F5 Advanced WAF Reviews

For me, the primary use case is to secure web applications from external threats, including cross-site scripting, SQL injection attacks, file inclusion vulnerabilities, and many more. The tool has simplified protection against web applications and recent threats that might be visible. If your applications are vulnerable, it gets protected by F5.

It is a very flexible solution. iRules is quite appealing when it comes to F5, and they apply it throughout their solution. BIG-IP is a known platform, and it is a part of F5 now. Application delivery or web application firewalls, F5 understands these terms and then suggests better data policies. But you have to do the work on your application's performance first. You have to look in the logs and understand the total attack you should prevent when we put it in the circuit protection mode, which works perfectly well.

iRules truly excites me because it has the ability to prevent the end-user and infrastructure from external threats.

Even if the F5’s default signatures and the default behavior are unable to help you, you can customize iRules to reach the objectives.

I don't like the management control of F5.

Moreover, if you are not an expert, it would be really difficult to set it up.

I have been using the product for fifteen years or more.

It is a stable solution.

It is definitely a scalable solution.

The initial setup is quite straightforward. I didn't experience any complexity. It could be difficult for somebody who is not familiar with application load balancers or web applications. It takes a month to understand the entire architecture. It primarily depends upon how great deployment could be.

It usually takes about five to seven days to configure and deploy the F5 Advanced WAF in production mode. It is essential to ensure that your configuration works properly before putting it into production mode.

When you have already designed it, it takes around five to seven days to set up. But it takes more than a month to understand the entire architecture of the F5.

I would rate it an eight out of ten.

We are distributors in Vietnam. We consult for our customers and I am a Product Manager. We use F5 Advanced WAF as a firewall for our website applications and the websites of our customers.

The most valuable features of F5 Advanced WAF are the security features and the protection.

In the future, I would like to see F5 include AI in the hardware of F5 Advanced WAF.

F5 Advanced needs to improve its bot protection. The solution needs to have machine learning to learn the behavior of the customer to recognize the human versus the bot. This is a difficult feature to explain to our customers. I would like documentation about the bot feature to make it easier for the customer to understand.

I have been using F5 Advanced WAF for two years.

The solution is stable.

F5 Advanced WAF is scalable.

We tend to handle our own technical support for our customers. My experience with F5 support is a three out of five overall. They need to improve the information and training of the receiver.

Positive

The initial setup was neither easy nor difficult. I would rate setup as a four out of five.

The pricing of F5 Advanced WAF is more expensive than other solutions like Radware and CD18, it is quite high. I rate the product a one out of five for price, with one being expensive.

Overall, I would rate F5 Advanced WAF an eight out of ten overall.

It's considered one of the modules for the LTM box. It's all modules for the LTM box.

It is actually to protect the customer web application which is published on the internet. It's actually to protect that, and nowadays, we also have this threat intelligence. You will link to the F5 centra, the depository of the threat intelligence database. We always have the latest update on the common threat that is happening currently. You will notify the customer if there's an issue.

The threat intelligence function is great. Nowadays, there is more awareness on the security side. They'd have a real-time update from F5. It provides peace of mind on the security side for the customer.

It is an add-on module to protect the web application.

The solution can scale with planning.

The solution is stable.

Support is helpful.

The deployment side is quite complex. We'd like them to simplify the implementation process. I'm not sure whether they can do that, however, they have to be very detailed on configurations, and sharing of the policy. Anybody that configures this box, the WAF, they have to have knowledge of the application and some of the security portions there as well.

We've had the solution since last year. We have deployed it to a customer.

It is stable. Actually, it evolved from ASM, what they call the Application Security Manager, and now they name it Advanced WAF. It's been around for a while. There are no bugs or glitches. It doesn't crash or freeze. 

We'll size up based on the customer requirement with some buffer, maybe 20% to 30% for the future extension. There is also some consideration on the capacity planning and the size of the box. You can scale. You just need to plan ahead. 

In terms of users, with Advanced WAF, normally their role is more related to the security side.

We just implemented the solution recently and we'll have to wait another three or four years before we change or upgrade the solution. 

I've dealt with technical support. We're quite satisfied with them. They're good. 

Positive

F5 WAF is a web application, in the firewall domain, they have been in the market for a very long time. They know the requirements and the market trends very well. This is the reason why we normally chose F5.

The solution is pretty difficult to set up. You really have to have a grasp o the product to configure it correctly.

The setup takes approximately two months. It's quite a long time. If the application is not ready, then the dependency will be on the application side. Therefore, the cycle is quite long. It depends on the application readiness.

We just need one to two people to handle deployment and maintenance. 

The licensing is charged yearly. It's considered expensive, however, there are more expensive WAFs on the market - like Imperva. F5 is second after Imperva in terms of cost. L1 to L3 support is included in the cost.

I'd rate the price of the solution at a four out of five in terms of how expensive it is.

We tend to stay with F5, however, we will look at pricing and try to negotiate based on that. We'd like to get a discount and look at the market to see the costs. 

I'd advise that new users need to know the requirement expectations, and then the criticality of the application that they're going to let the user use. Sometimes the application is public to the internet for a public user to log into and query the database. In that case, we're exposed to all kinds of external parties. So if you put something that is cheap in place, something that is not able to do the protection properly, then it will be a very big risk to the company. 

I'd rate the solution ten out of ten. Our clients have been very happy with it.

I use F5 Advanced WAF to secure web applications and load balance for connectivity.

F5 Advanced WAF secures our connectivity and combines both the main functions of WAF (balancing and web application security).

F5 Advanced WAF's best feature is that it's a combination of LTM and ASM in one license.

It's sometimes difficult to customize APIs with F5 Advanced WAF, which could be made easier.

I've been using F5 Advanced WAF for three-and-a-half years.

F5 Advanced WAF is stable.

I previously used FortiWeb, but after comparison, I preferred F5.

The initial setup was moderate, and I would rate my experience as four out of five. Deployment took a month because we had to put it in learning mode, customize policies, and get the security signature.

We used a third-party team.

A yearly license for F5 Advanced WAF is expensive. I would rate the pricing at two out of five.

I would give F5 Advanced WAF a rating of nine out of ten.

I use it for load balancing.

It's flexible and powerful, and the users can input their own rules to the system.

The pricing could be more flexible.

I've been using it for three to four years.

It is a stable solution.

F5 Advanced WAF is a scalable solution. We have 20 people using it in our company, mainly from our operations team.

F5 has a partner in Singapore, and he's very supportive.

It is reasonably easy to set up and took about a month.

I used a third party for the deployment.

The cost is slightly above average.

I would rate this solution at eight on a scale from one to ten.

We are using F5 Advanced WAF to defend against web application attacks.

The most valuable features of the F5 Advanced WAF are the enhanced ASM and the performance. Additionally, the usability and effectiveness are very good.

F5 Advanced WAF could improve on its funding for WAF features. There is a need to be more advanced WAF features.

I have been using F5 Advanced WAF for several years.

My advice to others is F5 Advanced WAF is a powerful WAF for many years in the market, and it has powerful security features.

F5 Advanced WAF is a stable solution.

I have found that F5 Advanced WAF is scalable but there is a limit.

We have hundreds of people using this solution in my organization.

I have not used the support from F5 Advanced WAF.

The initial setup of F5 Advanced WAF is straightforward, but the process is lengthy.

We did the deployment of F5 Advanced WAF in-house. We have a team that's always ready and aligned with the process of maintaining F5 Advanced WAF.

There are different licenses available to use F5 Advanced WAF, such as BT, ASM, and LPM.

I rate the price of F5 Advanced WAF a four out of five.

I rate F5 Advanced WAF an eight out of ten.

We host public-facing web applications or APIs. There are web applications that are owned by the company that is exposed to the outside. The internal infrastructure is within the premise. We use F5 to protect them. It's an HA model, and we have two sites.

We need to have an extra layer of protection. We were previously exposed to the public API. The deployment and the rate of deploying web-based applications had increased. After we introduced the web application firewall, it increased our ability to expose more of the services to the public. 

My favorite feature of F5 is the ability to play around with the ciphers. I also like the ability to have an immediate display of the support IDs when a real blockage occurs. The protection offered is great.

The reporting portion of F5 Advance WAF is not great. They need to work out something better, as it is very basic. You only see the top IPs, I think there is more they can offer.

I have been using F5 Advanced WAF for four years, since 2018.

F5 Advanced WAF is a stable solution.

For the initial deployment, from what we were planning to implement, it was scalable. 

We now have other requirements that we need to engage with. They believe we need to increase our license, so we can accommodate more features.

There have been issues in the availability of quick support. For general issues there is no concern. The issue is when you need support right away, but it is not available.

Positive

The solution was deployed using network security. At the time of deployment, the appliance was there, but we did not have any person that was able to accomplish the deployment. It took six months to deploy.

We have definitely seen a ROI by using F5 Advanced WAF.

As far as the pricing of F5 Advanced WAF I would rate it a four out of five depending on what features I am looking for. Imperva is more expensive.

The price has remained consistent at a constant rate. There have not been any increases or any unforeseen increases when we're renewing our license. The price is fixed.

I reviewed Imperva only to compare pricing.

On the initial engagement, you should try to look on how best you can accommodate the quick support features, as this was a big struggle for us.

Overall, I would rate F5 Advanced WAF an eight out of ten.

We use this solution for web application protection. The solution offers layer seven protection of the applications and can be configured against attacks.

There are a lot of good features.

I would like for there to be a cloud-based solution, this would also help to improve scalability.

I have been using this solution for about a year or so.

This solution is quite stable.

Scalability is limited since it is an on-premise solution. You will have to size your box properly, based your throughput and capacity. Our company uses it to protect all traffic of out 5.5 thousand users and we have plans to expand the usage.

Support was helpful when we reached out.

We used Kona Defender and Akamai Web Application Firewall for about a year prior to using F5. The main reason that we switched was due to costs.

The initial setup was rather complex taking a lot of time and information to be configured. We have two administrators for maintenance. 

Our consultant was able to help us integrate the solution in a day or two.

There is a perpetual license that comes with your hardware. There is also an additional fee for support.

When you choose to go with F5, be sure to size your box properly so that the capacity is taken care of. From there, you will be able to easily configure the platform to provide you with a lot of value. Overall, I would rate the solution a seven out of ten.