F5 Silverline Managed Services Reviews

The major reason to use F5 Silverline Managed Services is to protect my applications and web application firewalls on my cloud applications and cloud-hosted applications that I want to protect. I am using F5 Silverline Managed Services only as a web application firewall.

What really stands out for me in terms of advantages of F5 Silverline Managed Services is that in a single cloud platform, I can protect my web applications against attacks. I can also use my load balancer in F5 because they are providing and acting as a load balancer too, and they will support the volumetric and DDoS attacks and malicious attacks.

Regarding the real-time threat intelligence feature, I do use this aspect in F5 Silverline Managed Services. It blocks malicious IPs or bad IPs for my server, protecting against my applications. For example, if someone is a bad actor trying to access via a malicious IP, I can block it because the threat intelligence has the capability to block the malicious IP.

The adaptable and flexible security impacts threat response time positively. It is effective because it blocks my malicious traffic. Whenever I face issues related to that application, it automatically routes my traffic to act as a proxy and routes my traffic to their scrubbing center, especially in case of any volumetric attack.

In terms of areas for improvement, I would say that one scenario is that F5 Silverline Managed Services needs to adapt compliances related to India's DPDP, as I have informed the F5 person. They are normally following only PCI DSS standards or GDPR compliance, but in India, we are using different data protection rules, so across compliances, they have to adapt.

About stability, I would say it is 99.95 percent.

F5 Silverline Managed Services is not a concern due to its scalability. The only thing is that you have to be careful while sizing the requirement.

I think 24/7 expert support and streamlined compliance management definitely benefit my company's security efforts. That feature has someone really working on us, and in case of any challenges, we can easily approach them.

If I were to rate support from zero to ten points, I would say they will provide at least seven. I rate it a seven because of my sizing. If the person doesn't know anything and blindly goes for sizing, then it's a challenge because they operate in a different licensing model.

Positive

Regarding the deployment and initial setup of F5 Silverline Managed Services, I find it easy to implement. The person needs to have basic knowledge.

The person has to have some application security manager knowledge, but I would go with a partner.

The name of the partner I was working with is Hitachi. Overall, my experience with Hitachi was good. They helped.

Regarding return on investment with F5 Silverline Managed Services, I would say only ten to fifteen percent, not more than that.

Regarding the pricing of F5 Silverline Managed Services, I would say it is quite affordable.

When comparing F5 Silverline Managed Services technically and from a pricing perspective with other solutions, I do see some differences, for example Check Point.

To compare F5 Silverline Managed Services with Check Point briefly, on the API protection front, F5 Silverline Managed Services operates only based on the number of sessions, while Check Point operates on the number of the load balancer count, not for the number of sessions.

Regarding time being saved, I would say a reduction of fifteen percent, not more than that.

While sizing the requirement, I would say only ten to fifteen percent, not more than that. I am talking about money saving.

I would provide a rating of eight on a scale of one to ten for F5 Silverline Managed Services. My overall review rating for this product is nine out of ten.

One great thing about F5 Silverline Managed Services is that it provides DDoS protection, and the protection is available 24 hours, 365 days a year, seven days a week. The Web Application Firewall helps us against different API attacks, phishing activities, and malicious bot activities. It detects different bots and websites before they reach our website and helps us keep our email secure. Whenever I forward any phishing email, it helps us detect and delete it immediately. I would say F5 Silverline Managed Services offers a first layer of protection.

One thing that stands out about F5 Silverline Managed Services is the DDoS protection that it provides, which is available 24 hours, 365 days. The service is a layered offering, so it scrubs all different volumetric attacks, which is very much advantageous in this day and age.

One of the best features that F5 Silverline Managed Services offers is the Web Application Firewall and also the bot and fraud defense that it provides. These are the two best features according to me.

One immediate result that I have noticed from the Web Application Firewall and bot and fraud defense of F5 Silverline Managed Services is that many false leads, false bot websites, or bot attacks that happened on our website earlier are being greatly stopped. I am seeing an improvement of about 30% in our overall efficiency and performance of the website, which has helped us get more sales. I would say it is indirectly related to our sales, but I have seen a 30% efficiency improvement in our website performance after the introduction of F5 Silverline Managed Services.

One thing that was a hassle for us regarding F5 Silverline Managed Services was the deployment of this particular software. The deployment is completely done from their team, and it took about 15 days for it to be completely deployed, which was a tedious process for us. Perhaps that could have been shortened, but apart from that, feature-wise, I do not have any complaints. Everything is excellent with the software.

The onboarding process of F5 Silverline Managed Services took a lot of time, but apart from that, I do not have any complaints.

Everything is great with F5 Silverline Managed Services. Perhaps the integrations with other F5 tools could be better for me to have a centralized view of all F5 offerings. Apart from that, I do not have any complaints with regards to F5 Silverline Managed Services.

I have been using F5 Silverline Managed Services for about a year to 14 months.

So far, I have not seen anything suspicious with its accuracy or output. Everything is consistent and good, which is what I also want from this. It is very consistent.

The 30% efficiency improvement has definitely resulted in increased revenue for us. With our website performing much better, I am able to achieve faster cycle times in terms of lead to conversion. It has indirectly helped our sales grow, which is directly related to our revenue. Our revenue has grown substantially after the introduction of F5 Silverline Managed Services.

I would urge others looking into using F5 Silverline Managed Services to obtain the services immediately for their organization and website, because data threats are real issues right now. Businesses that invest in data security and cloud security have higher chances of achieving higher revenue, which I have been able to do. I would suggest starting to invest in this area to see more returns in your business.

F5 Silverline Managed Services is excellent software, and in my opinion, it is very much needed. The level of security that it provides is unmatched in the market. The 24/7 support that it offers is also very good. I would urge everyone to start using it. I give this product a rating of 10 out of 10.

F5 Silverline Managed Services has been used to ensure business continuity and protect customer-facing applications from downtime and security breaches. During a volumetric DDoS attack on an e-commerce portal in my company that occurred during a seasonal sales event, F5 Silverline Managed Services performed very well. Normally, this kind of traffic spike would overwhelm the service and cause downtime, but F5 Silverline Managed Services kept the customer-facing application online even under heavy attack traffic.

The best features F5 Silverline Managed Services offers include DDoS mitigation and a Web Application Firewall. These features stand out because of their effectiveness, speed of response, and the balance between automation and human oversight. The layered defense and DDoS consistently block attacks without disrupting legitimate traffic, and the reliability is what makes them shine.

F5 Silverline Managed Services has a very positive impact on my organization. The business continuity application stayed online even during large-scale DDoS attacks, meaning customers never experienced downtime and the new streams remained intact. Specific outcomes and metrics resulting from using F5 Silverline Managed Services include reduced downtime during the major DDoS attack on the e-commerce portal, improved customer satisfaction since customers never saw the attack, and maintained trust and confidence. Post-event surveys showed a five to seven percent increase in satisfaction scores related to reliability.

F5 Silverline Managed Services could be improved with more intuitive dashboards, a self-service option for respondents, localized support, and better pricing since I think it is high.

I have been using F5 Silverline Managed Services for the last year.

F5 Silverline Managed Services is stable.

F5 Silverline Managed Services has good scalability because it is a service in the cloud.

My experience with customer support is that it is really fast and great for the company.

I previously used a different solution, specifically WAF in Azure, but it was not a complete solution.

I have seen a return on investment in the time saved.

My experience with pricing, setup cost, and licensing is that it is better than other solutions.

I did not evaluate other options before choosing F5 Silverline Managed Services.

If someone is considering F5 Silverline Managed Services based on my experience, they should decide what their priority is, whether it is DDoS protection, WAF, compliance for SOC, and remember that the monitoring reporting dashboard is great. The reporting features should be used to track attack metrics and mitigation results.

The reporting dashboard makes it easier to show later the financial and reputation impact, avoiding issues. This transparency is often overlooked but critical for executive buy-in.

Silverline shields the stream, silent stream behind the screen, attacks dissolve, trust remains, revenue safe, no downtime plains. I have given this review a rating of eight out of ten.

I work with F5 Silverline Managed Services, and I'm doing the presales engineering of that product, which is a WAF solution.

F5 Silverline Managed Services, a Web Application Firewall solution, is used for protecting web services. Organizations put that product in front of web services to load balance the traffic and create a secure environment, especially for web services operating in HTTPS.

The best aspect of F5 Silverline Managed Services is its two-way security environment for web services. One part is positive security, which allows you to know vulnerabilities in depth, and you can implement CAPTCHA and MFA for logins, while also preventing known threats with included signatures.

F5 Silverline Managed Services utilizes real-time threat intelligence; the traffic flows through the product, allowing us to see all the traffic in clear text, which enables real-time intelligent threat signature analysis and supports a learning mode for codebase evaluation.

The adaptable and flexible security can help prevent threats in learning mode, but admins need to be cautious about false positives that could affect production due to unrecognized vulnerabilities.

One negative aspect is that the product is expensive.

I have been selling F5 Silverline Managed Services for about two years.

Twenty-four hours a day, seven days a week expert support is available for F5 Silverline Managed Services, and while the product mostly has no issues, configuration problems largely arise from customer misunderstanding, leading to cases opened for configuration aspects where AI has become increasingly useful.

The installation is easy; if the admin has some basic network and website knowledge, anyone can set up that product without too much difficulty.

F5 Silverline Managed Services is recognized as one of the best solutions in Gartner for WAF; I believe it can effectively manage vast amounts of traffic better than other brands like Citrix or FortiGate's WAF solution.

If the company is a government entity, they primarily use the hardware solution; smaller companies mostly utilize the DVM solution.

The deployment model does not affect visibility and control over security; the difference is only in performance.

The performance is generally good; it depends on the topology, but if the topology is okay and the product is efficiently used, it's acceptable.

I would rate the scalability of F5 Silverline Managed Services as a nine.

I would rate technical support as a seven point five.

I rate technical support as seven because F5 Silverline Managed Services lacks a TAC team in Turkey, which means escalation takes time, and I don't typically give high ratings to any vendor.

I rate this product an overall eight.

I use F5 Silverline Managed Services for application delivery and security. I have extensive experience with products like LTM (application delivery controller), GTM (global traffic load balancing), ASM, and APM. These products enable me to distribute back-end server traffic, customize and control HTTP headers, and provide security measures like health checks and DNS security.

F5 Silverline offers load balancing, flexibility, and reliability. It allows for centralized management of certificates, protecting applications from top ten attacks like SQL injection and cross-site scripting. It is effective at mitigating DDoS attacks where a profile can be created and applied to virtual servers.

Improvements could include the creation of highly optimized profiles, optimization deployments, and compression profiles for better performance.

I have been using F5 solutions for 15 years.

The stability of the solution is very good.

The solution is fully scalable, and I would give it a rating of ten on a scale of one to ten for scalability.

Sometimes tech support can be slow. They take more time assigning engineers to complex issues, however, they resolve the issues by joining me to fix them.

Positive

I also work with Fortinet solutions.

The setup of F5 Silverline Managed Services is straightforward and easy. One person is enough for installation, however, for high availability, deploying two devices as active-standby or active-active is better.

Using F5 results in time and cost savings, estimating a return on investment of 100%.

The solution is expensive, however, the quality and performance are good.

I work with Fortinet solutions, specifically FortiGate, FortiAnalyzer, and FortiManager.

For comparison, I prefer F5 over Fortinet because of its simplicity in operation and administration. I have been working with F5 for about ten years, and its support is professional. 

Overall, I would rate F5 Silverline Managed Services at nine out of ten.

Our primary use case for this solution is DDoS and firewall protection. 

F5 Silverline Managed Services's most valuable feature is 24/7 organic mitigation. The service consists of real people mitigating attacks in real time. When a real person is mitigating an attack, you will get the best possible defense.

F5 Silverline Managed Services is expensive. You do get world-class quality of mitigation, but I think it is still pricey. You can find similar services, potentially of slightly lower quality, from other vendors like Cloudflare or Akamai for about half the price. When you compare what you get for the money you spend at Cloudflare or Akamai, you do get less protection but you are not dishing out too much for it. On the other hand, at F5 Silverline Managed Services, you do get better protection but, but you are paying double for it.

We have had mixed feedback from our clients about this. Most of them would rather pay less for a bit of a lower-quality defense than overshoot their budget. The most common piece of feedback we receive is that the difference in protection levels is not reflected in the price. 

I have been using F5 Silverline Managed Services on a daily basis for the last three years. Most vendors fulfill the requirements for standard DDoS protection, but F5 Silverline Managed Services has a better understanding of defending web applications like HTTP and can mitigate more bot activity than any other vendor.

The main advantage of using F5 Silverline Managed Services – if you are protecting your whole system and especially web applications that you are delivering to customers – is that it has a plethora of tools and awareness about bots that are constantly crowding and traveling towards your website. In other words, in addition to protecting against DDoS attacks, F5 Silverline Managed Services also has that additional layer of body defense. F5 Silverline Managed Services is a better fit for those focused on publishing web applications toward the internet.

F5 Silverline Managed Services is stable. On a scale of one to five, one being not stable at all and five being very stable, it gets an easy five. 

F5 Silverline Managed Services is scalable. It only takes three or four clicks to upgrade the capacity for everything, which is not a big deal.

There is a lot of room for improvement with their tech support. I am not sure F5 Silverline Managed Services can be classified as having tech support. A lot of the time, and this is not only the case for Silverline but for the whole F5 portfolio, the biggest issue is their tech support. When you have an issue and open a ticket, it will get transferred from one person to another for next three months, and after that period, if you don't have a connection inside F5 – like, you personally know a deputy manager or somebody like that – your ticket will not ever get solved ever. 

Negative

On a scale of one to five, with one being difficult and five being very easy, I would give F5 Silverline Managed Services's initial setup a four. How difficult the deployment is will depend in large part on the experience of the person on the back end. I have about 15 years of experience in IT. My journey started with small deployments and eventually included the ISP. I have been working in Serbia at an intern service provider for eight years. In other words, I may not be the best person to judge simplicity because I have seen some complex systems. I would personally classify a F5 Silverline Managed Services deployment for a common enterprise customer as easy.

Deployment does require you to have knowledge of routing protocols that are not part of the F5 solution. That is the only prerequisite that you need to meet before you start doing something in the cloud itself. You need to understand how to steer traffic towards the cloud and that requires good planning.

If a customer is currently under attack, implementation can take three to four days. If a customer had been proactive and evaluating different solutions for DDoS before getting hit with the attack, deployment could take maybe three weeks, but there is no need to waste more time than that. I'm including the regular process of onboarding the customer, configuring everything, and acceptance tests in this time frame.

We are a distributor SE. We are basically the middleman between F5 Silverline Managed Services (the vendor) and partners that delivering solutions on the premises of the customers. I am the guy who helps partners and engineers as a first level and maybe second level of support in everything from deployment towards the troubleshooting and maintaining the whole solution in that. 

Deployment and maintenance in this model would require an individual like me and two engineers from partner companies. These engineers would implement the solution on the customer premises and do all the maintenance. When they get stuck, they would escalate the issue towards me.

There is a global shortage of skilled people in cyber security. With this solution, you do not need to have anyone inside your company managing it on a daily, weekly, or monthly basis because it is could-based. If you take that into account, I would say that the return on investment is getting a secure system without needing to hire more people or train an employee to master the technology. From that standpoint, F5 Silverline Managed Services is a worry-free service.

One a scale of one to five for return on investment, with one being very low and five being very high, I would give F5 Silverline Managed Services a three. I have seen better.

On a scale of one to five, with one being the most expensive and five being affordable, I would rate F5 Silverline Managed Services a one in terms of pricing. However, additional services like separate threat feeds and IP intelligence are not so pricey.

F5 Silverline Managed Services is an add-on for on-prem DDoS protection. If, for example, you are using Advanced Firewall Manager (AFM) on-premise, F5 Silverline Managed Services will serve as additional layer of protection when you are under attack. It has a hybrid deployment structure using both on-prem and cloud technology.

F5 Silverline Managed Services' scrubbing and mitigation is done in-cloud, so there are no new versions. Their soc team does the manual mitigations in the cloud in their scrubbing center.

F5 Silverline Managed Services provides industry-standard DDoS protection. It is not missing anything that any other vendor would be offering in that regard. As a client, you want to have a solution that will successfully defend you from volumetric attacks from the internet, and F5 Silverline Managed Services does that.

It also offers standard reporting. It shows you how hard you have been hit and how mitigation kicked in and what it did.

There is no universal, one-size-fits-all solution in this field, but when a customer has a lot of public services – they provide a web application or API – F5 Silverline Managed Services is the way to go for them.

We use the solution for protection from Layer 3, Layer 4, and Layer 7 DDoS attacks and for web application firewalls.

The product’s UI is easy to understand.

Since we use the solution’s cloud, the product has more control over the back end. The customer will not have control. It is part of the product’s feature. When we get more complex requirements or if we want to write more complex tools, the support team will have the visibility to write them because they have control.

The navigation is difficult to use. The navigation should be improved. Other products are quite straightforward. If I try to implement a new application and do an onboarding, it is not very easy. We must go to one feature, inside which there will be more features. It should be simplified, and a menu should be provided.

I have been using the solution for more than two years.

The product is stable.

The solution is scalable. More than 100 people use the solution in our organization.

Support is not good. The team takes a long time to respond.

Neutral

The initial setup was easy. The solution has good documentation for the initial setup. F5 also provided us with support.

The product’s pricing is reasonable.

As a customer, if we need more control, then we should choose F5 ASM. We use multiple applications and products. We use the tool for corporate applications because it fulfils our requirements. I will recommend the solution. If it fulfils your requirement, you can definitely go ahead and use it. Overall, I rate the tool a seven out of ten.

We use it for thing application deployment for our application, which is known as CBN. Most of the traffic is put to Silverline.

We only use for Web Application Firewall (WAF). We only did one.

There is room for improvement in the stability of the solution. 

I have been using this solution for two years. 

We use the latest version because we use SaaS.

I would rate the stability an eight out of ten. 

I would rate the scalability an eight out of ten. 

The initial setup is straightforward. 

Overall, I would rate the solution an eight out of ten. 

We primarily use the solution for config or application security policies on web application firewalls. It's to protect applications that are internet-facing. There's port protection as well. 

The initial setup is very straightforward. 

The security and protection on offer are pretty good. 

We'd like more AI to be used. Right now, they don't use it enough. 

We'd like the solution to offer open sessions so that the session syncs to other IP faster. 

The protection could be a bit better in various areas. 

The stability could be a bit better. 

It could offer better pricing. 

We're still using the solution after two years. 

The stability is okay. I'd rate the reliability six out of ten. It could be a bit better. 

The scalability is good. I would rate it eight out of ten. 

We have about 50 users on the solution right now. 

I don't have any experience with technical support directly from the company. I've only dealt with local support, and their help has been enough for me. 

I'm also familiar with Imperva. Imperva is pretty good in general, however, the local support could be better. F5 is better in terms of local support. 

The initial setup is very simple to set up. It's not overly complex. I found it to be very easy. 

We used a local partner, and they assisted with the initial setup. They were F5 field support.

The pricing is okay, however, it could be lower. I'd rate the affordability six out of ten. 

I am a user of the product.

I'm not an implementor. I cannot choose which product to use, I just optimize the product that is provided to me by my company. That's why I use F5. 

I'd rate the solution seven out of ten. 

We are using this product for a major airline whose traffic is routed via F5 Silverline Web Application Firewall. All B2C sites are behind F5 Silverline Web Application Firewall. The data part is basically to Akamai for CDNs and to F5 Silverline Web Application Firewall for WAF capability. The resources are hosted on AWS or Azure. For parameters, we have another F5 AWAS module, which intercepts the traffic once it is inside the cloud parameters, and then the data goes to the backend application pool. Every B2C traffic gets inspected on F5 Silverline Web Application Firewall. Every HTTP profile is inspected on the Advanced WAF module, which is again F5 on-premises.

We are also deploying this solution for another client in the Middle East. We're basically deploying the architecture. We have F5 Silverline Web Application Firewall and the Check Point firewall as the next-generation firewalls. All HTTP traffic is via F5 Silverline Web Application Firewall, and it is routed back to the Check Point firewall for IPS and malware inspection because F5 Silverline Web Application Firewall does not do that. Non-HTTP profiles go via the Check Point firewall.

Its flexibility is the most valuable because it is a managed service. The good part is that you don't need to set it up. It just needs DNS routing, which is the easiest thing.

Our client had Akamai for certain websites because they were using CDN features. They had NetScaler on the internal zone, F5 AWAFs on the data centers, and no WAF at all in the cloud. One of the main activities of the project was to move all these policies into a single WAF so that we could control and use that as a choke point. That exercise itself was very easy because it was a managed service and F5 Silverline Web Application Firewall does that for you. That's the best thing about F5 Silverline Web Application Firewall.

It is easy to apply policies on-premises. If you have AWAF on-premises and you want to replicate some policies on F5 Silverline Web Application Firewall, other than the policies that it applies by itself, it is easy because you have a team that supports it.

F5 Silverline Web Application Firewall works perfectly fine. It pretty much does everything that an Advanced WAF on-premises should do.

F5 Silverline Web Application Firewall, being a new product in the market or comparatively related to a new product, currently supports less number of PoPs. They should introduce more PoPs. The current number of PoPs that they have is around 10 or 12, which is still relatively less as compared to 2,400 plus PoPs that Akamai offers. The user latency or the number of hops a user needs before reaching the actual web application is less in Akamai because it has its internal fabric to route the traffic.

They need to spin up more data to increase its traffic handling capability. They can also include the bot detection capability, though it is a pretty advanced functionality. If they could include DataDome like functionality, that is, bot prediction, then F5 Silverline Web Application Firewall will be top-notch in the market.

I have been using this solution for a year or so.

It is so far stable. When I did a POC for one of my clients, I ran tests for a month on both Imperva, F5, and Akamai. I found F5 to be more regress in terms of infections than Imperva. It could be because of the teams on-site, representing these companies, doing their job right or wrong. If a PS consultant from Imperva did not configure the policies right, it probably would have scored less. 

I know that F5 Silverline Web Application Firewall is scalable. We are using this product in two enterprise setups that can have a hundred thousand-plus requests at any given time.

Scalability for products like F5 Silverline Web Application Firewall or Incapsula is pretty easy because their sizing is managed by the vendor. Therefore, you don't have to really bother about what goes in there because that's a black box for you. However, if you are doing it on-premises, it's a task.

I've been involved in upgrading a traditional WAF to Advanced WAF. It's basically a license upgrade involving testing and re-profiling of applications and things like that. It's a sort of straightforward task. If you have the right team, it is not something really difficult. It isn't something like where you just add a few boxes and then scale.

Our airline client has millions of customers, and all this data is going via F5 Silverline Web Application Firewall, which is a lot of data. It's an enterprise kind of setup. We're not talking about end-user traffic here. We're talking about B2C traffic. For end-user traffic, we have around 400-odd unique URLs behind the F5 Silverline Web Application Firewall on-premises, which is again an Advanced WAF module. F5 Silverline Web Application Firewall has around 60,000 to 80,000 users, not at the peak but spread over time. All B2C requests coming into the website, like booking or looking for your seats on the flight, go via F5 Silverline Web Application Firewall, and that could go up to millions of hits a day.

We have a personal rapport with both Imperva and F5 in UAE because we have worked with them for more than a year. I have found them to be really good. I may have once or twice talked to their central support team as the contact person for the account was not available. Otherwise, it has been a personalized experience for both products because we know the teams.

The initial setup is certainly straightforward because F5 Silverline Web Application Firewall does the setup for you. All that you need to worry about doing is routing your DNS via F5 Silverline Web Application Firewall.

If I have a website, I would just make sure that it routes via F5 Silverline Web Application Firewall DNS, and then I would only whitelist the traffic between F5 Silverline Web Application Firewall and my application pool. That's the only configuration that I need to worry about, unlike a traditional WAF that you need to set up. You can't just say that it is a strength of F5 Silverline Web Application Firewall because Imperva's WAF on the cloud, Incapsula, also works the same way. 

F5 Silverline Web Application Firewall works based on your bandwidth. They look at the clean bandwidth and do the pricing. 20% of a total pipe would be a clean bandwidth.

The list price or a non-negotiated price for F5 Silverline Web Application Firewall would be around $2,200 per application per year for everything that you need. When you get into an enterprise kind of a setup, they negotiate this to the last bit. I would easily take 20% on that, which would be the cost, but it should cover all your Advance WAF features, bot protection, tech campaign, etc. It is built as a package and gives you most of the capability.

You don't get the mobile SDK, which is an additional license. Mobile SDK is required only if you're buying or if you have a mobile application, and you are going to instrument F5 or Imperva into your mobile appliance. This anyways would be an additional module. It doesn't come within the WAF, but it is a WAF feature.

There are a lot of gray areas in WAF. If you take a look at the top ten WAF solutions, most of the WAFs in the market, or at least the advanced ones, do it right because the WAF technology is evolved.

If you look at bot protection, it is probably not everyone's game. I've seen Imperva doing it really well. If I masquerade a browser, for example, if I masquerade a Chrome browser by changing the agent files and make it look like Firefox, and then if I send a request to my F5 Silverline Web Application Firewall (or Imperva firewall), I would want to see if it identifies the real browser behind it. I've seen F5 Silverline Web Application Firewall (and Imperva) handling most of such cases well, but other WAF products in the market fail.

If you look at Imperva, their strength primarily is on the DDoS capability. In the volumetric attack part, Imperva scores or has at least a record of doing better than F5 Silverline Web Application Firewall. Imperva is also in the public domain, so they have mitigated larger attacks than F5 Silverline Web Application Firewall, but this is not something you can test in the lab. You wait for the doomsday, and then you do your actual test.

Overall, if you say F5 Silverline Web Application Firewall as a product, I would vote it over Imperva. It may be because I'm more inclined to work on F5 Silverline Web Application Firewall. I found working with it easier than Imperva.

You should know what you're actually blocking. A lot of customers move to WAF or AWAF because they were told to do that, but they need to identify what they're actually looking to inspect. For example, one of the clients I worked with did not understand the differences in capabilities between a next-generation firewall and a WAF. When I say WAF, I am talking about AWAF, not the previous generation WAF. No one considers that anymore.

People who try to put WAF and think that they are secure are not really secure. There is still a fine grain of security that you need on a next-generation firewall. For example, if I inject a payload, I'm going to have HTTPS traffic that I pass on to WAF. If I do not do my SSL termination and just inspect the remaining stuff, such as headers, WAF is basically useless.

If you're using a WAF solution like F5 Silverline Web Application Firewall, one thing it does really well is the orchestration part. It can terminate your SSL and do the encryption. Basically, it may make your stream decrypted via texts, inspect every element of it, decrypt it back, and then send it. 

As a security consultant, I would add another next-generation firewall behind F5 Silverline Web Application Firewall. I will make sure that I do a service chaining, and every single stream or packet that is decrypted is again routed via a next-generation firewall to do IPS. This is because your WAF cannot do IPS. It is not its major strength; it is a firewall capability. Let's say you have a website where you upload files, and you are going to upload a file that probably has some malicious code that could be executed. When you upload it, it is going to sit on your system. How do you know that a file that is attached to a website is not malicious? A WAF generally doesn't take this up. That's where a combination of WAF and firewall comes into the picture. 

It's about defining and ensuring what is your load and how many applications you want to protect. Do you really have the skills to manage those policies in-house? If you don't have really good engineers who look at the policies and manage these boxes, then it is better to go for managers like Silverline. If you have good hands on the ground, then use an Advanced WAF in your data center. 

Some companies might not need on-premises deployments because they might be using a cloud. In that case, run this on the cloud. You could have virtual licenses or virtual machines running on the cloud, or you could use Silverline. If you're more security passionate, then you probably will have to have a Silverline for it and then another WAF within your cloud. Again, there's no one way to do it. It depends on your network, but do not rely on one product because every product has its limitations.

I would easily rate F5 Silverline Web Application Firewall a seven out of ten. I won't give it an eight because I haven't tested it for a longer period.