one is cheap and ten is expensive, I rate the tool an eight.

The product's document says that Forinet FortiWeb can detect zero-day attacks, but it needs more devices like FortiSandbox for help. Fortinet FortiWeb needs to be integrated with FortiSandbox. I think it is Fortinet's strategy to upsell other tools because Fortinet doesn't want to put the solution in one box or one device. If you want another feature, Fortinet wants you to buy another box.

I rate the tool an eight out of ten.

I use the solution in my company to make web applications more secure because we have a special portal or web interface that we have to make secure for cybersecurity and different accesses. We found that FortiWeb Web Application Firewall (WAF) works fine for such use cases.

The tool's most valuable feature is the web access it offers. We control every access, like who goes in and what they do.

The tool's price and performance are areas of concern where improvements are required.

I have been using FortiWeb Web Application Firewall (WAF) for three years.

It is a 100 percent stable solution. Stability-wise, I rate the solution a ten out of ten.

My company has three customers using the tool. One of the customers has 1,00,000 users.

My company manages the technical support with around four people, so it is not a complex process for us to handle. In general, the tool's support team is friendly.

The product's initial setup phase was easy.

The solution's deployment needs a bit of time because we have to discuss it with the deployment team, which consists of software. The project keeps growing and changing daily, so if the people involved in the deployment make new software, we have to change something. It is an easy process and can be managed in around two weeks by one person.

The tool is really expensive. In our company, we could do a lot more, but the price is always a point covering areas like why we need one, whether it is important to discuss, why it is so expensive and so on.

Speaking about the licensing model, people need to opt for a subscription-based model. My company likes to have a subscription for at least three or five years because, otherwise, you have to renew the license. Managing the licensing part for one person can also be very complex.

The solution helps protect our company's web applications against common threats up to 99 percent. We feel very safe with the tool.

Speaking about how the tool has effectively mitigated web security threats for an application, I would say that it is an application behind the web portal, so there are about a hundred or thousand people who can access a website. If it is a sensitive application, and we have to watch every access to it to make it really safe, that is the reason why we need WAF on the application.

My company doesn't use AI with the tool.

I recommend the product to others. I would say that others need to have it if they have a shopping website or something similar. I know it is hard to sell because we find it quite hard whenever my company tries to do so.

The solution offers 100 percent integration with other Fortinet security products.

The ease of policy configuration in the tool is okay.

I rate the tool a nine to ten out of ten.