What is our primary use case?
We are still working with Cloudflare at my company, bKash Limited, and we continue to use Cloudflare's Cloud WAF solutions and anti-DDoS solutions.
We are using three solutions from Cloudflare. One is their DNS solution. For our on-premises workload at bikash.com, the primary DNS solution for authoritative DNS is Cloudflare's DNS solution. All traffic for the bikash.com domain is routed through Cloudflare's Anycast solution and Anycast IP. We are advertising this through Cloudflare, and Cloudflare protects our web application and API through this solution for our on-premises infrastructure. This represents 40 to 45% of our workload traffic.
We are using Cloudflare's image optimization feature called Turnstile for CAPTCHA. In some of our applications, we were previously using Google reCAPTCHA, but we are now replacing Google reCAPTCHA with Cloudflare's Turnstile solution for DDoS protection.
What is most valuable?
Cloudflare's WAF features help us address security threats including SQL injection and cross-site scripting because these protections are automated. In other solutions, we use F5 for our distributed cloud for our AWS and other workloads, and we have to configure those solutions manually. With Cloudflare, those are predefined configurations. We do not need to perform any configuration ourselves, and they ensure protections.
Cloudflare's DNS services deliver the best performance in terms of speed and reliability. We are also using AWS Route 53 for bikash.sh, where our 65% workload is located, but we feel more secure with Cloudflare rather than AWS Route 53 for authoritative DNS.
Cloudflare's custom analytics provide insights into user interactions and security vulnerabilities because we receive good information from the security dashboard about where our traffic originates and from which networks we receive the most attacks. These are valuable features, and I would say they are an added advantage from a monitoring perspective.
Their analytical dashboard is comprehensive because they provide substantial information and features that I find valuable.
What needs improvement?
From a security perspective, there remains a security loophole, as some browsers in the market can bypass the Turnstile solution, which requires approximately 40 seconds to do so. From a performance perspective, this is acceptable. We also tried Google reCAPTCHA, and that can also be bypassed. From a security perspective, I would say neither solution is completely secured.
Regarding uptime, we have faced a couple of incidents due to Cloudflare in recent years, so I cannot say we receive 100% uptime for our region. We sometimes face challenges, including downtime and other issues. As a result, we are not receiving 100% uptime from Cloudflare's solution. Since most of our customers are in this region, we need alternatives. We need something more competitive than Cloudflare. Unfortunately, in Bangladesh, Cloudflare has three points of presence already, and we cannot find any other solution provider in Bangladesh as an alternative, which presents another challenge.
Competitor solutions have more attack signatures, which ensure better security compared to Cloudflare's predefined configurations. Customers do not have options to modify any configuration parameters in Cloudflare, whereas other competitor solutions, such as F5 Distributed Cloud, allow customers to tune configurations according to their requirements. Cloudflare could improve in this area. Additionally, regarding visibility, Cloudflare has static visibility, but they could adopt dynamic graph features for their customers.
For how long have I used the solution?
We have been using Cloudflare since 2018.
How are customer service and support?
I would rate their technical support as average, neither particularly good nor poor.
Cloudflare's technical support presents challenges. First, because they are dealing with live traffic as an emerging service, their response time should be more consistent. Currently, we use other solutions where support is available through Slack channels and is more interactive, with someone responding within a couple of minutes or seconds. We also see solution providers that offer AI-based responses, providing solutions from their knowledge-based database whenever an issue occurs. Cloudflare operates traditionally with a portal where we must raise a ticket, and an engineer will engage and respond within two to three hours. This is why I rate them as average, and we need more proactive support from Cloudflare.
How would you rate customer service and support?
Which other solutions did I evaluate?
We are also using AWS Route 53 for bikash.sh, where our 65% workload is located.
From an analytical perspective, we are also using DataDog and F5 WAF solutions, all with interactive dashboards. However, Cloudflare only has some predefined dashboard visibility, and the graphs are actually static and not dynamic. Other solutions have dynamic representations, but while Cloudflare provides substantial information, the representation could be much better.
I would recommend Cloudflare to other companies. However, I would recommend F5 XC Distributed Cloud first as my top priority, and then Cloudflare as my second priority.
Which deployment model are you using for this solution?
On-premises
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: My company does not have a business relationship with this vendor other than being a customer.