Try our new research platform with insights from 80,000+ expert users

Barracuda Web Application Firewall vs F5 Advanced WAF comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 1, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cloudflare
Sponsored
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
75
Ranking in other categories
CDN (1st), Distributed Denial-of-Service (DDoS) Protection (1st), Managed DNS (1st), Cloud Security Posture Management (CSPM) (14th)
Barracuda Web Application F...
Average Rating
8.2
Reviews Sentiment
7.5
Number of Reviews
44
Ranking in other categories
Web Application Firewall (WAF) (18th)
F5 Advanced WAF
Average Rating
8.6
Reviews Sentiment
7.2
Number of Reviews
69
Ranking in other categories
Web Application Firewall (WAF) (2nd)
 

Featured Reviews

Spencer Malmad - PeerSpot reviewer
It's easy to set up because you point the DNS to it, and it's working in under 15 minutes
Cloudflare is highly scalable. Cloudflare is a system with a web portal that the end users like me see. It's a console where we can adjust the DNS, caching, and security features all in that console. Cloudflare owns thousands of servers across the world that cache the data. It's a powerful solution. When clients sign up for Cloudflare, they're getting this monster content delivery network, security, and a web application firewall in one. It's all rolled into one, and it's massive. Unless you have your website hosted on a massive hosting provider, there's no way that you can deliver the amount of data that Cloudflare can provide to the end users. If you have static content, there's no way that you can ever match what Cloudflare can do. Obviously, there are competitors to Cloudflare that do the same, but I'm saying other types of solutions. Let's say you go with F5. Great, that's on-prem. That's in your colo. You can't deliver as much data to the internet as you can with a CDN. You don't have to spend $20,000 on a net scaler, F5, or whatever Cisco's selling now. You don't have to buy that. You pay them $50 a month or $150 a month. It's totally worth it because even in five years, you'll never get the performance value, not just the actual ROI. You have to consider how much throughput you can get with Cloudflare.
Anne-Aimee Wollerich - PeerSpot reviewer
Managing bot traffic effectively enhances usability for non-technical users
Barracuda Web Application Firewall ( /products/barracuda-web-application-firewall-reviews ) lacks some of the more specified and structured features offered by solutions like Tenable. Although Tenable is more expensive and less easily deployable, its features are more deepened and chiseled, particularly for IT personnel. For example, Tenable provides more comprehensive dark web scanning capabilities, which Barracuda could improve upon.
Richard Polyak - PeerSpot reviewer
Easy event identification, highly stable, and customizable
Generally, F5 Advanced WAF initial setup is straightforward. However, our environment was more complex and it took us a little more time to customize the solution to where we needed it to be. Additionally, the customization didn't rectify everything. We had to do customization to a certain event to prevent attacks that it wasn't catching, but that might not necessarily be the solutions' fault. It could be more of our setup than the solution's fault and not being able to run the latest version or the newer version could be more of a limitation on our ability to put it in the right place. The whole implementation to have the solution run at the level we wanted it to take approximately five months. Our company's environment is one that we can't put a canned solution in front of. Our environment, cannot have a canned solution that might fit everybody else because of how customized this environment is. It does need a lot of tuning to meet our environment's requirements. I rate the initial setup of F5 Advanced WAF a three out of five.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"When using services like Heroku, Cloudflare is very useful for CNAME flattening. I also use it for their end-to-end SSL with TLS authentication on nginx for securing servers."
"The most valuable feature is the web application firewall."
"The tool is user-friendly."
"Cloudflare consolidates various capabilities into one product, streamlining processes."
"It is easier to configure and develop documentation to see how we have configured firewalls."
"Generally, I am satisfied with this product."
"The DDoS protection is the most valuable aspect of the solution."
"The web application firewall brought us good security and a view of the accesses/blocks of the entire domain and subdomain that were accessed both by region (country) and IPs."
"What I like most about Barracuda Web Application Firewall is its availability. I also like that it's an easy-to-use solution."
"The installation is straightforward."
"It is stable and the performance is good."
"The volumetric DDoS defense is very good because I had a problem with a lot of volumetric DDoS attacks on my servers. After using Barracuda, those attacks have stopped and all the traffic is going smoothly to my servers and the system is working really well."
"The most valuable features of Barracuda Web Application Firewall include advanced bot protection, DDoS protection, and addressing the top ten vulnerabilities."
"Its recommendation about the probabilities on the website is great. It also has free probability managers for the website, which is really helpful. The protection engine, signature-based protection behavior, and analysis features are also great. It also has an ATP module for sandbox scanning and behavior analysis for file uploads."
"Data leak prevention is very important and ensures protection against attacks."
"Even when we were upgrading to a new OS, we didn't have any difficulties with the product. The stability is good."
"The most valuable feature is that it is secure."
"With F5 Advanced WAF, it was protection for online publications and for our customers that caused us to choose the platform."
"The anti-bot protection is the solution's most valuable feature. Safe-guard or credential staffing are also useful features."
"The most valuable feature of F5 Advanced WAF is its grand unity of the implementation, where you have the freedom to configure based on how it affects your use case or your organization. With the default setting of implicit deny, you can gradually start defining and deploying the tool to align with your environment, whether it is outdated, recent, or futuristic. This allows you to customize the solution to protect you from threat actors. You have the ability to define what the advanced threat act should do - whether it should alert, deny, or both - and it will deliver based on your configuration. Unlike other online solutions, F5 Advanced WAF provides flexibility to deliver to your unique environment the way you want."
"I like the security features, especially against SQL injection."
"In terms of F5 Advanced WAF's most valuable features, I would definitely say its stability. F5 is one the most stable products. Either as the load balancer or the web application firewall, it is very stable."
"The solution is easily accessible on mobile and laptop devices."
"The solution isn't too expensive. The license allows you to license what you need and leave out what you don't need."
 

Cons

"There should be a specific price list for enterprise-level customers."
"There could be more courses with engineers. I like e-learning, however, having a specialist in a classroom is more comfortable for me."
"For large enterprises, the pricing is okay. However, the enterprise price for small projects is a bit high. A mid-tier pricing option would be beneficial."
"The pricing could be improved."
"Cloudflare's console should be made more user-friendly."
"It would be beneficial for us if Cloudflare could offer a scrubbing solution. This would involve taking a snapshot of my website and keeping it live during a DDoS attack, ensuring uninterrupted service for our users. DDoS attacks are typically short in duration, and having Cloudflare maintain the site's availability from its secure network would enhance the overall user experience. I would appreciate it if Cloudflare could consider implementing this feature. Many organizations already utilize similar capabilities in their CDN platforms, where a static snapshot of the web page is displayed during DDoS attacks. In terms of features, Cloudflare needs to enhance its resilience and stay more focused on adopting new technologies. For instance, solutions like F5 XC Box, Access Solution, and Distributed Cloud Solution have impressive features, and Cloudflare should strive to match and exceed those capabilities. There's a need for improvement in areas like AI-based DDoS attacks and Layer 7 WAF features. Cloudflare should prioritize enhancements in areas such as behavioral DDoS and protection against SQL injection attacks, considering the prevalent trend of public exposure to the internet for business reasons. Overall, Cloudflare needs to invest more in advancing its feature set."
"We are a product integrator and reseller, and we would like to have a better partner relationship, similar to a channel sales relationship. Sometimes we are on our own or get diverted by Cloudflare because they have direct sales, which competes with us and makes it difficult to build a relationship with this company since we want to be an MSP or a managed service provider for the solution."
"Technical support is lacking."
"The incident reporting needs to be improved."
"Barracuda Web Application Firewall’s scalability needs improvement."
"Its interface can be better. It is not very friendly."
"They could improve their performance, support, and their upgrades. Their updates used to be good. Their improvements were right on the money but nowadays, the updates are minor."
"An area for improvement in Barracuda Web Application Firewall is attack identification. Other banks identified attacks and tracked logs that the solution wasn't able to identify because of its ready-made rules pre-deployed by the vendor. My organization raised this issue with the technical support team. Another area to improve in Barracuda Web Application Firewall is its service desk. The team resorted to stonewalling because they couldn't accept that a feature was missing in the solution, and it was only after a lot of drilling down that the service desk team accepted that, and would be adding that feature in the future. My organization had to submit a report to the Reserve Bank of India with information on the logs identified and the attacks that happened, and that there was a failure on the part of the Barracuda Web Application Firewall. The Reserve Bank of India conducts a tri-monthly cyber risk audit in all Indian banks. Even smaller banks identified and caught attacks that my organization wasn't able to do, so I was looking into other solutions that competitor banks could be using because Barracuda Web Application Firewall failed to identify some of the attacks."
"I have found F5 more stable than Barracuda Web Application Firewall. They should improve the stability."
"I have to go to an individual obligation, make changes, and come out, and go to the next obligation and make the same changes. There is no grouping option."
"The GUI needs to be improved because it sometimes hangs and needs to be restarted."
"F5 Advanced WAF could improve resource usage, it is CPU intensive. Additionally, adding automated remediation would be a benefit. For example, an easy button alerts us of the events that are occurring, and what we want to do at the time. An automated approach where somebody could be alerted very quickly. Instead of going and reconfiguring everything, an automated approach is what I'm looking at."
"There is a learning curve that extends the time of implementation."
"There should be more ability to rate limit certain scenarios. The majority of the time, it is either on or off. For certain types of use cases, there should be the ability to rate limit, not just enable or disable."
"The delay times on firmware patches and software updates could be better and improved."
"The BNS module needs improvement."
"F5 Advanced WAF could improve on its funding for WAF features. There is a need to be more advanced WAF features."
"The overall price of F5 Advanced WAF could improve."
"F5 Advanced WAF could improve the precision of the scanning. There are many false positives. They should improve their threat database."
 

Pricing and Cost Advice

"The product's pricing is cheap."
"The tool is a premium product, so it is very expensive."
"So far I use free tier and happy with it. You can subscribe to business package if needed."
"I think the pricing is competitive. I think as far as licensing is concerned it's pretty straightforward because it's based on domain. It's just that sometimes domains could be tricky with some customers."
"In terms of licensing costs, we don't pay for licensing for Cloudflare. We only establish communication, then for peering, Cloudflare takes care of the cross-connection in different data centers."
"That is one of the great features. I was able to access the majority of the features and services for free."
"There are no additional costs beyond the standard licensing fees."
"We are using the free tier of the solution."
"The pricing is reasonable."
"They only offer a yearly licensing plan."
"For small companies, the price is very expensive because the WAF is an enterprise-level application, not intended for smaller businesses. In my opinion, the price is right for enterprise-level use."
"The price of this solution is okay."
"The product is expensive."
"The price of the solution is a little expensive. There is a license for this solution and it can be purchased every one, two, or five years."
"The solution is based on a licensing model and might be $360 for the hybrid version."
"While I would have to check on the price of the solution, I feel it to be okay and it matches the market price."
"I rate F5 Advanced WAF's pricing a three out of ten."
"F5 Advanced WAF's pricing is high."
"Its price is fair. We have done a couple of deals where they were able to give some kind of discount to the customers. The price was initially high for the customers, but after a couple of negotiations, it came within their budget. They were happy with that."
"I would rate the pricing as seven out of ten"
"The cost is slightly above average."
"F5 Advanced WAF pricing structure should be adjusted to meet the need of small to medium-sized companies."
"As far as the pricing of F5 Advanced WAF I would rate it a four out of five depending on what features I am looking for. Imperva is more expensive."
"F5 bundles up services and the bundle is what you pay for rather than individual components."
report
Use our free recommendation engine to learn which Web Application Firewall (WAF) solutions are best for your needs.
849,686 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
17%
Computer Software Company
14%
Comms Service Provider
9%
Financial Services Firm
8%
Computer Software Company
20%
Financial Services Firm
10%
Government
7%
Educational Organization
6%
Financial Services Firm
15%
Computer Software Company
13%
Government
8%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Cloudflare. We are moving from Akamai prolexic to Cloudflare. Cloudflare anycast network outperforms Akamai static GR...
Which would you choose - Cloudflare DNS or Quad9?
Cloudflare DNS is a very fast, very reliable public DNS resolver. It is an enterprise-grade authoritative DNS service...
What do you like most about Cloudflare?
Cloudflare offers CDN and DDoS protection. We have the front end, API, and database in how you structure applications.
What do you like most about Barracuda Web Application Firewall?
It significantly improved our overall web security posture, addressing intrusions and enhancing control over web URLs...
What is your primary use case for Barracuda Web Application Firewall?
Our primary use case was to track the traffic on websites or webshops to identify potential malicious actors, such as...
What is your experience regarding pricing and costs for Barracuda Web Application Firewall?
The pricing for Barracuda is quite high compared to other OEMs. Each transaction requires my purchase team to negotia...
What do you like most about F5 Advanced WAF?
It's a fairly easy-to-use and user-friendly tool. My administrators and team also like its ability to customize the r...
What is your experience regarding pricing and costs for F5 Advanced WAF?
Subscription models have competitive pricing, while perpetual licenses involve an upfront higher cost, leading to amb...
What needs improvement with F5 Advanced WAF?
F5 Advanced WAF sells perpetual licenses as perpetual assets during sales without informing me that support ends afte...
 

Also Known As

Cloudflare DNS
No data available
No data available
 

Overview

 

Sample Customers

Trusted by over 9,000,000 Internet Applications and APIs, including Nasdaq, Zendesk, Crunchbase, Steve Madden, OkCupid, Cisco, Quizlet, Discord and more.
Oracle, CBS, Pioneer, Hyundai, Publix, Barnes Noble, Calzedonia, Nordstrom, Samsung, Nascar
MAXIMUS, Vivo, American Systems, Bangladesh Post Office, City Bank
Find out what your peers are saying about Barracuda Web Application Firewall vs. F5 Advanced WAF and other solutions. Updated: April 2025.
849,686 professionals have used our research since 2012.