We checked OCI WAF, Microsoft Azure WAF, Google Cloud Armor, and Fortinet FortiWeb. We also checked other WAF solutions such as Akamai and CloudFlare but didn't do a PoC with them. We did a PoC with OCI WAF, Microsoft Azure WAF, Google Cloud Armor, and Fortinet FortiWeb.

We went for Fortinet FortiWeb because we wanted a single solution that can be implemented anywhere. If we use Azure WAF, it would be hard to use in GCP. We have to create a connection between both, whereas we can implement Fortinet FortiWeb on any cloud. If we have on-prem applications, we can implement FortiWeb hardware as a solution. In some places, we have strict requirements. If it's a VMware data center, they also have the FortiWeb VM solution. If we want to use Docker images, they also provide Docker images. We can just use a single tool. We are not dependent on multiple tools.

We also use F5. What happened is that we used Check Point as well. So when we replaced Check Point, we were offered this product with FortiWeb. So, we use it for some websites, but we have another solution we use for web applications. We want to test how FortiWeb works before potentially replacing F5. That's the advantage. We offered to use it with that POC first, and then we rolled it to a few of our websites since we have many different websites in the organization.

In my personal experience, F5 gives us more flexibility to do whatever we want. Fortinet FortiWeb is very restricted. We have templates and some profiles, but there's limited customization. 

F5 is a more open platform. You can customize how you want to handle requests and what you want the device to do. FortiWeb is an easy solution to implement; F5 is not as easy. 

I find F5 easy because I've been working with it for a long time. If you're a newcomer without experience, it would be easier for you to get FortiWeb working than F5, definitely. There are limited options with FortiWeb, and there's not much you can configure incorrectly. So it's easier in that sense – you go next, next, next, and it works.

To summarize my personal opinion, I see FortiWeb as targeting people who don't want to spend a lot of time configuring or customizing. If you need something quick and not very customizable, FortiWeb is an option. You don't need people with lots of experience with it because there aren't many choices. It seems, and this is again my personal opinion, that the people who designed FortiWeb are the same people who designed their firewall, which makes sense.

With the Fortinet NG firewall, you have a GUI to allow traffic from point A to point B – anyone can do this from the get-go. It's the same concept with FortiWeb, but it's very limited in what you can do. It's restricted, so it's ideal for somebody who just has a classic website without many options and they have average clients accessing it from the Internet. You don't have many options to make a mistake. But for our organization, and others with in-house developed products, you need something more flexible.

Fortinet won't cut it if you need people to come in and log in to trade stocks or exchange data using custom-built clients. You want to restrict and control these things. You have to go with something like F5 because it gives you that flexibility. With F5, you can capture a packet and rewrite it – it's programmable. You cannot do that with Fortinet.

Another limitation is with load balancing. FortiWeb gives you limited options, good for someone who has three or four servers and wants to load balance between them. F5 has a plethora of load-balancing algorithms, plus you can create your own.

To give examples, we have applications with a set of servers in different sites. We use geolocation, but also user behavior. Based on where the user is coming from and what they do on the site, we direct them to different servers. Fortinet FortiWeb doesn't have that flexibility, F5 does. Those are the main differences from my perspective.

So, FortiWeb is good for somebody who wants something to turn on, doesn't have a lot of experience, and just needs to protect a couple of servers behind a load balancer. If something goes wrong, troubleshooting is easier, and you can raise a ticket with Fortinet. With F5, you need to go deeper into troubleshooting code if you have complex configurations.

FortiWeb is good for classic websites. We do use it for situations like a couple of servers, or three or four servers – even seven in certain data centers – where we need to load balance between them, protect them, and have web access from the internet for public access. Your average users and average requests, it works fine. You turn it on, you don't touch it, and it works fine. But if we want something with a lot of products that we develop in-house, you can't do all these things. You need different load balancing algorithms because of specific use cases.

For example: We also have users uploading a lot of data. We can't just put them with many other users because they cause congestion. So, we need to load balance them – when they do normal requests, send them to the regular servers, but when they do bulk data transfers, we want to send them elsewhere. We need to do this, and these requests come from the same users on the same webpage, but they're clicking a different button. So we need to intercept that and say, "Oh, now the user wants to do this, let's send them there."

I'm the network team lead, so I assessed and deployed FortiWeb. I looked at several options. I knew the Fortinet brand but was unfamiliar with FortiWeb WAF. After researching it, I recognized that it was potentially a product that we could use. I did a demo and found that it ticked all the boxes.

F5 Advanced WAF includes more features and scalability than the solution but is very expensive. With an unlimited budget, F5 is the better choice.

The solution includes many of F5's features but is inexpensive. 

I had a look around, but I didn't test anything else. Fortinet was the first one that I did testing with and it met all my criteria, so I figured, "Why waste time looking at some others when this does the job?"

We have evaluated a number of solutions, such as Citrix NetScaler.

I'm exploring two or three products right now. We did not evaluate anything before choosing this product.

There are many security constraints that cannot be fulfilled by native cloud firewalls such as Azure and AWS. 

For example, AWS has a limitation of 8GB with regard to request values. 

We recommend the solution and its next-generation capabilities including ease of configuration, code being contained within the IIC engine, how templates and terraforms are handled, and superior wave and firewall security.

We are continually conducting research on next-generation firewalls because the solution can be a bit expensive.  

We didn't evaluate any cloud-based products. We've used Cisco products and Meraki products in the past, but they all were hardware products. When we were looking for a software solution, I had gotten a recommendation for the product from another person I worked with in the past. That person was using it and mentioned to me that I should give it a try. That's how I got into it. It was through a referral. Once I got it and tested it, it seemed like a pretty good product for what we needed, so that's how we went with it.

We thought about other options, however, since we had a very good experience with the FortiGate Firewall, I decided to buy FortiWeb. They operate well together. 

We didn't really look into other options as my boss is pretty well versed in other options. However, we are always looking into comparisons. 

The only other two web application firewall products that are available in my country are F5 and Imperva.

We evaluated machine learning and the main signatures about known attack signatures.

We have also tested other products such as Imperva and F5, and the most number of likes were for F5 and FortiWeb.

Since we were using FortiGate firewall, we decided to look at FortiWeb. We also looked into several solutions, like Check Point and Palo Alto.

We also evaluated Cisco and McAfee.

I have used firewalls that I find easier to manage, configure and troubleshoot. However, the Fortinet firewalls are pretty good, and in terms of value for money, they are outstanding.

Pros: Cost for performance, very feature rich, GUI is pretty good.

Cons: Debugging is not as good as I find Cisco ASA. CLI is overly complicated by all syntax showing in the configuration. The GUI is not as nice as CheckPoint or Palo Alto.

We also looked at Software CTM. It was impossible to use compared to FortiWeb. 

We did PoCs for other WAF products such as Citrix, F5 and Barracuda before finalizing on FortiWeb for our enterprise, which satisfied enterprise requirements.

Prior to implementing FortiWeb, we tested Barracuda, F5, Citrix, and Sophos.

For new projects this year, we evaluated Imperva and Barracuda. The latter can be a good option for entry-level deployments, but is hard to surpass Fortinet products.

When our customers ask about Palo Alto we can sell them a Palo Alto but we try to explain that Fortinet is a great solution. 

Before choosing this product, I did not evaluate other options.

F5, NetScaler, Imperva and Squid.

We also evaluated F5 and Imperva. Fortinet won because of its price. It has done its work for the last four years; the only problem that I have seen is the high false-positives rate which prevents us from focusing on the real attacks.

We have a lot of requests for Barracuda solutions from our customers. One of the reasons for this is that the pricing is cheaper by quite a lot.

We acquired a Fortinet-based project, so we didn’t evaluate other ones.

I have evaluated F5 and Citrix.

Before choosing this product, we did not evaluate other options. We had one of the smaller firewalls, and we upgraded to one of their bigger ones.

I've also looked at Palo Alto, and it has the specifications that we need, however, the pricing is quite high.

The WAF module of F5 was evaluated.

Not applicable.

Before choosing this product, we evaluated many products such as Cisco, Juniper, Cyberoam, and Sophos.

No.

Before choosing this product, I did not evaluate other options.

Before choosing this product, we evaluated Palo Alto, SonicWALL and Juniper.

I did not evaluate other options. This product was already implemented.