FortiGate is Fortinet's next-generation firewall, protecting your network perimeter. FortiWeb is a separate web application firewall built to protect the web applications you host, catching threats like SQL injection and cross-site scripting that a standard firewall isn't designed to inspect for. FortiWeb doesn't come loaded on a FortiGate. It's licensed and deployed on its own, whether as hardware or, in the VM04's case, a virtual appliance on your own infrastructure.

The VM01, VM02, VM04, and VM08 all run the same FortiWeb engine. What changes is the vCPU allocation and resulting throughput. The VM04 supports 2 to 4 vCPUs and up to 500 Mbps of protected throughput, more than the VM01 and VM02 tiers but less than the VM08. Pick the tier that matches your traffic volume and available hypervisor resources.

The VM04 deploys on VMware, Microsoft Hyper-V, Citrix XenServer, Open Source Xen, VirtualBox, and KVM, and it's available in every major public cloud, including AWS, Azure, and Google Cloud. It uses the same FortiWeb engine and configuration whether you run it on-premises or in the cloud.

A FortiGate handles network-layer firewall, IPS, and application control, but it isn't a substitute for a dedicated web application firewall. If you're hosting web applications and need protection against exploits like SQL injection or cross-site scripting, FortiWeb is the product built for that job, and it can run alongside your existing FortiGate.

The FortiWeb VM04 is available with 1, 3, and 5-year subscription bundles that include FortiCare support, the FortiWeb Security Service, and IP Reputation. Firewalls.com can help you pick the term and bundle that fits your renewal cycle.