Web application Firewall - WAF policies limitation to 60 rules?

There is an updated doc:

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/WebServer/index.html 

You can create any number of WAF rules, but only 60 rules can be active simultaneously.

There is an updated doc:

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/WebServer/index.html 

You can create any number of WAF rules, but only 60 rules can be active simultaneously.

Yes - Seems like this note was removed in some migration process and now added again. 

PS: Just some thoughts about your setup. 60+ Webserver is a big junk of Applications. What do you try to achieve? What are those applications? 

Because there is a new kid on the horizon called ZTNA, which could potentially replace your WAF and give you more "features" and a better integration. 

ZTNA is a tool to implement internal tools to users. It is all about having a Agent or Agentless (HTTPS) applications for internal applications to "known users". So it does not replace a reverseproxy with malware scanning for a public website, but it likely replace a reverseproxy with FORM authentication. 

So are you going to implement the SFOS appliance for public servers or internal applications? I wrote some more thoughts about this new product here: https://community.sophos.com/utm-firewall/f/vpn-site-to-site-and-remote-access/130933/road-warriors---l2tp-over-ipsec-capabilities-for-split-dns-and-split-tunnelling-routing-mac-windows-built-in