F5 Advanced WAF Reviews

It's considered one of the modules for the LTM box. It's all modules for the LTM box.

It is actually to protect the customer web application which is published on the internet. It's actually to protect that, and nowadays, we also have this threat intelligence. You will link to the F5 centra, the depository of the threat intelligence database. We always have the latest update on the common threat that is happening currently. You will notify the customer if there's an issue.

The threat intelligence function is great. Nowadays, there is more awareness on the security side. They'd have a real-time update from F5. It provides peace of mind on the security side for the customer.

It is an add-on module to protect the web application.

The solution can scale with planning.

The solution is stable.

Support is helpful.

The deployment side is quite complex. We'd like them to simplify the implementation process. I'm not sure whether they can do that, however, they have to be very detailed on configurations, and sharing of the policy. Anybody that configures this box, the WAF, they have to have knowledge of the application and some of the security portions there as well.

We've had the solution since last year. We have deployed it to a customer.

It is stable. Actually, it evolved from ASM, what they call the Application Security Manager, and now they name it Advanced WAF. It's been around for a while. There are no bugs or glitches. It doesn't crash or freeze. 

We'll size up based on the customer requirement with some buffer, maybe 20% to 30% for the future extension. There is also some consideration on the capacity planning and the size of the box. You can scale. You just need to plan ahead. 

In terms of users, with Advanced WAF, normally their role is more related to the security side.

We just implemented the solution recently and we'll have to wait another three or four years before we change or upgrade the solution. 

I've dealt with technical support. We're quite satisfied with them. They're good. 

Positive

F5 WAF is a web application, in the firewall domain, they have been in the market for a very long time. They know the requirements and the market trends very well. This is the reason why we normally chose F5.

The solution is pretty difficult to set up. You really have to have a grasp o the product to configure it correctly.

The setup takes approximately two months. It's quite a long time. If the application is not ready, then the dependency will be on the application side. Therefore, the cycle is quite long. It depends on the application readiness.

We just need one to two people to handle deployment and maintenance. 

The licensing is charged yearly. It's considered expensive, however, there are more expensive WAFs on the market - like Imperva. F5 is second after Imperva in terms of cost. L1 to L3 support is included in the cost.

I'd rate the price of the solution at a four out of five in terms of how expensive it is.

We tend to stay with F5, however, we will look at pricing and try to negotiate based on that. We'd like to get a discount and look at the market to see the costs. 

I'd advise that new users need to know the requirement expectations, and then the criticality of the application that they're going to let the user use. Sometimes the application is public to the internet for a public user to log into and query the database. In that case, we're exposed to all kinds of external parties. So if you put something that is cheap in place, something that is not able to do the protection properly, then it will be a very big risk to the company. 

I'd rate the solution ten out of ten. Our clients have been very happy with it.

I use F5 Advanced WAF to secure web applications and load balance for connectivity.

F5 Advanced WAF secures our connectivity and combines both the main functions of WAF (balancing and web application security).

F5 Advanced WAF's best feature is that it's a combination of LTM and ASM in one license.

It's sometimes difficult to customize APIs with F5 Advanced WAF, which could be made easier.

I've been using F5 Advanced WAF for three-and-a-half years.

F5 Advanced WAF is stable.

I previously used FortiWeb, but after comparison, I preferred F5.

The initial setup was moderate, and I would rate my experience as four out of five. Deployment took a month because we had to put it in learning mode, customize policies, and get the security signature.

We used a third-party team.

A yearly license for F5 Advanced WAF is expensive. I would rate the pricing at two out of five.

I would give F5 Advanced WAF a rating of nine out of ten.

I use it for load balancing.

It's flexible and powerful, and the users can input their own rules to the system.

The pricing could be more flexible.

I've been using it for three to four years.

It is a stable solution.

F5 Advanced WAF is a scalable solution. We have 20 people using it in our company, mainly from our operations team.

F5 has a partner in Singapore, and he's very supportive.

It is reasonably easy to set up and took about a month.

I used a third party for the deployment.

The cost is slightly above average.

I would rate this solution at eight on a scale from one to ten.

We are using F5 Advanced WAF to defend against web application attacks.

The most valuable features of the F5 Advanced WAF are the enhanced ASM and the performance. Additionally, the usability and effectiveness are very good.

F5 Advanced WAF could improve on its funding for WAF features. There is a need to be more advanced WAF features.

I have been using F5 Advanced WAF for several years.

My advice to others is F5 Advanced WAF is a powerful WAF for many years in the market, and it has powerful security features.

F5 Advanced WAF is a stable solution.

I have found that F5 Advanced WAF is scalable but there is a limit.

We have hundreds of people using this solution in my organization.

I have not used the support from F5 Advanced WAF.

The initial setup of F5 Advanced WAF is straightforward, but the process is lengthy.

We did the deployment of F5 Advanced WAF in-house. We have a team that's always ready and aligned with the process of maintaining F5 Advanced WAF.

There are different licenses available to use F5 Advanced WAF, such as BT, ASM, and LPM.

I rate the price of F5 Advanced WAF a four out of five.

I rate F5 Advanced WAF an eight out of ten.

We host public-facing web applications or APIs. There are web applications that are owned by the company that is exposed to the outside. The internal infrastructure is within the premise. We use F5 to protect them. It's an HA model, and we have two sites.

We need to have an extra layer of protection. We were previously exposed to the public API. The deployment and the rate of deploying web-based applications had increased. After we introduced the web application firewall, it increased our ability to expose more of the services to the public. 

My favorite feature of F5 is the ability to play around with the ciphers. I also like the ability to have an immediate display of the support IDs when a real blockage occurs. The protection offered is great.

The reporting portion of F5 Advance WAF is not great. They need to work out something better, as it is very basic. You only see the top IPs, I think there is more they can offer.

I have been using F5 Advanced WAF for four years, since 2018.

F5 Advanced WAF is a stable solution.

For the initial deployment, from what we were planning to implement, it was scalable. 

We now have other requirements that we need to engage with. They believe we need to increase our license, so we can accommodate more features.

There have been issues in the availability of quick support. For general issues there is no concern. The issue is when you need support right away, but it is not available.

Positive

The solution was deployed using network security. At the time of deployment, the appliance was there, but we did not have any person that was able to accomplish the deployment. It took six months to deploy.

We have definitely seen a ROI by using F5 Advanced WAF.

As far as the pricing of F5 Advanced WAF I would rate it a four out of five depending on what features I am looking for. Imperva is more expensive.

The price has remained consistent at a constant rate. There have not been any increases or any unforeseen increases when we're renewing our license. The price is fixed.

I reviewed Imperva only to compare pricing.

On the initial engagement, you should try to look on how best you can accommodate the quick support features, as this was a big struggle for us.

Overall, I would rate F5 Advanced WAF an eight out of ten.

We use this solution for web application protection. The solution offers layer seven protection of the applications and can be configured against attacks.

There are a lot of good features.

I would like for there to be a cloud-based solution, this would also help to improve scalability.

I have been using this solution for about a year or so.

This solution is quite stable.

Scalability is limited since it is an on-premise solution. You will have to size your box properly, based your throughput and capacity. Our company uses it to protect all traffic of out 5.5 thousand users and we have plans to expand the usage.

Support was helpful when we reached out.

We used Kona Defender and Akamai Web Application Firewall for about a year prior to using F5. The main reason that we switched was due to costs.

The initial setup was rather complex taking a lot of time and information to be configured. We have two administrators for maintenance. 

Our consultant was able to help us integrate the solution in a day or two.

There is a perpetual license that comes with your hardware. There is also an additional fee for support.

When you choose to go with F5, be sure to size your box properly so that the capacity is taken care of. From there, you will be able to easily configure the platform to provide you with a lot of value. Overall, I would rate the solution a seven out of ten.

We use F5 Advanced WAF to secure our public cloud. We also use it to secure firewalls for applications and websites. Whether on-premises or on public cloud, these are the usual use cases for WAF.

The most valuable feature of F5 Advanced WAF is its ability to mitigate attacks: DDoS and DNS, or layer seven application attacks, OWASP, and email.

The vendor needs to work on developing an MSP model for this solution as that is what's trending on the market, plus integrating this solution under a SASE model. Not all vendors' products are compatible with SASE, and not compatible with delivering multi-deployment options from hardware appliance, VM-based, shared cluster, etc.

The compatibility of F5 Advanced WAF with multiple public cloud environments also needs to be improved, and not to be overlooked with the VMware environment.

This solution shouldn't only focus on Azure public cloud compatibility, as they need to also work with and be compatible with private cloud on multiple environments.

I'm not aware of the latest updates in terms of features, but they need to work on enhancing their product, because it seems they have an issue in the market. Day by day, they seem to be lagging behind all the new products in the market.

We've been working with this solution for one year.

The stability of this solution is not great. It's stable, but you are aware of the performance stability when you are relying on a VM-based environment, so there is another layer of performance of the infrastructure itself which you need to take into consideration when talking about stability.

Sometimes the product performance is good, but the infrastructure you are using causes some performance issues.

Now VMware is doing great when it comes to performance, so the performance of the F5 Advanced WAF licensed on our VMware environment is good as well.

This solution is not easy to scale. F5 is suffering from scalability issues. They are struggling with scalability.

I never contacted F5's technical support team because we are the main service provider, and this means we have our own support.

The initial setup for F5 Advanced WAF is complex.

We implemented this solution through our in-house team.

Pricing for this solution is higher than average in the market, when compared to its competitors. They should revise their prices in the market.

There is no additional cost besides the licensing, and it will also depend on the service delivery model: VM-based or hardware-based. The licensing model, however, is similar among all the vendors.

I evaluated FortiWeb.

I work with F5 Advanced WAF (Web Application Firewall). It's hardware-based and VM-based.

We are a partner of F5 as a technology vendor.

Deployment of this solution could either be on-premises, via cloud, or both. F5 and VMware has a partnership, so our infrastructure is based on the VMware environment which comes with the F5 capabilities for the WAF.

The technology is evolving every day and vendors are doing well. Each technology has its pros and cons, and it will take a long time to discuss areas for improvement.

One of the issues of this solution is that it is complex.

How long deployment will take will depend on the customer's environment and use cases.

Maintenance of this solution requires patching the vendor update which is most important for product maintenance or solution maintenance, and doing monitoring for availability and performance.

F5 Advanced WAF works among all segmentations and all market size: small, medium, or large companies. However, I am seeing based on my experience, that Fortinet's WAF technology: FortiWeb, is now doing much better than F5.

Fortinet is doing much better in all aspects: in the protection itself, user-friendliness, threat intelligence, etc. The capabilities of FortiWeb is doing good in the market. Both pricing and delivery models are also more competitive than F5 Advanced WAF's.

My advice to future customers of F5 Advanced WAF or to people thinking of using it is that there is a much better product in the market. One of the better products is Fortinet (FortiWeb).

I'm rating this solution a six out of ten.

There is the Simple WAF and the Advanced WAF. We are currently working on the Advanced WAF, but previously, before the Advanced WAF came out, we were just using the Simple WAF.

We use the on-prem version because the cloud solution is not that popular here.

I have a customer here who has multiple applications dealing with the day to day operations. We have deployed the application firewall in the network and most of their web traffic from outside of their network comes into that WAF. This includes the email application Outlook and their own in-house application tools deployed that they use to sell their merchandise. They have a feature where you can transfer money to the other user based on their mobile phone number. So these web applications and in-house tools are the most used applications in their network.

In terms of F5 Advanced WAF's most valuable features, I would definitely say its stability. F5 is one of the most stable products. Either as the load balancer or the web application firewall, it is very stable.

Additionally, the method it uses to block attacks and the logging and support are very good. You can see anything you want in the logging and reporting section of the device, it is very detailed. These are two valuable features from F5.

If I had to summarize what needed improvement, I'd say they are currently in the process of updating their software. But more specifically, I would say their graphical interface, the GUI. I don't like the GUI as much as before, but now I think they're focusing on it. We are getting some new good features in the latest update. But there is still room for improvement on the user interface as well. It's easy to use. It's not difficult but it is not pleasing to the eye. Most of the time you want to see something dynamic, something like the reporting section or the system usage, the CPU, some detailed graphs, anything of that sort. So I guess they have some room for improvement there. Don't make it more complicated, just make it more pleasing to the eye.

We are using the most stable version. Because recently we got an email from F5 suggesting that if you have any user on the 14.1.2.0 that there was a vulnerability on that feature. And it was quite a severe one, so they asked us to immediately update that license to another version.

They currently have 15 versions, but they are not stable. They didn't recommend them to us. So most of the customers in Pakistan are using the 14.1.2.6 version. That is the most stable version and is recommended by F5.

My focus is normally on logging and reporting, because customers always ask for a clear reporting criteria. I would like it if they could simplify the reporting process. If I create something, I want to get a good report on it that I can read in seconds or in minutes. I don't want extra details in it. They should work on the exporting of the logging and reporting.

I have been using Advanced WAF since it came on the market last year. Advanced WAF is the advanced version of WAF which I have been using for three years.

F5 basically starts their hardware model from a 10GB distribution. So it is a good device to start with and in Pakistan we mostly have up to 40 or 60 gigabytes of devices.

As far as scalability is concerned, we already talked to the customer in detail about what kind of traffic they are expecting in the next five or seven years. Then we decide the box on that data basis and normally we don't have to worry about scaling later.

In terms of adding more features on the F5 hardware, that is a question based on the module. If it takes too much of the CPU, then it is difficult and scaling would be difficult with that hardware. If the hardware is not so many CPU's, then we have to dedicate to each module. Then the scalability becomes a bit difficult. But if you already have hardware that has CPU's in abundance, you can add as many modules as you want. There's no problem.

F5 lets you decide if you want to assign a specific module, a dedicated CPU or nominal resources. You can even decide if you want nominal resources or if you want full resources for that specific module. It all depends on the importance of that module in your business application.

If they are a small company, 250 to 500 employees, or less than 250, then we can go for the virtual Edition of the F5, because as I said, the hardware solution starts from a 10GB box. This can handle thousands of requests per second.

It would be a bit costly for a small scale business. If someone wants F5 and he has less applications and nominal users, he can go for the Virtual Edition. Most of the customers in Pakistan who are using F5 are in the banking sector. They have a good amount of users already, 1500, 3000. So mostly we have banks in Pakistan using F5. And I guess also a few in the education sector and businesses. Otherwise, not many small businesses have F5. The one I mentioned that is using AWAF is a big telecom in Pakistan and they have millions of users. It is not for the very small businesses, I guess.

I have had many experiences with customer support, both good and bad. Truthfully, they can improve a bit. There are two methods to engage the F5 support. You either call or email them. It's your choice. 

You decide which location you want to call, either the Singapore or UK office, because there is no support in Pakistan. We have to ask for support from either UAE, Singapore, the UK or the US. If I call, I normally prefer to call Singapore, because our region mostly deals with the Singapore head office. Sometimes there's a problem understanding Singaporean language and it's tough to talk to them. 

But if you reach out over email, then obviously it is easier. Talking to them on the phone is quite a difficult task. Secondly, if you open a customer request from a portal, we have a customer support portal for the client as well. Normally we get the engineer from UK or Singapore. It also depends on the engineer - sometimes he's very responsive. He will just respond to you in an hour or day. And sometimes you get an engineer who is absent for two, three days and you have to call them and change engineers because the first one is not responding.

In short they have to improve a bit on support.

We mostly deal with F5 and we always ask our customers who want the web application firewall to go for F5. We do have other web solutions as well, like Fortinet FortiWeb, another popular solution. For small businesses, we don't suggest that. 

We are gold partners with F5, so we always suggest F5.

In terms of the initial setup, for a person who is a bit experienced it is not that difficult. It is a straightforward device. You follow the same principle and the same steps and you are good to go. Just follow the steps. F5 guides you through the initial configuration, which is another of their features. If you don't want to go for the manual config you can just follow their step by step. Press - next, next, next, next then you have the initial configuration done. 

Then you can move to your own configuration according to your network and according to your need. It's an easy device to configure, it's not difficult. 

Only the graphical user interface needs some kind of improvement to make it more modern. But as far as the straightforward install is concerned, it's good and easy.

One person is enough for the deployment and for the check.

In terms of how long it takes to deploy Advanced WAF, it depends on the number of applications you have to put behind the F5 number one. 

The initial network configuration won't take so long if you have all the required data. 

You can set up the initial configuration in an hour or two. But the more applications you add will determine the length of the configuration. 

We mostly deploy Advanced WAF in automatic mode. We don't do the manual configuration of the security side. We just put application details there and we let F5 decide the learning process. It normally takes 15 to 20 days to get a good grip on the application, the language, and the do's and don'ts. We let F5 decide. 

It takes around 15 to 20 days to get it into the blocking mode. But for the configuration for one application it will hardly take 30 minutes to be configured. It all depends on the amount of applications you have.

My advice is that if you need a web application firewall you should go for F5. It is one of the best solutions in the past six or seven years.

F5 has been the leader in this field. It's a stable solution. One just has to decide their organization's goals in the beginning for the next five years or so. Because if they wrongly select the hardware module, they cannot do the scalability if they want to add  a number of modules in the future. So selecting the product should be done with great care. Otherwise, I guess it's okay. If you want a good web application firewall go for F5.

On a scale of one to ten, I would rate F5 Advanced WAF a nine.