F5 BIG-IP Advanced Firewall Manager (AFM) Reviews

I am using F5 BIG-IP AFM as a proxy in relation to a code decrypt traffic and analysis for the web application signatures on different published websites in our company. Additionally, I can customize iRules to inspect traffic or redial traffic to another reach. I can use it for text signatures and it can provide a security profile.

The most valuable feature of F5 BIG-IP AFM is the iRules where I can customize the configuration.

F5 BIG-IP AFM can improve the reporting interface in relation to advanced troubleshooting depending on CLI. They should have enhanced troubleshooting with the use of GUI.

In an upcoming release, F5 BIG-IP AFM should add more free online applications, tutorials, and guides for total enhancements.

I have been using F5 BIG-IP Advanced Firewall Manager (AFM) for approximately four years.

F5 BIG-IP AFM is stable and performs well.

I rate the stability of F5 BIG-IP AFM a nine out of ten.

I rate the scalability of F5 BIG-IP AFM an eight out of ten.

We have four units of approximately 20 engineers using this solution in my company.

We have contacted the support from F5 BIG-IP AFM previously. We contacted them for mentoring regarding the problem with traffic latency and the other engineers ask us to investigate the problem.

I rate the F5 BIG-IP AFM support a nine out of ten.

I did not use another solution prior to using F5 BIG-IP AFM.

The initial setup of F5 BIG-IP AFM difficulty depends on the experience of the person doing it. I have experience with the solution, it was not too difficult for me to implement. The process of implantation can be done in five minutes.

I rate the initial setup of F5 BIG-IP AFM an eight out of ten.

We sometimes use third-party companies, such as S3A, for deployment but we are able to do the implementation ourselves.

I have received a return on investment using the solution.

The price of F5 BIG-IP AFM is a little more expensive than other firewalls on the market.

I rate the price of F5 BIG-IP AFM an eight out of ten.

We are using F5 BIG-IP AFM because it has more stability and supports for devices, and provides a lot of online support materials, such as videos, for engineers for troubleshooting.

My advice to others is if you start to apply the initial design in your network, can achieve more benefits using the F5 BIG-IP AFM module as it can work as a perimeter firewall. It it has many features, such as DDoS, GTM, and Global Traffic Management.

I rate F5 BIG-IP AFM an eight out of ten.

I gave a high rating because there are many use cases this solution can be used for and it can be used similarly to an orchestrator in the network.

We use these as our data center firewalls. At the time of our analysis of the systems, they were the ones able to process the large load of traffic that we needed over any other systems out there. So, capacity-wise, these were able to address our needs.

We have version 12, version 13, version 14, and version 15.

We're a media company, and it provides security around very sensitive content. It provides security for content before being released.

Its performance and ease of use are valuable.

There should be simplified and better integration with BIG-IQ. There should also be a more modular approach. I believe they are working on it, and it is just a matter of deployment.

I have been using this solution for eight years.

It is stable.

It is scalable. There are 20,000 to 30,000 people who use it on a daily basis. Their roles vary from content editors to content viewers at different levels of the organization. Its usage might increase.

I would rate them a four out of five.

We have got different products. We have got different vendors for firewalls. We have Palo Alto, Juniper, Cisco, etc.

It is pretty straightforward. The duration depends on our typical deployment scenarios. Usually, it takes about three months from the time our projects are fully approved and all the way down to deployment. So, from initial installation to releasing the production, our deployment scenarios take three months.

Its maintenance is easy and simple. For maintenance, we need a staff of one.

It was implemented in-house. For deployment, we have different teams and levels, and they could be a team of five. We have another team for the day-to-day operations, and they could be anywhere from ten people.

For our requirements, we have seen an ROI.

We did look at different options. At the time we were looking at it, this was the only one that was able to perform at the level of performance required.

I would advise doing your homework. Do your research, and make sure you understand what the product is for so that you do not deploy it where it will not fit your needs. This is not a next-gen firewall. It is not meant to compete against next-gen firewalls. It is meant primarily for DNS type of things. That doesn't mean it can't do next-gen tasks, but the way I see it and the way I understand it, it is more for data centers.

I would rate it an eight out of ten.

We primarily use the solution as a data center firewall. 

It offers a border between the DMZ, the demilitarized zone, and the rest of the data center. We already have an F5 solution over there with some other models included. This additional model is something extra that can make a difference in security protection.

The protection is very useful. 

The solution is stable. 

Once you understand the logic, it's straightforward to set up. 

We seem to have confusing logic from the solution itself. This needs to be addressed. 

For configuring the firewall, every single vendor on the planet has pretty much the same logic when it comes to firewalls, and F5 has a completely different approach and completely different behavior. When you first encounter the AFM, it can be really complicated to understand and find a way how to achieve the desired configuration. It's not logical. It's completely different than any other solution. In the end, it gives you similar results - just in a much more complicated way.

Technical support could be better.

I've been using the solution for the last three years. 

The solution is really stable. There are no bugs or glitches. It doesn't crash or freeze. 

The scalability and cost-effectiveness of the solution is really good. Hardware appliances can forward some crazy amounts of traffic. However, this is not like all other firewalls. Scalability is pretty much somewhere in the middle. You always have some additional models on the same hardware or even in virtual machines. In general, it's not good, and it's not bad. You need to take everything into account.

Technical support is not that great.

The solution itself works perfectly. That said, if there is an issue and when you open the ticket, nobody picks up the ticket for ages. It can be a problem.

Negative

The initial setup is illogical, which makes it difficult. 

Basically, as a user, you are expecting something,  it's not easy to achieve that since logic is way, way different than any other firewall. That's the only reason why it can be hard to configure. Once you understand how the solution is processing the traffic, it becomes extremely easy.

The deployment only takes four days. 

I didn't have any cases where the AFM was the only module or where we started deployment of the solution from scratch. We always used it as an additional service on an existing platform. Therefore, you have F5 already deployed with, let's say, Access Policy Manager or maybe an advanced firewall verification firewall; that's an extra service where we are enabling one more functionality regarding that AFM. 

The first step is configuring the virtual service that moves the traffic and configuring the policies, rate limits, protection, and similar things. After that, we validate the configuration and eventually fine-tune everything before putting it into production.

The deployment pretty can be done by one man, no more than that. It's not that complex of a solution. It's a basic layer for the firewall and nothing more than that. In the cases where you have 3,000 policies, that could be time-consuming; however, in the end, one person can do it without any issues.

It requires, not maintenance in general terms, where you have something to patch or something to do with that. However, if change requests are considered, every now and then, you will have to allow some different things and maybe reconfigure some existing policies to include something that was not included or needed before. That's common practice.

In most cases, after that initial deployment and knowledge transfer, the customer itself is able to manage the solution.

When you are using it with another solution from F5, it's an excellent addition, and you get a lot of discounts, so it's affordable. In that case, the ROI is really nice. However, if you are using it as a standalone solution, I don't even know if that's comparable to other vendors or not. The ROI might be slightly below average. In that case, I'd rate the ROI at four out of ten.

The pricing is somewhere in the middle. It was not expensive and not cheap. 

The license itself is perpetual. Or you can get subscriptions. However, it is more than likely to be perpetual since you don't need any live feeds.

You can get separate subscriptions for threat intelligence, IP intelligence, and geolocation, yet you don't need any kind of subscription for the firewall itself.

Support is also an additional expense. 

We're resellers. We're using the latest version of the solution. 

Chances are, as a standalone product, you can find a better firewall at the same price. 

It's limited with functionalities, so there is nothing really nice about AFM except that if you already have an F5 stack of solutions on hardware or on virtual infrastructure, and you are adding this license, in that case, it makes sense. Any other case doesn't simply work. That doesn't make sense. 

I'd rate the product five out of ten. 

We primarily use the solution as a firewall. 

We use it to block or allow traffic inside the infrastructure.

Usually, if we want to tie it up to another service, we usually use AFM. The reason we use AFM is due to the fact that we have Anti-DDoS equipment and the components in order to mitigate those attacks, we use a combination of AFM, ATM, and GTM.

It's deployed in order to allow or deny traffic for us. It controls the flow and acts as a layer of security. It also is able to handle routing. 

The security is quite good. It allows us to block certain addresses. 

It is stable. 

Support is quite helpful.

We have witnessed an ROI. 

Some spam can go by the firewall. The processing is a bit slow, and spam can get by. 

We'd like to be able to do a deep packet inspection. We haven't enabled that. Hopefully, the next-generation firewalls will be able to do that for us.

The solution is a bit pricey. 

I've used the solution for around four years. It's been a while. 

The stability is okay. I'd rate it seven out of ten overall. 

The scalability would be based more on the hardware aspect. I'd rate its ability to scale at a six or seven out of ten, since it is rather fixed. It's still hardware and not fully virtualized, which makes scaling limited. 

Technical support is pretty good. I do find them to be mostly helpful and responsive. 

Positive

I have also used Check Point in the past. I've also used a few other firewalls as well. 

I wasn't directly involved in the initial setup. When I arrived at the company, I was more on the operations side of things. 

We have witnessed an ROI while using the product. 

The solution is a bit expensive. I'd rate pricing four out of ten in terms of affordability. 

Companies should implement the solution if they have the budget. If you're going to deploy a security firewall device, this is a helpful solution.

I'd rate the solution seven out of ten. 

F5 BIG-IP AFM is deployed on-premise and in the cloud.

We are using F5 BIG-IP AFM mostly for financial services.

F5 BIG-IP AFM has improved the way our organization functions.

The most valuable feature of F5 BIG-IP AFM is all of my workers enjoy using it.

I have been using F5 BIG-IP Advanced Firewall Manager (AFM) for approximately 11 years.

F5 BIG-IP AFM is very good.

The scalability of F5 BIG-IP AFM has been very good.

We have approximately 3,000 users using this solution in my company. If we have another system we will increase our usage.

The support that we receive from the F5 BIG-IP AFM has been very valuable.

Positive

I previously used Cisco solutions and I switched to F5 BIG-IP AFM because of the superior support.

The initial setup of F5 BIG-IP AFM in a complex environment was simple. However, the full deployment took us approximately one year.

We did the implementation of F5 BIG-IP AFM in-house.

We have seven people that are maintaining F5 BIG-IP AFM.

F5 BIG-IP AFM is an affordable solution. There were not any additional fees other than the standard licensing.

I rate F5 BIG-IP AFM a ten out of ten.

I am using F5 BIG-IP Advanced Firewall Manager (AFM) for load balancing and an IP gateway.

The most valuable features of F5 BIG-IP Advanced Firewall Manager (AFM) are the web gateway, load balancing, services, and applications available.

The web gateway feature could improve in F5 BIG-IP Advanced Firewall Manager (AFM).

In the next release, the automation and AI aspect are very important nowadays, particularly from the incident point of view. I know they've added automation and AI in the recent update, but it could improve. The solution comes with devices and is more device-based, but it could be beneficial to have a software-defined load balancer. If there were less hardware it would save on costs.

I have been using F5 BIG-IP Advanced Firewall Manager (AFM) for approximately five years.

F5 BIG-IP Advanced Firewall Manager (AFM) is a stable solution. I have not had many issues.

The solution is scalable, but there are costs involved.

We have approximately 10,000 users using the solution. The solution is being used daily.

I rate the technical support of F5 BIG-IP Advanced Firewall Manager (AFM) a four out of five.

They're responsive and have always have pointed helped out when we had issues.

The initial setup of the F5 BIG-IP Advanced Firewall Manager (AFM) is of a medium level of difficulty. There are technical elements that are required to set it up.

We used the vendor to help us do the implementation.

F5 BIG-IP Advanced Firewall Manager (AFM) is an expensive solution. They are one of the best in the market, but the price could be cheaper.

I rate the price of F5 BIG-IP Advanced Firewall Manager (AFM) a three out of five.

There are competing solutions in the market. In terms of what F5 BIG-IP Advanced Firewall Manager (AFM) offers, from the load balancing point of view, I think they are one of the best. When it comes to firewalls and other solutions, there are better ones, such as FortiGate, Cisco, or Huawei. As a firewall, they are not the best. However, for load balancing, they're the best.

F5 BIG-IP Advanced Firewall Manager (AFM) is a popular big brand name behind it. However, it is expensive. Everything that is being used by large corporations is going to have a high cost.

I rate F5 BIG-IP Advanced Firewall Manager (AFM) a seven out of ten.

CGNAT is one of its strong areas. 

If you're looking for a plain vanilla firewall or IPS, then this is a good tool. If you compare it with the next-generation firewalls, then definitely this tool is not comparable. The next generation tools are user centric and application centric at the same time.

I have experience with F5 BIG-IP Advanced Firewall Manager (AFM).

It is a highly stable solution. 

It is a scalable solution. 

I think com configuration of (AFM) is comparatively little better than LTM because one is that Sentry is not very feature rich. And because of that reasons, configurations are comparatively easier because when you deploy it as a plain, when you need a firewall or firewall or IPS. So it's it's not very difficult as such.

As per pricing, I would not say cheap, but little higher than cheap, but not very expensive. So you can say kind of value for money solutions.

Overall, i would rate the solution a seven out of ten. 

The product’s most valuable features are LTM and WAF.

F5 BIG-IP Advanced Firewall Manager's pricing and technical support services need improvement.

We have been using F5 BIG-IP Advanced Firewall Manager for four years.

It is a stable product.

The application is scalable.

The technical support services are complex in terms of direct communication compared to Fortinet. We only receive support easily for patch upgrades and configuration.

The product is easy to deploy. A basic configuration takes around two days to complete fine-tuning and policy setup. The deployment consists of two steps including deploying it in monitoring mode including observing traffic without blocking. The second step is to verify and observe traffic patterns and then switch to system mode to block malicious traffic. It being a continuous process, takes some more time for analysis.

The product is expensive compared to Fortinet, which has similar functionality. They offer one, three, and five-year license subscriptions.

I rate F5 BIG-IP Advanced Firewall Manager an eight out of ten from other users. It holds a challenger’s position in Gartner, closer to leader products. Its migration feature is complicated for on-premise versions compared to Palo Alto, Fortinet, etc.

I recommend the product to businesses with a considerable budget. I recommend Fortinet to other users.

We are using this solution for protection and blocking IPs for our customers.

The most valuable feature of this solution is that the blocking of IPs.

F5 has many advantages.

Currently, we have eighty F5s and we need some kind of management software. It would be very helpful. 

In the next release, I would like to have management and monitoring software included.

I have been using this solution for three years.

It's very stable.

It's not as easy to scale because you have to purchase new hardware to scale up.

I am satisfied with technical support, they are fairly widespread.

The initial setup was complex.

Some of the rules were not easy to do and it can take a fair amount of time to deploy.

I am doing the maintenance of this solution.

It's very expensive, and you pay extra for the models.

I recommend this solution to others who are interested in using F5 Advanced Firewall.

I would rate this solution a ten out of ten.

We primarily use the solution to protect and to divide cells. We are not using AFM as a standalone product. We are using AFM with the LTM module, as a module. The main purpose of F5 is to use it as an ADC application to deal with the console.

The DDoS is the solution's most valuable feature.

The support that the product offers is good. 

When you buy an F5 as an appliance, you are buying licenses as well. If you buy both LTM and AFM licenses, you can protect your servers in a one-off solution. You don't have to buy another firewall to protect your servers. It makes security really easy.

The decryption is great.

We aren't using the most recent version. The most recent version is 15. Therefore, there may have been improvements on the solution we're not aware of.

The should add, if they aren't already going to, some features surrounding location awareness, station awareness and segregation of users. I'm not sure of which version supports these items and which port version doesn't. However, I hope they will continue to develop out the product to ensure they are included.

In order to overcome some of the problems in the industry, I would like to see the solution offer a hardware device with strong ASICs, and a stand-alone AFM tool to prevent attacks. 

I've been using the solution for two years or so now.

The solution is pretty stable. If you do happen to find a bug, they will provide you with a patch to solve the issue. You can also go to their website where they will list all of the bugs that are associated with each version. They make it quite transparent.

The solution is scalable because it doesn't depend on hardware. If you run this product on a Viprion, it will be scalable, but not too much. If you run the same product with the same version in a standalone device or on a virtual system, you will use the power and scale of the associated device. It's scalable because you are able to use the same product in different hardware. If you buy a powerful server, and you can scale your F5 as a virtual system easily.

I don't really reach out to technical support, so I wouldn't be able to assess it.

The initial setup is very straightforward. It's not complex. It just takes a few steps and you are finished.

Deployment times vary according to the customer. It needs to be heavily configured. You need to look and you need to observe the behavior of the traffic before you can start configuring everything. It can take time.

In terms of deployment, a powerful deployment actually needs a minimum of two people and one of them needs to speak with the developers because the developers are protecting the source. They will help you to understand the requirements. After the assessment of the requirements, the users can deploy and test the solution.

Maintenence also varies by customer, however, once it is configured, unless you are adding extra servers or adjusting things, there doesn't need to be any maintenance. You can just leave it alone for the most part, so you will only need one person to check on it.

I help my clients deploy the product to their systems.

While some companies have now started to move these devices from on-premises to the cloud, most companies prefer not to do this due to security reasons.

I'd rate the solution eight out of ten. It's a good product, but it may not be the absolute best on the market. Companies should examine NGINX or Palo Alto or others and compare them to see what would work best for their organization.

I would recommend the solution.

It's great for protecting servers from attacks. With controllers plus the firewall, you will only need one device to protect everything.