Try our new research platform with insights from 80,000+ expert users

Barracuda Web Application Firewall vs F5 Advanced WAF comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 1, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cloudflare
Sponsored
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
75
Ranking in other categories
CDN (1st), Distributed Denial-of-Service (DDoS) Protection (1st), Managed DNS (1st), Cloud Security Posture Management (CSPM) (13th)
Barracuda Web Application F...
Average Rating
8.2
Reviews Sentiment
7.5
Number of Reviews
44
Ranking in other categories
Web Application Firewall (WAF) (17th)
F5 Advanced WAF
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
69
Ranking in other categories
Web Application Firewall (WAF) (2nd)
 

Featured Reviews

Spencer Malmad - PeerSpot reviewer
It's easy to set up because you point the DNS to it, and it's working in under 15 minutes
Cloudflare is highly scalable. Cloudflare is a system with a web portal that the end users like me see. It's a console where we can adjust the DNS, caching, and security features all in that console. Cloudflare owns thousands of servers across the world that cache the data. It's a powerful solution. When clients sign up for Cloudflare, they're getting this monster content delivery network, security, and a web application firewall in one. It's all rolled into one, and it's massive. Unless you have your website hosted on a massive hosting provider, there's no way that you can deliver the amount of data that Cloudflare can provide to the end users. If you have static content, there's no way that you can ever match what Cloudflare can do. Obviously, there are competitors to Cloudflare that do the same, but I'm saying other types of solutions. Let's say you go with F5. Great, that's on-prem. That's in your colo. You can't deliver as much data to the internet as you can with a CDN. You don't have to spend $20,000 on a net scaler, F5, or whatever Cisco's selling now. You don't have to buy that. You pay them $50 a month or $150 a month. It's totally worth it because even in five years, you'll never get the performance value, not just the actual ROI. You have to consider how much throughput you can get with Cloudflare.
UmeshKumar2 - PeerSpot reviewer
If an attack is continuous, it can block it temporarily for two to three minutes
I would rate the solution a nine out of ten. I use both Barracuda WAF and F5 but Barracuda is easy to use. F5 offers more control at another level. You can control your ship like a user. In Barracuda WAF, you can add or modify anything only with the help of support. Most of the features in Barracuda WAF are available in GUI mode. In the second version of F5, you can write iRules and apply them easily on the device. If you need something in the parameter level, you need to scan and then enable and disable the metacharacter for that particular parameter. There are some profilings available in Barracuda but they are not like F5. F5 has more general and applicable heuristics than Barracuda. However, there are good things about Barracuda too. If an attack is coming continuously, you can ask the device to block it temporarily for two to three minutes. F5 has not provided us with an option to block certain IPs for some time. Barracuda can help you block someone if the source is from a different IP. You can apply the rule to the device and block it for whatsoever time you want. The solution will unblock the IP after the prescribed time as well. This feature is not available in F5. F5 handles the implementation of single parameters and environmental parameters for financial applications easily. The profiling aspect is slower in Barracuda. Barracuda is easy for new people since everything that you need to implement the solution is available through the UI. You need little guidance for the solution. Anyone with knowledge of the HTTP header and signatures can use it very easily. It is more like Cisco in networking.
Richard Polyak - PeerSpot reviewer
Easy event identification, highly stable, and customizable
Generally, F5 Advanced WAF initial setup is straightforward. However, our environment was more complex and it took us a little more time to customize the solution to where we needed it to be. Additionally, the customization didn't rectify everything. We had to do customization to a certain event to prevent attacks that it wasn't catching, but that might not necessarily be the solutions' fault. It could be more of our setup than the solution's fault and not being able to run the latest version or the newer version could be more of a limitation on our ability to put it in the right place. The whole implementation to have the solution run at the level we wanted it to take approximately five months. Our company's environment is one that we can't put a canned solution in front of. Our environment, cannot have a canned solution that might fit everybody else because of how customized this environment is. It does need a lot of tuning to meet our environment's requirements. I rate the initial setup of F5 Advanced WAF a three out of five.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is very good at mitigating threats."
"Cloudflare DNS is widely used, and it's good for websites. If we use Cloudflare DNS and update one record, it updates in their office instantly."
"Easier http to https redirect using page rules"
"The most valuable feature is its usability."
"I get a lot of value from Cloudflare's API because it enables you to build a separate environment inside the solution. You can create a domain for performing test requests before you move to the production environment and connect various domains."
"The most valuable features of the solution are performance and security."
"There are key things that are used for our enterprise customers, such as Lambda and DNS."
"The most valuable feature of Cloudflare is the GUI. You are able to control the solution very well through the interface. There is a lot of functionality that is embedded in the service."
"One of the strongest points is its robust issue discovery capabilities. Barracuda invests significant efforts in identifying and resolving issues. They have multiple products that work in tandem to perform these checks, which is beneficial because it automates security updates. This is the primary reason I recommend it to my customers."
"It allows us to scale out to multiple phase servers."
"Barracuda Web Application Firewall provides optimized performance, a user-friendly environment, helpful dashboards, and is simple to use."
"The most valuable feature of this solution is the simplicity of configuration."
"The most valuable feature is the rule set."
"Some of the most valuable features are the ease of deployment, the Barracuda support, the easy-to-use console, and the granularity of the reports."
"It's very simple and predictable, because Barracuda provides a vision of the current state of your application. It gives you an understanding of what is happening on your site and any attempts against you at your source. This is the main value that Web Application Firewall provides our company. These aspects are also the main reason for this documentation process."
"Has a good dashboard."
"The support experience is better than average."
"One of the most valuable features is the Local Traffic Manager."
"The solution is easily accessible on mobile and laptop devices."
"It's flexible and powerful, and the users can input their own rules to the system."
"F5 Advanced WAF secures our connectivity and combines both the main functions of WAF (balancing and web application security)."
"It can scale."
"The bot defense capability, as well as protection from brute force attacks and OWASP Top Ten, are notable features."
"F5 Advanced WAF helps our engineers to learn the complete configuration, including fundamental and advanced policies."
 

Cons

"They lack a good way to manage DNS as a company, since everything is relegated to single account logins until you get to the higher levels. They have come out with a paid feature to remedy this, but I have not had a chance to fully review it yet to know if it fixes the access problem."
"Cloudflare does not have an on-premise solution. If they had different approaches they could be better suited to accommodate more customers, such as on-premise and hybrid deployments. For example, hybrid deployments would be useful where you could move the traffic from the enterprise to the cloud."
"It would be good if Cloudflare could have more servers for better traffic routing or an increase in the traffic routed. This is what I'd like to improve in Cloudflare."
"Cloudflare could offer a better view or maybe dashboards of the main resources used in the client."
"Although I think it's quite good, it doesn't provide me with all the features I would expect to have if I were using Imperva."
"If they improve on the placement of their data centers, it would be better. I'm living in a remote area. I would like to connect to them without any kind of lag."
"The product needs to improve its automation."
"I believe they currently have this feature, but there will most likely be integration with APIs so we can control some features through API."
"As a service, Barracuda needs to host in Saudi Arabia, as they currently don't have this functionality."
"An area for improvement in Barracuda Web Application Firewall is attack identification. Other banks identified attacks and tracked logs that the solution wasn't able to identify because of its ready-made rules pre-deployed by the vendor. My organization raised this issue with the technical support team. Another area to improve in Barracuda Web Application Firewall is its service desk. The team resorted to stonewalling because they couldn't accept that a feature was missing in the solution, and it was only after a lot of drilling down that the service desk team accepted that, and would be adding that feature in the future. My organization had to submit a report to the Reserve Bank of India with information on the logs identified and the attacks that happened, and that there was a failure on the part of the Barracuda Web Application Firewall. The Reserve Bank of India conducts a tri-monthly cyber risk audit in all Indian banks. Even smaller banks identified and caught attacks that my organization wasn't able to do, so I was looking into other solutions that competitor banks could be using because Barracuda Web Application Firewall failed to identify some of the attacks."
"Barracuda Web Application Firewall's load balancing feature could be improved."
"The solution needs to leverage some additional features to a broader scale of software-defined networks."
"In the Barracuda Web Application Firewall, there should be more affordable options for WAF as a service."
"The incident reporting needs to be improved."
"The solution could use more reports."
"There's potential for improvement in the platform's CMS integration."
"There is a learning curve that extends the time of implementation."
"F5 Advanced WAF could improve resource usage, it is CPU intensive. Additionally, adding automated remediation would be a benefit. For example, an easy button alerts us of the events that are occurring, and what we want to do at the time. An automated approach where somebody could be alerted very quickly. Instead of going and reconfiguring everything, an automated approach is what I'm looking at."
"Scalability could be improved."
"I think the deployment templates can be better."
"The Sandbox integration feature could be improved."
"The administrator's user interface and some of the settings can sometimes be very complicated to understand."
"The reporting portion of F5 Advance WAF is not great. They need to work out something better, as it is very basic. You only see the top IPs, I think there is more they can offer."
"I would not expect traffic details to pass through the web application firewall across the length of the whole application. I think that there is a web application where it can let the application function without traffic going in into the WAF."
 

Pricing and Cost Advice

"The price is reasonable."
"The price of the solution is expensive."
"For Cloudflare, I recommend it heavily for small businesses with revenue under a couple of million dollars. Onboarding is easy, and they even have a free plan. This makes it simple for businesses in the $100,000-$500,000 range to try it out and see its value, allowing them to scale up their infrastructure as needed."
"We are using the free tier of the solution."
"The solution is expensive when compared to other products but offers unlimited bandwidth."
"In terms of licensing costs, we don't pay for licensing for Cloudflare. We only establish communication, then for peering, Cloudflare takes care of the cross-connection in different data centers."
"Cloudflare's pricing is not much higher and is good for middle-level organizations."
"The solution has many features but there are ones that you need to pay for. Sometimes you have to find out which is available for free and which you have to pay for."
"The price is reasonable, more so than other products."
"The product is expensive."
"The price of this solution is okay."
"The product is inexpensive."
"The pricing is less compared to other web applications."
"Our licensing fees are paid annually and the cost is between €600 and €800 (approximately $665.00 to $885.00 USD)."
"The solution is based on a licensing model and might be $360 for the hybrid version."
"For small companies, the price is very expensive because the WAF is an enterprise-level application, not intended for smaller businesses. In my opinion, the price is right for enterprise-level use."
"F5 Advanced WAF's pricing is high."
"F5 Advanced WAF is not a cost-effective solution. Although they are attempting to reduce prices with their VE and cloud options, they are more expensive than other solutions. The solution is more expensive on average."
"Pricing for this solution is higher than average."
"The price of the solution is reasonable when compared with other products, such as FortiWeb. I am very satisfied with the price."
"There is an annual subscription for this solution."
"I rate F5 Advanced WAF's pricing a three out of ten."
"It is a little bit costly, but it has all the features that are required."
"Its price is fair. We have done a couple of deals where they were able to give some kind of discount to the customers. The price was initially high for the customers, but after a couple of negotiations, it came within their budget. They were happy with that."
report
Use our free recommendation engine to learn which Web Application Firewall (WAF) solutions are best for your needs.
851,604 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
15%
Computer Software Company
14%
Comms Service Provider
9%
Financial Services Firm
9%
Computer Software Company
20%
Financial Services Firm
10%
Government
7%
Educational Organization
6%
Financial Services Firm
16%
Computer Software Company
14%
Government
8%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Cloudflare. We are moving from Akamai prolexic to Cloudflare. Cloudflare anycast network outperforms Akamai static GR...
Which would you choose - Cloudflare DNS or Quad9?
Cloudflare DNS is a very fast, very reliable public DNS resolver. It is an enterprise-grade authoritative DNS service...
What do you like most about Cloudflare?
Cloudflare offers CDN and DDoS protection. We have the front end, API, and database in how you structure applications.
What do you like most about Barracuda Web Application Firewall?
It significantly improved our overall web security posture, addressing intrusions and enhancing control over web URLs...
What is your primary use case for Barracuda Web Application Firewall?
Our primary use case was to track the traffic on websites or webshops to identify potential malicious actors, such as...
What is your experience regarding pricing and costs for Barracuda Web Application Firewall?
The pricing for Barracuda is quite high compared to other OEMs. Each transaction requires my purchase team to negotia...
What do you like most about F5 Advanced WAF?
It's a fairly easy-to-use and user-friendly tool. My administrators and team also like its ability to customize the r...
What needs improvement with F5 Advanced WAF?
I do not have anything in mind right now that needs improvement. Generally, it works well. If we need any specific fe...
 

Also Known As

Cloudflare DNS
No data available
No data available
 

Overview

 

Sample Customers

Trusted by over 9,000,000 Internet Applications and APIs, including Nasdaq, Zendesk, Crunchbase, Steve Madden, OkCupid, Cisco, Quizlet, Discord and more.
Oracle, CBS, Pioneer, Hyundai, Publix, Barnes Noble, Calzedonia, Nordstrom, Samsung, Nascar
MAXIMUS, Vivo, American Systems, Bangladesh Post Office, City Bank
Find out what your peers are saying about Barracuda Web Application Firewall vs. F5 Advanced WAF and other solutions. Updated: April 2025.
851,604 professionals have used our research since 2012.