Fortinet FortiWeb Reviews

Fortinet FortiWeb is known for its web application firewalls. We are using it for preventing and detecting layer 7 attacks such as SQL injection.

We have several web applications in our organization and we use this solution to protect them against attacks.

It's stable and works efficiently against OWASP Top 10 attacks.

It's good at checking IP reputation and it's capable of detecting Layer 7 DDoS attacks.

Overall, it has many features.

The Layer 7 DDoS attacks need improvement, it could be better. When you compare it with the F5 solution, FortiWeb is weak in detecting the Layer 7 DDoS attacks. At times, it generates several false positives and there should be fewer.

In the next release, I would like to see better DDoS protection. It's an essential feature that should be included.

I have been using Fortinet FortiWeb for more than five years.

We are using the 4000D model.

It's a stable solution and we run it 24/7. In the past five years, we have had four cases where there were some inconsistencies with the firmware. There are times where we experience crashes because of issues with the firmware.

It's not easy to scale this solution. It has a determined throughput and if your throughput is more than it should be then you have to use another solution or purchase another FortiWeb model.

We have less than 10 people using this solution on a daily basis.

We are not able to use international support because of US sanctions. We use a consultant to help us troubleshoot.

Previously with another company, we used ModSecurity, which is an open-source solution. FortiWeb is better.

If I compare with F5 solutions, I would suggest F5.

The initial setup was not easy but not exactly complex.

We maintain the system ourselves.

We completed the initial setup ourselves and we had a consultant help us with some of the features. It was a hybrid implementation.

It's an expensive solution, although there are no additional costs.

In my opinion, F5 is the best solution in the world, whereas Fortinet FortiWeb would be second.

I have heard that Barracuda is a good solution, but I have not worked with it. In my experience, F5 is the better solution.

I would rate Fortinet FortiWeb a seven out of ten.

I initially deployed it for my company, but now I administrate it for a client.

We use it to secure VMs and applications in Azure. It protects against DDoS attacks.

It's very user-friendly.

There is room for improvement in the support. The response time could be faster. Plus, they ask for a lot of information. It is not easy to get support. 

In future releases, I would like to see added antivirus features that provide user-based activity indicators. For example, if a user downloads a large number of files or connects frequently, the WAF could flag this activity for investigation.

I have been using it for three months now. 

It is a stable solution. 

It is a scalable product. 

For some initial issues. It's good, but not during the first year. FortiWeb could improve response time and first-level support clarity.

Positive

The first implementation with an expert took two hours. My solo attempt took three weeks.

Take time to test it thoroughly. Consider buying an existing solution if needed.

Overall, I would rate the solution an eight out of ten. 

We use FortiWeb for protecting web applications.

The product has a very user-friendly dashboard.

The software's support services could be better compared to Sophos.

The product's scalability could be better compared to Sophos.

It is challenging to communicate with the FortiWeb's support team.

We use Sophos as well.

FortiWeb's configuration process is more difficult than Sophos. I rate the process a one out of ten.

The product is expensive. I rate the pricing a ten out of ten.

I rate FortiWeb a five out of ten.

We use FortiWeb Web Application Firewall to protect websites from injection attacks.

FortiWeb Web Application Firewall blocks attacks from application layers and provides protection.

FortiWeb Web Application Firewall's signature database updates could be improved.

I have been using FortiWeb Web Application Firewall for one year.

I rate FortiWeb Web Application Firewall an eight out of ten for stability.

I rate FortiWeb Web Application Firewall a nine out of ten for scalability. Around 10 to 12 users use the solution in our organization.

The solution’s customer support is not good.

Positive

The solution’s initial setup is easier than other products.

It takes one week to deploy FortiWeb Web Application Firewall. As part of the deployment process, we create a FortiGate interface, connect FortiWeb to our website server, create virtual web servers in FortiWeb, and write some access control rules for protection purposes.

FortiWeb Web Application Firewall's pricing is suited for small or medium organizations.

FortiWeb Web Application Firewall is deployed on-cloud in our organization.

I recommend FortiWeb Web Application Firewall to other users because it helps block many attacks that come from the web and application layers. Using the solution to protect organizations from attacks is an easy process.

Overall, I rate FortiWeb Web Application Firewall a nine out of ten.

It helps us prevent attacks on servers, and we deploy it on-premises.

There are many valuable features. It has machine learning, artificial intelligence, behaviour detection, and many other features capable of detecting web attacks.

The initial setup could be simplified.

We have been using the solution for approximately ten years.

The solution is stable.

The solution is scalable.

We do not have experience with customer service and support.

The initial setup is complex and takes between three to six months.

We implemented the solution in-house.

Fortinet FortiWeb has some types of licenses, and the main licenses refer to updating a signature and a pattern.

We evaluated machine learning and the main signatures about known attack signatures.

I rate the solution a ten out of ten, and I recommend it for every organization with web services.

We use this product for load balancing and for their firewall. We are partners with Fortinet. 

I like that the GUI makes it easy to scale in terms of learning and utilization.
We chose this solution based on the online training and materials they offered. It's easily available on the web. 

There are specific functionalities that I'd like to see improve and that would basically bring it into line with what is being offered by solutions such as F5 and Imperva.

I've been using this solution for five years. 

This is a stable solution. 

The initial setup is straightforward, the deployment took us about two hours. We currently have 16 users. 

I rate this solution seven out of 10. 

We use the solution to protect the various services of our site, E-commerce, file service, and download service.

The most important feature of this solution is protection from an attack.

The maintenance fee for this product could be improved and it needs to be easier to scale up. 

I have been using the solution for four to five years. 

Stability is very important and yes, the product is stable.

The solution is not very scalable, to scale up would require another deployment with a new appliance and a change to the network.

I would say technical support is good for this solution.

Setup for this solution is easy, with one being easy and five being hard I would rate it a two out of five. Deployment took a few days. 

We have between 100 and 200 users of the solution in our company. 

I would rate the solution a six out of ten. 

The support services, performance, and pricing are all valuable features. The performance is excellent.

The initial setup process could be improved.

I've been working with this solution for two years.

It is deployed both on-premises and on the cloud.

In general, we have small projects, so the scalability has been fine for our clients.

As for users, we have, in general, 50 to 100 clients.

My colleagues at the network operations center have contacted technical support. I would rate technical support at eight on a scale from one to ten.

Positive

We sell and work with several options, but we feel comfortable with Fortinet FortiWeb because the performance and feedback are great.

In general, the initial setup is easy, and I would rate it at four out of five.

I deployed it myself.

There's only one payment for the duration of the license. On a scale from one to five, I would rate pricing at four.

I have not encountered any additional costs on my projects involving Fortinet FortiWeb.

I sell or presell, and in general, the feedback is great. In fact, I think that Fortinet FortiWeb is number one in terms of performance.

The most valuable features in Fortinet FortiWeb are sandboxing and threat prevention. 

In my experience, Fortinet FortiWeb could improve the intelligent features to acknowledge whether any threat or incident that's running happened. Then give us the ability to escalate it to layer 2 or layer 3 in the network operations.

I have been using Fortinet FortiWeb for approximately two years.

I have found Fortinet FortiWeb to be stable.

The solution is scalable, but it can only scale at a medium level.

We use the technical support from the system integration, not directly with Fortinet FortiWeb. It takes them a lot of time to solve an issue when we submit a complaint.

in Indonesia, we need more knowledgeable local support.

The initial implementation is simple and the configuration is straightforward.

The price of Fortinet FortiWeb is reasonable. This is one of the key factors of why we use this solution.

I rate Fortinet FortiWeb an eight out of ten.

We mainly use it for protection. OS scanning and load balancing are two of its main use cases.

My team is most probably working with its latest version. In terms of the deployment, lately, it has been on the cloud because the end-user-facing web applications are usually live on the cloud.

Banks have to be compliant with PCI and other things, and FortiWeb is absolutely amazing in terms of providing these reports. Otherwise, they will have to spend a lot of time on them.

The compliance piece is the best feature. Load balancing is also valuable, which is something that all web application firewalls do. Another valuable feature is high availability. You can scale it very well. Load balancing and high availability are the two reasons why we picked it for a couple of banks.

From the feature perspective, it is pretty rich. The automation piece can be improved. Although they say it can be automated very well, there is still manual work. Its usability should be improved in terms of automation because we want to build an infrastructure with code, but you can't do that easily with this solution. If they can give us APIs in the firewalls that we can tap into, it would be perfect. 

I would also like it to scale automatically based on the traffic.

I have been using this solution for about six years.

I've never seen any issues, but when you turn on all the features or every single scanning, that's when it slows down a bit.

It is scalable, but it is a roundabout way of automated scaling. It is not truly automated scaling. In general, when the size is okay, scaling is not a problem. I would like it to scale automatically based on the traffic, but that doesn't happen because automation is not there.

I haven't seen any big issues with performance. We ran 20,000 connections through it, and it was okay. When you deploy it in the cloud, you can increase the size of the VM, and with extra licensing, it is fine performance-wise.

It is suitable for medium and large customers. My team has deployed at least 500 of these in the last few years. In general, it's okay. We don't have any issue with it.

They have been pretty good, honest, and upfront. It all comes down to expectations when you buy these things.

I know the country manager very well. He is my friend for Fortinet. They are very good in terms of support. 

When you buy these things from a marketplace like Amazon or AWS, the support is not as good as it can be because the first line of support is the cloud provider, and then there is the vendor. So, our preference usually is to go directly to the vendor because they know more about it.

One of the best things about Azure Firewall is the automation. There is a huge difference. The second thing is pricing. 

With FortiWeb, when you want to buy HA, you need to start designing high availability across different regions. With Azure, it comes by default.

It depends on the customer and the use case. Usually, it's straightforward, but as you add more applications, it can become more and more complex.

The deployment duration varies. Usually, designing, building, and putting in production take about four weeks, but it also depends on the application type.

It requires maintenance all the time. Everything requires maintenance. Usually, we build it and operationalize it, and we then hand it over to the customer.

It keeps changing, but it's based on the size of the VM you buy and also the traffic throughput you want from it, whereas what we have on Azure is just the traffic throughput. You can also pay on a monthly basis from Azure. During each part of the project, it's okay to get Azure-based licensing or AWS-based licensing for FortiWeb, but over time, you would want to go with the perpetual license. You should go to Fortinet and buy the license from them. So, there is a two-step process there.

I would advise getting the right engineer. You need someone who is a specialist, and that's very important.

I would rate it an eight out of 10.