F5 Advanced WAF Reviews

We use the solution for load balancing.

They should improve the capability, and then they should work on the virtualization of NGINX. Currently, most environments are virtualized. F5 Advanced WAF will not be able to protect it.

I have been using F5 Advanced WAF as a reseller for 5 years.

Technical support is good but not enough. It takes a lot of time to get support.

Neutral

The initial setup is not so easy nor not so complex. There is a learning phase, and there are policies to apply. It complies with regulations. Recently, we used it for Formula One, and it proved very effective.

ROI is covered in one year. You can see how it protects and mitigates damages in the network.

The product is not so expensive. It depends on the assets.

There are other solutions for data loss prevention, such as Symantec and IP solutions. There are options available for DNS blocking. While these solutions may specialize in certain aspects, They offer comprehensive coverage across various areas. Each vendor specializes in different aspects, but F5 Advanced WAF excels in its particular domain.

I recommend the solution. Most of the environment is going to virtualization.

Overall, I rate the solution an 8 out of 10.

We use F5 Advanced WAF to protect web applications on HTTPS, APIs, and portals.

F5 Advanced WAF helps our engineers to learn the complete configuration, including fundamental and advanced policies.

Most customers encounter stability issues with the product's Big-IP logs. It works slowly while retrieving logs.

We have been using F5 Advanced WAF since this year.

The product is more stable than Fortinet.

The product has modular appliances. It works well, scalability-wise.

The technical support services are good. The team includes professional engineers to communicate with the customers regarding cases.

It is easy to set up F5 Advanced WAF. Although, it is difficult to deploy and maintain compared to Fortinet. The deployment process involves gathering customer information regarding virtual servers to be protected. Later, we select the best design suitable for their requirements and start with license provisioning. Further, we configure LTM with special servers and nodes and proceed with configuring the security policy and advanced directory. It takes a week to protect the infrastructure fully. Once we have license provisioning, it is good to run.

F5 Advanced WAF's pricing is high. Fortinet and some other vendors are more affordable.

F5 Advanced WAF has good capabilities, powerful tools, and professional services. I advise others to compare pricing with vendors in terms of their use cases before purchasing the product.

I rate it a ten out of ten.

It is used for application security and load balancing. As we have a few customers who are using banking applications, and stock market applications, they are more concerned about security and how to protect the product and their business applications. And that's why we offer security applications. Besides that, there are new features for load balancing in the F5.

Customers find the load balancer feature as the most valuable.

The tool needs to improve its pricing. 

I have been using it for two years.

It is a very stable product. It is the favourite product of banking customers in Egypt.

It is a very scalable product. You can write down any iRule you want as it is very convenient.

We used Citrix ADC, Fortinet FortiWeb, and Barracuda before F5 Advanced WAF. We switched to F5 Advanced WAF due to its efficiency and the port lockdown feature that the customers in Egypt like. Also since it's certified by Gartner, the customers feel confident using it.

The initial setup was simple.

If you are looking for a really good product, you should consider F5 Advanced WAF.

I would rate it a nine out of ten.

It protects our public entities. Its use case is very directed at a resolution of security.

It protects our environment. It protects our entities.

Identification, ease of use, and ease of modifying it to most of our needs are valuable.

There should be more ability to rate limit certain scenarios. The majority of the time, it is either on or off. For certain types of use cases, there should be the ability to rate limit, not just enable or disable.

It is a very CPU-intensive application. I understand why, but I'm hoping that they could optimize the CPU utilization a little bit better.

I have been using this solution for eight years.

It is stable.

It is very scalable for what we need. It is a public-facing service. So, everybody on the internet would be able to utilize this type of service.

We are exploring areas to increase its usage.

I would rate them an eight out of ten.

Positive

We used other public entities for similar use cases.

It is pretty straightforward. A typical setup for these types of projects takes three months.

It is all done in-house. We do everything in-house. 

In its maintenance, I and other people are involved. The daily operations, which include modifying policies, are up to the individual application owners because they understand their applications a lot better than I or our standard operating team would. So, their usage might go higher than mine.

We have very much seen an ROI. It protects our revenue stream.

The way we deployed it, I would rate it a four out of five in terms of pricing.

I would advise doing your homework. It could be very simplified, or it could be very complex, but definitely, do your homework with the owners of the application because they understand the application more than certain people.

I would rate this solution an eight out of ten.

The most valuable features of F5 Advanced WAF are SSL uploading, signature, and anomaly detection. It is overall a high-quality solution.

The solution could improve by having an independent capture module. It has a built feature that you can deploy the capture on your published website. However, it's not very user-friendly. When you compare this feature to Google Capture or other enterprise captures, they are very simple. It needs a good connection to the F5 Advanced WAF sandbox. When you implement this feature in the data center, you may suffer some complications with connecting to the F5 Advanced WAF sandbox. This should be improved in the future.

I have been using F5 Advanced WAF for approximately 10 years. This includes my experience when the solution was  formerly named Advanced Security Module(ASM).

F5 Advanced WAF is an extremely stable solution.

I have found F5 Advanced WAF scalable.

Technical support is handy and useful when you have your contract available. Once you lose it, you are all alone and there is a penalty to extend your subscription.

I have used FortiWeb previously.

These products are not meant to be compared, because they are serving in different areas of expertise. When you are low on budget, it's better to use the FortiWeb. When you have a budget and want quality, it's most recommended to use the F5 Advanced WAF. We are talking about different classes of quality.

When you are using the F5 Advanced WAF for any reason, you have to employ an expert. It's not the same as other solutions, such as FortiWeb, it is not easy to use. It's an advanced device, and you have to have an advanced person to operate it. This is the biggest problem that F5 Advanced WAF.

The price of the solution is reasonable when compared with other products, such as FortiWeb. I am very satisfied with the price.

My advice to those wanting to implement F5 Advanced WAF is they will need to have an expert on any stage of operation. Then once they decide to use the F5 Advanced WAF they have to have very good expert advisors for choosing the product because there are a variety of license options, and you may spend more than what you need. 

In the implementation stage, you have to have experts. At least three experts for the implementation phase. When it comes to the operation, you can't have a temporary expert that comes and goes, you have to have the F5 Advanced WAF expert in your company. It's an advanced device. It's completely different from the FortiWeb and the other devices. It gives you lots of options but it's complicated to implement. You have to have an expert to support you.

I rate F5 Advanced WAF an eight out of ten.

We use it for ASM and ATF. I am working at the PCI company, and I am a manager of F5. I work with F5 WAF and ASF.

Currently, I use version 50.1.4, and I'm going to update to the new version, 50.144.1.

I like the solution for ASM. There is an online update certification, but access is locked so we couldn't use it.

I would like to see a better interface and better documentation compatibility with other products. It's more complicated with OWASP.

F5 has a learning university, but it's very complex. I teach other people, and it can be confusing with the different versions of software. It's very hard to support that.

I've been working with this solution for four years.

The product is very stable. It is a PCI company, so there are 10,000-12,000 people using the solution. 

My TLS connection is unlimited, so I have a lot of clients because of internet payments. All of the internet payments are behind the ASM for the F5.

It's scalable and very easy to manage.

I worked with FortiWeb for a few years. It's a good product, but it's not very good for a big company. So we decided to migrate to F5.

The initial setup is from a configuration utility.

I would rate this solution 9 out of 10.

In APM or IT intelligence, it's the best. But in the ASM model, it's not as good as a 40G for Palo Alto.

What a WAF is happens to be exactly what we are using F5 WAF for: a firewall for our web applications. It is a totally customizable solution. You have our signature-based rule sets and then we can customize to our heart's content depending on what our application can and can not do or what we are trying to protect against.  

So we are using this for anything that is internet-facing. We are applying the WAF there and we are putting it in block mode wherever possible.  

The features I think are the most valuable starts with the IP intelligence component. That is separately licensed and it is definitely one component that we have made heavy use of. Geo-blocking is another — which can be done without a WAF because you do not necessarily need a WAF to do it — but the F5 WAF has those capabilities.  

The signature-based controls that F5 has are another one of the heavier-used components that Advanced WAF has. We do not have to worry about updating signatures, et cetera. WAF will automatically update the signatures for us. I think that is a nice feature.  

Those are the biggest things that we are making use of month-to-month.  

I think the contextual-based component needs a lot of help. It is all based on regular-expressions. That is something I think companies like Signal Sciences are doing a really good job with. We are transitioning off to Signal Sciences on some of our WAF components because of the capabilities Signal Science has. I think that contextual-base signatures would definitely help in F5 WAF.  

Within the enterprise, F5 Advanced WAF (Web Application Firewall) has been rolled out for about six or seven years. I have been working on it for about three to four years.  

It is a stable product.  

F5 WAF is a scalable solution. A lot of the employees and other end-users (virtually anybody on the internet who is coming to your site) benefit from the solution. As far as the people who are directly dealing with the administration, maintenance, and deploying the updates, there are maybe two people. But it can certainly scale-out to service passive use.  

The F5 tech supports is fairly decent. It is not the top of the line, but they do their job. They give you an account team. The account teams are normally really responsive. When you need to run something by them, they are unlike some other products. With other products you have to go through opening up a ticket — because that is the only way they will respond to you — and later they might come back and say it is not their problem and you need to figure it out on your own. The F5 is very different from that perspective in providing support. Your account team is your go-to group. They will walk you through solutions, help you design solutions, and it is part of the value add of using F5Advanced WAF. I really liked them for the extra effort they put in to provide good support. They do not upsell professional services or anything like that. Because of that, I would rate them a little on the higher side for support than just your average support experience.  

The installation of F5 Advanced WAF is complex. Any WAF that you put in takes a lot of time to install correctly. You never really just drop it in and have it working right off the bat. The only exception I can say that I have come across to that right now is Signal Sciences. You can literally drop that solution in place and put it in blocking mode within the same day. With F5 there is a learning period where you allow it to learn and then you go back because it is based on regular expressions. So you have to go through and check to see that there is normal traffic going through your site, et cetera. In other words, there is training involved. It can take from seven to fourteen days before you get a good signature set up.  

If you just need to turn on the licensing key, that might take 10 seconds to do and that is available essentially immediately when you implement WAF. But when you are talking about implementation — and this is true with any WAF — it is time-consuming. You are integrating a piece of technology with applications that have already been written. It might be a legacy app, it might be a new app or whatever that you use for whatever your use case might be for that application. You are using WAF in order to protect that app. You have to invest time in creating the signatures. That period of time where you are creating the signature is what is complex and extends the period of the implementation.  

That is what I think the true difference is between F5 WAF and the new-gen stuff like Signal Sciences is. With Signal Sciences you literally can just drop in and turn it on.  

F5's licensing varies. I do not know exactly what the individual WAF component costs because they bundle up services and the bundle is what I pay for. I do not pay for individual components.  

Advice that I would give to people considering F5 WAF is to look at and consider other products as well. They have to make sure they know what they are getting into. That is key to finding the right solution. I think WAF requires a lot of time and patience as well as an understanding of your applications in order to make the best use of its capabilities.  

On a scale from one to ten (where one is the worst and ten is the best), I would rate the F5 Advanced WAF as a solid eight-out-of-ten.  

There is the Simple WAF and the Advanced WAF. We are currently working on the Advanced WAF, but previously, before the Advanced WAF came out, we were just using the Simple WAF.

We use the on-prem version because the cloud solution is not that popular here.

I have a customer here who has multiple applications dealing with the day to day operations. We have deployed the application firewall in the network and most of their web traffic from outside of their network comes into that WAF. This includes the email application Outlook and their own in-house application tools deployed that they use to sell their merchandise. They have a feature where you can transfer money to the other user based on their mobile phone number. So these web applications and in-house tools are the most used applications in their network.

In terms of F5 Advanced WAF's most valuable features, I would definitely say its stability. F5 is one of the most stable products. Either as the load balancer or the web application firewall, it is very stable.

Additionally, the method it uses to block attacks and the logging and support are very good. You can see anything you want in the logging and reporting section of the device, it is very detailed. These are two valuable features from F5.

If I had to summarize what needed improvement, I'd say they are currently in the process of updating their software. But more specifically, I would say their graphical interface, the GUI. I don't like the GUI as much as before, but now I think they're focusing on it. We are getting some new good features in the latest update. But there is still room for improvement on the user interface as well. It's easy to use. It's not difficult but it is not pleasing to the eye. Most of the time you want to see something dynamic, something like the reporting section or the system usage, the CPU, some detailed graphs, anything of that sort. So I guess they have some room for improvement there. Don't make it more complicated, just make it more pleasing to the eye.

We are using the most stable version. Because recently we got an email from F5 suggesting that if you have any user on the 14.1.2.0 that there was a vulnerability on that feature. And it was quite a severe one, so they asked us to immediately update that license to another version.

They currently have 15 versions, but they are not stable. They didn't recommend them to us. So most of the customers in Pakistan are using the 14.1.2.6 version. That is the most stable version and is recommended by F5.

My focus is normally on logging and reporting, because customers always ask for a clear reporting criteria. I would like it if they could simplify the reporting process. If I create something, I want to get a good report on it that I can read in seconds or in minutes. I don't want extra details in it. They should work on the exporting of the logging and reporting.

I have been using Advanced WAF since it came on the market last year. Advanced WAF is the advanced version of WAF which I have been using for three years.

F5 basically starts their hardware model from a 10GB distribution. So it is a good device to start with and in Pakistan we mostly have up to 40 or 60 gigabytes of devices.

As far as scalability is concerned, we already talked to the customer in detail about what kind of traffic they are expecting in the next five or seven years. Then we decide the box on that data basis and normally we don't have to worry about scaling later.

In terms of adding more features on the F5 hardware, that is a question based on the module. If it takes too much of the CPU, then it is difficult and scaling would be difficult with that hardware. If the hardware is not so many CPU's, then we have to dedicate to each module. Then the scalability becomes a bit difficult. But if you already have hardware that has CPU's in abundance, you can add as many modules as you want. There's no problem.

F5 lets you decide if you want to assign a specific module, a dedicated CPU or nominal resources. You can even decide if you want nominal resources or if you want full resources for that specific module. It all depends on the importance of that module in your business application.

If they are a small company, 250 to 500 employees, or less than 250, then we can go for the virtual Edition of the F5, because as I said, the hardware solution starts from a 10GB box. This can handle thousands of requests per second.

It would be a bit costly for a small scale business. If someone wants F5 and he has less applications and nominal users, he can go for the Virtual Edition. Most of the customers in Pakistan who are using F5 are in the banking sector. They have a good amount of users already, 1500, 3000. So mostly we have banks in Pakistan using F5. And I guess also a few in the education sector and businesses. Otherwise, not many small businesses have F5. The one I mentioned that is using AWAF is a big telecom in Pakistan and they have millions of users. It is not for the very small businesses, I guess.

I have had many experiences with customer support, both good and bad. Truthfully, they can improve a bit. There are two methods to engage the F5 support. You either call or email them. It's your choice. 

You decide which location you want to call, either the Singapore or UK office, because there is no support in Pakistan. We have to ask for support from either UAE, Singapore, the UK or the US. If I call, I normally prefer to call Singapore, because our region mostly deals with the Singapore head office. Sometimes there's a problem understanding Singaporean language and it's tough to talk to them. 

But if you reach out over email, then obviously it is easier. Talking to them on the phone is quite a difficult task. Secondly, if you open a customer request from a portal, we have a customer support portal for the client as well. Normally we get the engineer from UK or Singapore. It also depends on the engineer - sometimes he's very responsive. He will just respond to you in an hour or day. And sometimes you get an engineer who is absent for two, three days and you have to call them and change engineers because the first one is not responding.

In short they have to improve a bit on support.

We mostly deal with F5 and we always ask our customers who want the web application firewall to go for F5. We do have other web solutions as well, like Fortinet FortiWeb, another popular solution. For small businesses, we don't suggest that. 

We are gold partners with F5, so we always suggest F5.

In terms of the initial setup, for a person who is a bit experienced it is not that difficult. It is a straightforward device. You follow the same principle and the same steps and you are good to go. Just follow the steps. F5 guides you through the initial configuration, which is another of their features. If you don't want to go for the manual config you can just follow their step by step. Press - next, next, next, next then you have the initial configuration done. 

Then you can move to your own configuration according to your network and according to your need. It's an easy device to configure, it's not difficult. 

Only the graphical user interface needs some kind of improvement to make it more modern. But as far as the straightforward install is concerned, it's good and easy.

One person is enough for the deployment and for the check.

In terms of how long it takes to deploy Advanced WAF, it depends on the number of applications you have to put behind the F5 number one. 

The initial network configuration won't take so long if you have all the required data. 

You can set up the initial configuration in an hour or two. But the more applications you add will determine the length of the configuration. 

We mostly deploy Advanced WAF in automatic mode. We don't do the manual configuration of the security side. We just put application details there and we let F5 decide the learning process. It normally takes 15 to 20 days to get a good grip on the application, the language, and the do's and don'ts. We let F5 decide. 

It takes around 15 to 20 days to get it into the blocking mode. But for the configuration for one application it will hardly take 30 minutes to be configured. It all depends on the amount of applications you have.

My advice is that if you need a web application firewall you should go for F5. It is one of the best solutions in the past six or seven years.

F5 has been the leader in this field. It's a stable solution. One just has to decide their organization's goals in the beginning for the next five years or so. Because if they wrongly select the hardware module, they cannot do the scalability if they want to add  a number of modules in the future. So selecting the product should be done with great care. Otherwise, I guess it's okay. If you want a good web application firewall go for F5.

On a scale of one to ten, I would rate F5 Advanced WAF a nine.