As Enterprises continue to rearchitect their WAN Edge with rapid migration of applications to the cloud, the attack surface at the remote sites/branch locations continues to increase. This risk is especially high for web-based traffic, as web-based threat continue to be one of the primary attack vectors. As attack techniques become more advanced and versatile, organizations need an integrated approach to secure against external and internal risks. Fortinet's secure web gateway provides flexible deployment options to protect against internet-based threats without compromising on end-user experience.
Secure Web Gateway (SWG) solutions use web filtering to enforce company Internet access policies. They also filter unwanted software, especially malware, from user-initiated Internet connections.
SWGs are hugely important as enterprises have continued to evolve their WAN Edge. Applications are rapidly migrating to the cloud, and the attack surface at remote sites and branch locations continues to increase. Security risks are especially high for web-based traffic, and as attack techniques become more advanced, organizations need an integrated approach to secure against external and internal risks.
An SWG solution should include URL filtering, application control, deep HTTPS/SSL inspection, data loss prevention and remote browser isolation capabilities. SWGs are increasingly popular, and the overall web gateway market is expected to reach $4B by 2023.
Fortinet's SWG provides flexible deployment options, including explicit, transparent, and inline modes, to protect against internet-based threats without harming end-user experience.
SWGs prevent malware infections, block access to malicious websites and applications, and enforce company compliance policies, especially at branch offices and for remote workers.
SWGs are similar to firewalls in that they both can discern malicious Internet traffic from benign traffic, and both provide advanced network security protections. Firewalls function at the packet level. The primary role of SWGs, however, is to identify and protect against advanced attacks by inspecting web traffic at the application level—without compromising on overall web experience.
A fully integrated enterprise security strategy requires both SWGs and next-generation firewalls (NGFW).
Traditional web proxy tools manage how traffic passes between an organization’s internal endpoints and the Internet. Over time, organizations have embraced Secure Web Gateway solutions to offer a more advanced set of capabilities beyond what traditional proxy alone can offer.
|
FortiGate SWG protects against web attacks with URL filtering, visibility and control of encrypted web traffic via SSL inspection, and application of granular web application policies. This demo walks through several key use cases: How to block malicious web pages using FortiGuard Web Filtering, How to enforce Acceptable Use policy, How to enforce DLP policy, and How to utilize Browser Isolation with SWG.
Watch NowFortinet Secure Web Gateway defends users from internet-borne threats and helps enterprises enforce policy compliance for internet applications. With FortiGate SWG, you can deploy industry-leading Fortinet Next-Generation Firewalls as a proxy.
FortiGate SWG consolidates NGFW and SWG services, helping enterprises manage their network security solution with ease. It supports all proxy deployment modes and uses multiple detection techniques such as web filtering, DNS filtering, data loss prevention, antivirus, intrusion prevention, and advanced threat protection to protect employees from internet threats.
FortiGate SWG is best suited for enterprises looking to consolidate network security services and optimize the workload of security teams.
Enterprises can also adopt FortiProxy, a dedicated Secure Web Gateway solution. Among many benefits, FortiProxy offers integration with FortiGuard Threat Intelligence services—continuously updated threat intelligence used to enhance DNS and web filtering, intrusion prevention, dynamic analysis using sandboxing, antivirus and DLP, and content analysis.
SWGs keep enterprise networks safe from malicious Internet traffic, preventing threats from entering the network and causing an infection or intrusion.
Critical SWG features such as SSL inspection are increasingly necessary to protect enterprises, especially with more than half of all attacks and malicious Internet traffic today using encryption.
Feature-rich product that consolidates NGFW and SWG services
Powerful hardware that can perform SSL deep inspection
Anti-malware techniques updated with the latest threat intelligence
Reduce security team’s workload by providing a single pane of glass management for both NGFW and SWG
Effectively remove blind spots in encrypted traffic, without compromising on performance
Stay protected against the latest known and unknown internet-borne attacks
SWG is available in different form factors with many different models to choose from to meet your needs ranging from hardware appliances to VM options that be deployed in your datacenter.
Throughput |
9.5 Gbps |
Ports |
8x1GE RJ45, 8x1GE SFP, 2x10G SFP+ |
SSL Inspection |
8 Gbps |
Throughput |
5 Gbps |
Ports |
2x 10 GE SFP+, 10x GE RJ45, 8x GE SFP |
SSL Inspection |
6.8 Gbps |
Throughput |
6 Gbps |
Ports |
16x 1GE RJ45, 16x 1GE SFP |
SSL Inspection |
4.8 Gbps |
Throughput |
4 Gbps |
Ports |
2x 10 GE SFP+, 10x GE RJ45, 8x GE SFP |
SSL Inspection |
6.8 Gbps |
Throughput |
5 Gbps |
Ports |
2x 10 GE SFP+, 16x GE SFP, 18x GE RJ45 |
SSL Inspection |
4 Gbps |
Throughput |
6 Gbps |
Ports |
4x 10GE SFP+/GE SFP, 16x GE SFP, 18x GE RJ45 |
SSL Inspection |
6 Gbps |
Throughput |
7 Gbps |
Ports |
8x 10GE SFP+/GE SFP, 16x GE SFP, 18x GE RJ45 |
SSL Inspection |
10.5 Gbps |
Throughput |
9 Gbps |
Ports |
6x 10GE SFP+, 34x GE RJ45 |
SSL Inspection |
12.5 Gbps |
Throughput |
9 Gbps |
Ports |
10x 10GE SFP+, 2x 10GE SFP+ bypass, 34x GE RJ45 |
SSL Inspection |
12.5 Gbps |
Throughput |
22 Gbps |
Ports |
16x 10GE SFP+/GE SFP, 2x GE RJ45 |
SSL Inspection |
19 Gbps |
Throughput |
24 Gbps |
Ports |
48x 10GE SFP+/GE SFP, 2x GE RJ45 |
SSL Inspection |
20 Gbps |
Throughput |
20 Gbps |
Ports |
4x 40GE QSFP+, 20x 10GE SFP+/GE SFP, 8x SFP+, 2x GE RJ45 |
SSL Inspection |
24 Gbps |
Throughput |
2.5 Gbps |
| Ports | 1 / 10 (Minimum/Maximum) |
Throughput |
4.5 Gbps |
| Ports | 1 / 10 (Minimum/Maximum) |
Throughput |
9 Gbps |
| Ports | 1 / 10 (Minimum/Maximum) |
Throughput |
16.5 Gbps |
| Ports | 1 / 10 (Minimum/Maximum) |
Actual performance may vary depending on the network and system configuration. Performance metrics were observed using a DELL R740 (CPU Intel Xeon Platinum 8168 2.7 GHz, Intel X710 network adapters), running FOS v5.6.3. Tested with VMware vSphere 6.5 Enterprise Plus. SR-IOV is enabled. 1. IPS performance is measured using 1 Mbyte HTTP and Enterprise Traffic Mix. 2. Application Control performance is measured with 64 Kbytes HTTP traffic. 3. NGFW performance is measured with IPS and Application Control enabled, based on Enterprise Traffic Mix. 4. Threat Protection performance is measured with IPS and Application Control and Malware protection enabled, based on Enterprise Traffic Mix.
Model |
FortiProxy 400E |
License Capacity |
500-2,500 Users |
Ports |
4x GE RJ45 |
Model |
FortiProxy 2000E |
License Capacity |
2,500-25,000 Users |
Ports |
2x 10 GE SFP+, 2x GE SFP ports, 2x GE RJ45 ports |
Model |
FortiProxy 4000E |
License Capacity |
15,000-50,000 Users |
Ports |
4x 10 GE SFP+, 2x GE SFP ports, 4x GE RJ45 ports |
Model |
FortiProxy VM |
License Capacity |
25-25,000 Users |
Ports |
1 / 10 (Minimum/Maximum) |
FortiGate SWG employs multiple FortiGuard services to protect users against the latest web threats and to enforce compliance. One of the key services is FortiGuard Web Filtering, which is the only web filtering service in the industry that is VBWeb certified for security effectiveness by Virus Bulletin.
Effective best-in-class security requires timely, global intelligence combined with fast decision-making and response across all critical vectors. Fortinet offers proven and one of the most certified artificial intelligence-driven protection available in the market today powered by FortiGuard Labs.
For customers implementing FortiGates as NGFWs, here’s how FortiGuard subscriptions can help:
Mission critical security-driven networks deserve the best support available. FortiCare provides 24x7 support options to help keep your FortiGates up and running. We also have services to help you recover in the rare moments when bigger bumps seem to come out of nowhere such as our Premium RMA options with 4-hour replacements.
Want faster resolution? Choose our Advanced Support option.
Need help to get going with new deployments and integrations? FortiCare can do it, too, with Professional Services and Resident Engineers! Contact Sales to find out how.
With the increase in SSL web traffic, zero-day malware and growing number of social websites, enterprises are turning to secure web gateway to protect employees from internet-borne attacks.
This demo lets you explore the key Secure Web Gateway features such as SSL Inspection, DNS and Web Filtering, Web Application Control, Authenticated Web Access and Detailed Reporting.
We recently migrated to Office 365 and our proxy can’t handle the traffic. Can FortiGate SWG be used?
Yes, this is one of our common deployments. FortiGate SWG has powerful hardware, and custom-built ASICs to provide high performance. It can also enforce Office365 tenant restrictions and inspect SSL traffic .
Can FortiGate SWG be deployed in explicit proxy mode?
FortiGate SWG can be deployed in all proxy modes. It includes explicit proxy and transparent proxy for large enterprises, and inline proxy mode for smaller enterprises.
How is FortiGate SWG licensed?
Unlike other SWG vendors, FortiGate SWG is not licensed per user. You pay for the hardware and security services such as web filtering, antivirus, IPS, sandboxing, CASB and application control. This significantly reduces the total cost of ownership.
What are the use cases supported by FortiGate SWG?
FortiGate SWG supports all common authentication methods such as RADIUS, Active Directory, LDAP and SAML.
What techniques does FortiGate SWG use for malware prevention?
FortiGate SWG always receives the latest security protection from FortiGuard Threat Intelligence Service, that collects threat data from more than 200,000 live deployments. Numerous techniques are used for malware prevention such as AV, website reputation analysis, sandboxing and DLP.
Does FortiGate SWG work with other Fortinet products?
FortiGate SWG is part of the Fortinet Security Fabric; integrating with FortiClient for endpoint protection, FortiCWP for cloud applications protection, FortiSandbox for advanced protection, and FortiManager and FortiAnalyzer for management.