F5 Advanced WAF Reviews

F5 is a web application firewall and load balancer. 

The primary use case of this solution is for data protection and security.

I like all of the features, but the main one is the attack signatures.

If they could separate the control plane from the data plane, it would give us more flexibility, especially with the Hyper Cloud. This could be the reason they purchased NGINX.

They have released the first production release but they are not there yet. It would be good to have this separation in the near future.

Also, automation on the cloud is not easy. It's a bit of a job, and it doesn't auto-scale very well.

They need to work on the BIG-IQ, which is centralized management. There are too many devices. Managing them individually is inconvenient. Essentially, BIG-IQ is supposed to centralize the management for all of the boxes but it's not very effective.

I have been using this solution for more than five years.

The stability is very good.

There is no solution that is bug-free, but when comparing it with other vendors, I would say that F5 is less buggy than the others.

The scalability is an issue at the moment, which is the reason they need to separate the control plane from the data plane.

We are using this solution daily. It runs 24/7.

The technical support is very good. They are knowledgeable and helpful.

The initial setup was simple and it took an hour to deploy.

This solution does not require a lot of maintenance but we need to do the patching regularly.

We do the implementation but at times we get consultations from F5.

It's more expensive than other solutions and depending on the modules, there can be additional fees.

If I would compare F5 with other solutions, the main differences are the support and the stability of the code, it has fewer bugs.

For on-premises deployments I would recommend F5, but for the cloud, it would be questionable.

I would rate this solution a seven of ten.

We use the solution to secure web applications running in the organization.

F5 is one of the best products. We use it for multiple segments within our organization and applications. It is a central point of all the applications being scrubbed and checked.

The customer service could be improved.

I have been using F5 Advanced WAF for more than ten years.

The product is stable.

I rate the solution’s stability a seven out of ten.

The solution is scalable.

Our entire organization and clients use the solution.

The initial setup is easy since I have used the technology for almost 20 years. Some applications require more attention depending on what you are doing and trying to achieve with the particular module. You need some assistance from the team in configuring the different components within the application through the web.

The solution is worth the money that you spend.

The solution is expensive.

Whatever you are looking for can be done on the platform. Some features may not be available with IO components. A few features give you the flexibility that no other product can.

Overall, I rate the solution an eight out of ten.

We use the product for load-balancing purposes.

The product has valuable features for load balancing, monitoring tools, and HPXpress services.

They could provide better pricing.

We have been using F5 Advanced WAF for a year.

I rate the product's stability an eight out of ten. 

The product is highly scalable. It is suitable for enterprise businesses. I rate its scalability an eight out of ten.

I rate the initial setup process a seven out of ten.

I rate F5 Advanced WAF's pricing a three out of ten.

I rate F5 Advanced WAF an eight out of ten.

I work for a bank and our use case of WAF is to protect our applications, including mobile ones. We are users of this solution and I am an IT specialist engineer. 

Protection from attacks is the best feature of this product. 

We sometimes get pages with false positives. The F5 team does its best to deal with this problem. I'd like to see this product compatible with more mobile applications, like protecting something devices from a malicious server or from the mobile application itself.

We've been using this solution for one year. 

The stability is good. 

The version we are using is not very scalable. 

The technical support is generally good although in some cases they take a long time to respond and we then need to escalate the case to get an answer from a higher level. The team is mature and they are able to solve our problems.

Positive

F5 has good documentation available on their website so deployment is relatively straightforward. 

This is a mature solution and a very powerful device for protecting web applications. I rate this solution eight out of 10. 

We use this solution because we provide a platform that requires a lot of security.

The solution is deployed on cloud.

We have thousands of external users.

I like the security features, especially against SQL injection.

I would like to see additional controls.

I have been using this solution for a year.

The stability is reasonably good. There haven't been any major issues so far.

It's scalable. We haven't had any major issues so far.

We went through the managed service partner, so they did the deployment. Deployment took about 15 days.

We have a few IT experts for maintenance. 

Implementation was done in-house.

I would rate this solution eight out of ten. 

My advice is to do a thorough testing of the application.

Most of the time, we use it as a load balancer. It's for the client’s applications. They then apply WAF policies, of course, if the customer wants, and also an APM solution, like VPN access or Web Box, like a web and reverse protocol. Customers vary in terms of what they want.

The WAF and APM are very useful. I like the modules.

The solution has been mostly stable and reliable.

It can scale.

The BNS module needs improvement.

I’ve been using the solution for the last four and a half or five years. It’s been a while.

Most of the time, the stability is okay. For the most part, we don’t have issues with bugs or the solution crashing. It’s fine.

The solution can scale as necessary.

We have a lot of telecom and banking clients that use the solution. I’m not sure how much in total each client has in terms of users. Whoever would be using it would be more on the technical side.

We do plan to increase usage and to continue to offer this to our clients.

We help with the support as well as implementation. If a client runs into issues, they can always talk to us.

I’ve contacted the technical support of F5. However, I haven’t used them that much. They have always been okay. I’ve never had issues with them.

Sometimes the setup is straightforward. Other times it’s more complicated. It depends on the client and the project. How long the deployment takes depends on what they want.

You only need one person to handle deployment and maintenance tasks.

We are an integrator and can help customers set up the solution.

While there may be a potential for ROI, I don’t track it.

I’m not sure about the licensing. I don’t handle this aspect of the product.

We’re platinum partners with F5 in Greece. We’re integrators and resellers. We work with different versions.

The solution can be deployed both on the cloud and on-premises.

I’d recommend the solution to others.

I would rate the solution nine out of ten. We’ve been pretty happy with its capabilities.

We primarily use the solution to protect web and API applications. You can choose either web classic or API to protect against different types of attacks.

With Advanced WAF protection, F5 was able to protect multiple kind of Web Application, supporting both HTTP & API protocols access

There are two main features that we love on F5.

The first is the hardware itself. It's extremely stable and reliable. We never face any issues with it and performance is never affected. 

The second is the features on offer. Feature-wise, they are always cutting edge and up-to-date. Many features aren't available via competitors. There's always a lot of enhanced critical features that just aren't available through anyone else, or, if they are, are too lightweight. They're the leaders in the space.

We usually use a third-party tool for logging and reporting. It would be nice if we could do that right on this solution. They have one, but it's not very stable. Logging and reporting effectively would be a big enhancement.

The solution still needs some development to handle more traffic, especially in huge environments. In small environments, it's not an issue. 

I've bee using the solution for more than ten years.

The solution is extremely stable and robust. There are no issues with bugs or glitches. It doesn't crash or freeze. It's great. The stability is a huge selling feature.

It's scalable. There's always options to upgrade the hardware. Any hardware you buy from a store, you have the basic model and the upgraded model. For example, if you buy the 4600 appliance, you can upgrade up to 4800. You get double specs for everything, so you can just upgrade the license of the hardware. However, hardware eventually has a limitation. If you buy too small of a size of hardware, eventually there's some development limitations for the hardware. You can, however, do a cluster. You can add multiple hardware devices. This makes it very scalable.

The solution is not user-based. It's more connection-based, so there's no limitation on the number of users. It's more of a limitation on total throughput or total connection. Limitations depend on the application and how much traffic it generates. We've seen it in Telco environment where there's more than millions of users. We've also seen it do well with online banking where there are thousands of users. Small companies can use it too. It can vary, however, we've seen it in millions of users at Telco.

Technical support is great. We always open tickets. They're always very fast and very professional, and they always solve the issues. We're extremely satisfied with the level of support we receive.

If you want to do the basic installation and get the system up and running, then it's pretty straightforward. However, you have the flexibility to go very advanced and you can get into very complicated scenarios. That's what we like about the solution. There's a lot of use cases where you're required to have the ability to create some advanced features or some complicated scenarios. It gives you the capabilities to handle them.

You have the flexibility to go beyond that and have advanced scripting rules and advanced features in order to have more capability to do new things that are not as common. You need to have the space to improvise things if you need to.

While a straightforward deployment may only take a few hours, as it has a pre-defined rough template, there's always tuning to be done. It's a security product. It's not like it's plug-and-play. There's always a learning phase and tuning is necessary. This is common with any security product. That said, to get it up and operational, it's a matter of hours.

For a proper work deployment, to be frank, you need an ether professional because there's an ether configuration change. You also need a security professional to do the rules and policies and everything. Then, you need the involvement of the web application developer, so you can understand the content of the web application. Security people don't know which link is good and which link is bad inside the application. Usually, you need three people from the team - one each from network, security, and application - to have a proper deployment.

We're an integrator.

We have a big customer base, therefore we always have to be up to date with the latest versions. We feed to constantly look at things so that we know the new features.

I highly recommend the solution to other companies. F5 has a huge portfolio of plug-ins. You can add it to the top of the web. On the same appliance, you can have your balancer, you can have your application authentication, and those things that turn on. You can have multiple other features on the same hardware. It is definitely a technology that adapts. I can use the application in different ways beyond just security.

On a scale from one to ten, I'd rate it at a perfect ten.

F5 Advanced WAF could improve the precision of the scanning. There are many false positives. They should improve their threat database.

I have been using F5 Advanced WAF for three years.

F5 Advanced WAF is a stable solution, we are satisfied. It is more stable than ForiWeb.

I have found F5 Advanced WAF to be scalable.

The local support is good and they have been helpful. However, if we raise an issue to the global support they take a lot of time to return our inquiry.

The price of the enterprise solution is reasonable. However, if you are a small to medium-sized business the price could be difficult to afford.

F5 Advanced WAF pricing structure should be adjusted to meet the need of small to medium-sized companies.

I rate F5 Advanced WAF an eight out of ten.