Fortinet FortiWeb Reviews

I primarily use this solution for the protection of our applications. We chose Fortinet because you can check an application and deploy it in real time. We use the WAF solution from Fortinet to protect against new exploits discovered. Within Fortinet, there is a way to secure such bugs and exploits in the application we're running.

The most valuable feature in this solution is the ability to disseminate between the user entering some wrong value to the field, and a suspicious actor trying to exploit some known vulnerability. This part of the intelligence and behavioral analysis makes it very easy to tell if the user just used a few wrong characters in the field or not. It also checks to see if different characters are being entered very quickly, and can tell whether the user is actually typing something.

Another feature is the possibility to balance the traffic and there's lots of integration with your sandbox.

We would like to know more about the integration with the hardware or security products, such as Gemalto, because we need to move to that point. But, from what I understand, we haven't looked at the market to see how this can be done yet.

In terms of stability, we haven't had a crash or malfunction.

We've used the solution for two years and it's been okay.

We are operating at approximately sixty percent capacity. The solution is used all the time, but you can measure this because there are different boxes that you can buy for different levels. In our case, we keep some at thirty to forty percent available. In order to be able to watch an application and protect a larger amount of traffic, we keep it at this level. So we're good on this scalability or performance side.

We haven't had any technical issues, because it was designed as specified in the documentation. I know we have local support, so if there is an issue we can call and escalate the call to get the support if there is a problem. We are within the warranty service period, so from this side, we are comfortable with this solution.

We did use another solution, but, compared with the competition, we got the best ratio of performance to price when we chose Fortinet. We could use F5, for example, but the price is not as good.

The setup for one application is sort of complex but based on the automatic profiling, they're learning. You are provided with a set of policies that meet best practices and security recommendations, so you are good to go in a very short time.

We did the implementation ourselves. It was not required to have some higher level of expertise order to implement. There were no functions that were not documented, so we didn't need any outside party involved with this process.

The solution gives us the best price to performance ratio.

The interface has been a pain in the past but now with the later version, 2.2, the user behavior analysis has improved. Before when you want to deploy an application, for example, you needed to have a login page and make sure to search for the user behavior and all the interactions. That way, you could generate flexible usage for that application. Now that's automated, so apart from that, there's no huge report or feature that we would like to improve.

I would rate this product a ten out of ten.

Publishing Web application, Exchange, Lotus Domino. Some microservices. 

Fortiweb improved way people work and access internal resources based on http/https communication. 

It depends on the project and what the customer is looking for. 

First of all, upgrade path should be introduced for scaling up or down VM deployment. Second, they need to include better wizards for publishing common applications like MS Exchange. 

.

Fortinet FortiWeb has been extensively used by us previously, but we are going to decrease the usage now because of cost. 

Fortinet FortiWeb is scalable but you have to do forklift upgrades. 

Fortinet has had some rough times. When they started expanding a bit, they completely screwed up their support system. The support had no clue what they were doing except just asking dumb questions. Now is bit different since Fortinet consolidated their support but still you need to pass L1 support quickly. 

Even from the early days, Fortigate/Fortiweb was easy to set up. It had an ugly interface but it has been improved every year. 

I deliver different security solution to customers. 

The license cost depends on the size of the box or the size of the solution. It can go from few K Euros to a few hundred thousand Euros a year depending on your size.

If you are looking to be partner with Fortinet, you have to buy licenses. Not even VMs are free to partners.  

Fortiweb in essence, needs to become part of Fortigate. Fortinet is not suitable for SMB customers since you have to deploy several boxes in order to get thing right. Also, speed of deployment is important and that isn't fast with many boxes. 

On a scale from one to ten, I would rate this product a solid seven. It's a good product. 

All of our customers use it because they need a proxy solution. Fortinet provides us the best solution to do this. I don't believe that Check Point or Palo Alto can do what Fortinet does. 

There's a high school with many branches in our country. I configured it for them and they are very happy with Fortinet. Fortinet's performance is very good. 

All the features that FortiGate contains are very suitable for our business. We work with other products in Fortinet: FortiWeb, FortiSandbox, FortiMail, and FortiCache. We use all UTM features like self-encryption, encryption, all UTM features.

New releases and old releases have some bugs, some features do not work as good as we want but every new release the Fortinet team fixes up problems. I don't have anything to say about what to do to improve this product. It's a great solution for us.

Scalability is very good. Our customers that use Fortinet have two thousand local users.

Any problems that our customers have, they first call me and I support them. If I can't solve a problem I create a ticket. This happens very rarely. Their technical support is very good because they always help me.

The initial setup is very simple to configure. Our customers are very happy with that.

The time it takes to deploy depends on how deep our project is. Sometimes it can take a week and sometimes a month. Minimum a week though.

All Fortinet products that we sell, I deploy by myself.

The licensing policy is very good. Our customers are very happy with that.

When our customers ask about Palo Alto we can sell them a Palo Alto but we try to explain that Fortinet is a great solution. 

I would rate it an eleven out of ten. 

Our primary use case is as a firewall. We use a lot of Fortinet products. We have email security and FortiGate IPS. 

When we had Cisco we had around thirty thousand entries on our firewalls. Now we are down to three thousand. Fortinet has a mechanism to detect all of your entries which are not used, and it can clean it up.

The most valuable features are the access policies and how Fortinet gets the compilation done is really good.

I would like to have an antivirus option. 

Stability is very good. 

We haven't had any issues with scalability. You can scale up easily. 

Their technical support is good. 

We previously used Cisco. We switched because all they are is a brand name. It was a failure. We gave it a year to improve the product and it didn't so we switched. 

The initial setup was straightforward. The deployment didn't take much time. The support guys were really good. The transition from Cisco to Fortinet was a bit challenging but they had tools to make it easier. 

We require three staff for the deployment and maintenance. 

We are the resellers. 

I would rate it a seven out of ten. A seven and not a ten because of the antivirus issue. 

We are a system integrator so we propose FortiWeb to our clients who are looking to protect their public web applications like e-banking platforms, teleservice, and so on.

A customer said to us that before FortiWeb they regularly had to back up their whole website folder to prevent defacement and ransomware. Now, with the FortiWeb Anti-defacement feature, this process is handled more intelligently, as FortiWeb does it for them.

Security Fabric integration. This is really a value-added feature as FortiWeb can interact with the rest of the client’s Fortinet pack to provide an intelligent security layer like (FortiSIEM for central log management and correlation, FortiGate, FortiSandbox for malware analysis, etc.).

FortiWeb does not exist in a cloud-based form. Its only available for deployment as a virtual appliance on AWS and Azure IaaS platforms. Because of the trend to WAF environments, it would be good to have it as a SaaS. Also, FortiWeb would be more competitive if it combined WAF and DDoS protection.

I rate FortiWeb at eight out of 10 because it is good at what it does but I think it could do more, like combining DDoS protection.

Fortinet FortiWeb has improved my organization by protecting our customers' web infrastructure environment.

The most valuable feature is the web application firewall (WAF).

Their support needs improvement.

No stability issues.

No scalability issues.

I would rate their technical support as a nine out of 10.

We previously used NetScaler.

The initial setup was straightforward.

The pricing is reasonable.

Not applicable.

Evaluate this product against other vendors out there.

We were previously a partner.

We were able to protect our web servers from outside attacks. It has really helped us with publishing servers which were published on Microsoft Forefront TMG.

All of its feature are valuable to us. If you ask me which is the most valuable, it is the load balancing, then I would say the security features. Publishing OWA is also a good feature.

We started with FortiWeb400C, then we did an upgrade to FortiWeb 400D. I had some small problems when I was upgrading firmware. After the upgrade, some of my certificates were deleted.

The false positives are also annoying.

We did not encounter with any stability issues.

We did not encounter with any scalability issues.

Fortinet technical support is really good. I would give them a nine out of 10.

We did not use a WAF before. We used Microsoft TMG, but it is not a WAF.

Initial setup is straightforward, and it is not too complex.

It really pays off to buy licences for multiple years.

No.

It is a really good product. It is worth using in your network.

Other than the additional security with exploit protection, we have simpler certificate handling, as we can keep internal servers using internal certificates continuously distributed and updated by Active Directory Group Policy, while the public certificates become updated only in a single place, FortiWeb itself.

SSL Offloading, as it simplifies the public certificate handling and brings additional protection features. 

Also, L-7 protection, as it makes possible to protect legacy/not up-to-date servers/applications without changing the application code.

• Centralized management of multiple devices, and GUI improvement, could reduce the learning curve. 
• The interface could have the interdependent elements arranged sequentially and wizards that go through most common deployment actions. 
• Centralized configuration using FortiManager – like what exists for NGFW FortiGate appliances - would improve the configuration.

No issues with stability.

No issues with scalability. (Actually, our traffic usually does not reach 50% of unit capacity).

Good. Usually takes one day to get over all the assessment procedures to start to handle the issue.

The previous vendor discontinued its product.

A little bit complex, as understanding the GUI arrangement and terms took more time and effort than we expected.

Keep a loose margin between your actual bandwidth and the product sizing when using hardware appliances. Only virtual machines are upgradable to larger sizes.

We acquired a Fortinet-based project, so we didn’t evaluate other ones.

I rate it eight out of 10. I understand that a 10 is for products that not only execute smoothly but are also easy to use and manage, even when used on a multi-site corporation.

Take at least the Fortinet online course, or make sure that your reseller has experienced professionals.

Security.

• Web application security features, because they are more effective
• Stability 
• Auto Learn feature: Makes policy additions or deletions for my customers very simple

HA Architecture. I would improve it by working on AP HA.

No issues with stability.

No issues with stability, with the true network topology.

I am Fortinet expert, but L4 support is working very well.

Previously used F5, NetScaler, Imperva. Other products feature LB WAFs, so a limited WAF feature. This product's primary feature is WAF. I chose this product because it prioritizes security.

Very complex. More security features.

Cheaper than others.

F5, NetScaler, Imperva and Squid.

Here's how I would break down my rating of this product:

• Session Management: 10 out of 10 
• Security: 10 out of 10 
• Stability: 10 out of 10
• Health check feature: eight out of 10.

If your goal is security, FortiWeb is your best choice.

Mitigation of attacks and thefts in an online banking platform.

High-performance and detection engines, because of their high rate of exposure of web attacks.

Integration and learning about attacks. I would improve these areas by making FortiWeb integrate with other network technologies and feedback from multiple platforms.

No issues with stability.

The equipment is dimensioned as a function of servers traffic. To scale on the platform it is necessary to acquire superior models.

Excellent.

It was simple and functional.

FortiWeb can be purchased in VM mode for a lower price and the same features.

The WAF module of F5 was evaluated.

FortiWeb is easy to operate with a reasonably high level of protection. FortiWeb provides multiple deployment options with a physical or virtual (FortiWeb-VM) appliance, and acts either as a reverse/transparent proxy or out-of-band. It is also available on AWS and Azure.

I would advise requesting a PoC test with a learning policy.