FortiGate is Fortinet's next-generation firewall, protecting your network perimeter. FortiWeb is a separate web application firewall built to protect the web applications you host, catching threats like SQL injection and cross-site scripting that a standard firewall isn't designed to inspect for. FortiWeb doesn't come loaded on a FortiGate. It's licensed and deployed on its own, whether as hardware or, in the VM08's case, a virtual appliance on your own infrastructure.

The VM01, VM02, VM04, and VM08 all run the same FortiWeb engine. What changes is the vCPU allocation and resulting throughput. The VM08 is the top of the line, supporting 2 to 8 vCPUs and up to 3 Gbps of protected throughput, roughly six times the VM04's ceiling. It's built for organizations with high-traffic or business-critical applications that outgrow the lower tiers.

The VM08 deploys on VMware, Microsoft Hyper-V, Citrix XenServer, Open Source Xen, VirtualBox, and KVM, and it's available in every major public cloud, including AWS, Azure, and Google Cloud. It uses the same FortiWeb engine and configuration whether you run it on-premises or in the cloud.

A FortiGate handles network-layer firewall, IPS, and application control, but it isn't a substitute for a dedicated web application firewall. If you're hosting web applications and need protection against exploits like SQL injection or cross-site scripting, FortiWeb is the product built for that job, and it can run alongside your existing FortiGate.

The FortiWeb VM08 is available with 1, 3, and 5-year subscription bundles that include FortiCare support, the FortiWeb Security Service, and IP Reputation. Firewalls.com can help you pick the term and bundle that fits your renewal cycle.