F5 BIG-IP Local Traffic Manager (LTM) Reviews

My team uses F5 for two main purposes. The first purpose is load balancing. F5 is very good at load balancing. It allows you to set up monitors so it can easily detect if the systems' load balancing is actually up. In addition, we use F5 for intrusion detection on some externally facing pieces of the applications that I support.

We like the capability to combine the content switching with the intrusion prevention and adding the security roles, so we can expose certain sub-pieces outside without exposing everything.

Another feature that we like is how they integrate nicely with the Oracle PeopleSoft application, and since that's one of my main focuses, I really like that they have the built-in integration.

I have been really happy with what they have been doing.

They could improve the synchronization between their main site and the failover site. Sometimes, we run into issues where it does not sync well, so I would like to see that improved.

The synchronization does works fairly well. However, if I were to make changes,  I would make it easier to start the sync process. For example, once you get the changes pending you have to click inside to tell it to sync. It would be nice if it would offer a button to click on for the sync if it is only going one direction. Another feature which would be nice in a sync is to have the ability to compare if there are changes on both sides, and if there are conflicts, it would allow you to choose which to apply. Otherwise, it would sync both directions at the same time.

We haven't had any major downtime. The solution comes with a high availability situation, and I've never seen a situation where it was down, because even when you do the patch, you patch one side and then the other, and so always one side at least is up. I haven't noticed it to be down.

It is a scalable solution. I think it will meet our future requirements. We started using it when Cisco announced that they were no longer doing their content switch and we've been implementing it a lot. It's one of the current focuses that our company is doing in the infrastructure side of things.

Customer Service:

I usually go via the online support, which is very good.

Technical Support:

They have been very quick to respond to all of the needs that we've had. If you want ad-hoc support. They also provide professional services that you can purchase as well.

I got involved after the initial setup was done, so I can't say if that was complex or not. The pieces that we're doing where we're setting up content switches and stuff like that, that seems to be really straightforward. I didn't even have to take training to work on it!

I have not actually used any of the competitor products.

I would recommend that they really look at it. It's a good product. It really helps. Initially, I would also recommend that they consider using some consulting help from their firm to get it set up, because like I said, I wasn't involved there, but I know we did use that.

When I look to work with a vendor like this, I look for vendors that are responsive, certainly ones that have a good reputation, and ones that when you get their products, they actually do what they tell you they're going to do.

I rated F5 Big-IP three and a half stars, because I seldom rate anything five stars. The F5 interface is easy to use, but not everything is intuitive. Some training is necessary to understand how everything works together.

Central solution to control traffic or web applications (besides NG Firewall).

• Easy administration
• A lot of features
• Scriptable (iRules and REST API)

I have some experience with other load balancing providers. The BIG-IP’s interface is more intuitive than other GUIs. It is well structured, not overloaded, and does not have too many gimmicks.

The ASM administration is quite complex. I am a technical GUI expert (not UI). They did improve the ASM administration in each version, but added new features, too. The topic itself is pretty complex, so it is not easy to provide a nice, clean interface. There are a lot of references and dependencies in-between the different subareas.

I have not yet encountered any stability issues.

I have not yet encountered any scalability issues.

Technical support is good. I have had nothing to complain about up until now.

I previously used a different solution. We switched because the hardware was too old, and the other vendor did not have the same set of features.

Initial setup was straightforward. We were up and running in three hours.

Take a look at the modules that you are going to use. Look into the best bundles for them.

Before choosing this product, I compared it with Radware. Cisco was already off the market, and Citrix was not as big as it is today.

Use the community and DevCentral.

iRules are so helpful in meeting our complex application’s architecture in case of routing. The requests have to be routed according to the cookies and headers of the host name itself. And also we can log the details, which helps us a lot in troubleshooting.

Using the “repeat” option when creating multiple virtual servers, we are able to create as many virtual IPs as we can as we go. This reduces a lot of configuration time.

My organization has various kinds of routing requirements and we have achieved it using F5’s iRules. Also with different load balancing options, many applications have benefited a lot.

Active-Standby sync has to be made automatic.

All of the F5 boxes have an Active-Standby configuration. Users need to make changes in the Active box, but often users by mistake make changes in the Standby box. This creates problems when syncing between Active and Standby. There should be some indication from the F5 tool to avoid such mistakes.

I have used it for the past year.

All of the support I require is available on the internet.

The BigIP F5 tool is applicable to all types of infrastructure. I would recommend this tool to others.

LTM is a full-reverse proxy, handling connections from clients. The F5 LTM uses Virtual Services (VSs) and Virtual IPs (VIPs) to configure a load balancing setup for a service. We have used this feature in many applications, especially for HTTP and HTTPS.

There is room for improvement with their firmware quality control. A bug in the firmware caused hardware failures.

I have been using it for one year.

Unfortunately, we faced hardware failures and a lot of other problems, as well.

With the hardware failure problem, we faced a management problem via the GUI. We could only manage the device through the CLI. The issue was caused by a firmware bug.

In addition, health check statistics like CPU and memory utilization were not correct.

It is F5’s responsibility to solve those problems, and I don’t know how they can release firmware with such bugs to their customers.

F5 support can be rated low on the scale, as there is a problem regarding handover between their engineers when we follow-up with them about some technical cases.

I recommend considering NetScaler, as well.

We mainly use the following F5 modules 

ISP environments:

• CGNAT
• DNS firewall
• Load balancer
• WAF to be sold as a service to their clients

Enterprise environments:

• Web application firewall
• Load balancer
• Application policy manager
• Fraud protection (Web and mobile)
• DDoS (on-premise, and cloud-based)

iRule: It's a great feature that helped us multiple times have an advantage over competition (during PoCs) performing some traffic control/management functions that are not supported out of the box. Use Case: One client was deploying a new web app, where video/chat Traffic is configured over the SOCKS protocol. We used iRule to disable the WAF Inspection when a SOCKS protocol packet passed through (because it is not supported), and enable the WAF Inspection for all other URLs on the same Web page. (No other vendor in our region was able to provide that.)

Appliance Performance: One of the main advantages we always have over competition is in hardware performance, where the smallest F5 appliances compete with competitors’ medium to high-end appliances, while high-end devices can sit in the datacenter without risking performance degradation.

• Reporting: One of the negative things about F5 is there is no place to generate a summary/executive/detailed report about everything happening on the box, especially for WAF & APM events. The only way to get some kind of report is enable the AVR module, and manually export the data required into PDF/XLS documents.
• GUI interface: F5 appliances lack a standard dashboard page, where it shows a summary for all events on the boxes. (This is usually available with firewalls & IPSs...) In the F5 GUI, we have to perform multiple steps to reach the required info, but there is no simple (and attractive) GUI interface when compared to some other WAF competitors.
• Event notifications

I have not encountered any stability issues. It is a very stable product, even in big, high-load deployments. What I mean is that all F5 Hardware appliances are very stable and does not cause any performance degradation or failure when it has a high load (Of course a supported load).

We have deployment for different modules of F5 (LTM, ASM, CGNAT...) in Data Centers and in Telco's Public network, and we have never heard any complaints or of issues from our clients regarding the performance. - no packet drops, delays or disconnections.

We only encountered issues with small appliances, 2000s, when we needed to add more than two modules...

Technical support is great.

We previously used Cisco ACE (for load balancing & WAF). We switched because the Cisco ACE solution features were very basic compared to F5. Plus, the solutions line was discontinued several years ago.

Initial setup is straightforward; easy deployment with lots of available online documentation.

F5 Prices are considered higher then competitive solutions, but performance & features are worth the extra money.

Over our year of engagement with F5, we evaluated multiple products from other vendors and competed with many others, and we always found F5 products to be our first and best choice to advise our customers to use, with respect to:

• Performance, protection, stability, scalability
• Being modular based, for a better long term investment

F5 is dedicated to a specific technology line, which makes it the best of breed in the application delivery market. F5's main business is always focused on application delivery, whether in availability, security, or performance.

F5 is a very stable and recommended product, whether needed on the internet edge or inside the data center. It can provide different application delivery solutions, such as:

• Load balancing
• Web application firewall
• Access policy manager
• Web fraud
• DDoS protection.

I rate it nine out of 10 because we are an F5 partner, and we have been selling and deploying different F5 modules for different industry vectors. In any deployment we always had a great customer experience, mainly in the following areas:

• performance stability 
• overall stability
• rich features in the appliances, that customers can benefit from.

It's a modular-based appliance. You can double the performance specs by a license upgrade, and regarding features you can add a license for additional modules (E.g.: Web application firewall, application policy manager, fraud, DDoS). In general, for a client doing a proper ROI over five years, F5 appliances become their preferred choice.

Primary use case for the product is high availability and load sharing of applications to be serviced. Also, it provides application security by use of the Application Security Manager.

It has enabled us to keep a sustainable and supported load balancing platform. This is partly due to Cisco withdrawing a large number of their load balancing products and also related to Microsoft Network Load Balancing not scaling enough to suit our needs.

The most valuable feature is the F5 LTM (Local Traffic Manager). This is the part of the product most organisations will be using most. It provides the core functionality to be able to load balance services and the means and the intelligence to be able to load balance based on advanced logic, e.g., TCL scripting.

The F5 GTM/BIGIP DNS (Global Traffic Manager) is another valuable feature. This feature allows for DNS load balancing, which means that high availability and load sharing can be done across services locally, as well as across datacenters with advanced capabilities.

I would like F5 to incorporate the ability to create your own custom roles and customised permissions within the product set. I have seen many customers wanting to give a certain level of access for the purposes of out-of-hours servicing to out-of-hours staff or teams that fulfill an operations type role.

For example, I would like to see the ability to create roles within F5 where I can specify permissions instead of choosing from a set list that does not always fit my organisation’s needs. The current roles available out-of-the-box do not allow for enough granularity for an operator role to take pool resources offline and push or commit those changes to the configuration/HA cluster. Every role within the F5 that can make changes should be able to commit those changes if the administrator(s) permits.

Three to five years.

Stability has never been an issue with F5 BIG-IP. The product is geared predominantly at providing stability and resiliency across your infrastructure.

No issues with scalability have been encountered. I would say that this has largely been due to having a good F5 consultant and consultancy throughout the buying process and implementation. This has ensured that the product being purchased can scale past our current needs and fulfill potential future needs.

I would give a 10 out of 10. Technical support through F5 is very thorough. On most occasions, the F5 DevCentral and support website generally gives you a lot of the expertise that you need without having to raise a support ticket. If you ever reach the stage of needing to raise a support ticket, you usually are handed quickly to someone who is able to deal with your query as efficiently as possible.

Previously, I have used Cisco load balancing, e.g., Cisco CSM, Cisco ACE, Microsoft Network Load Balancing, and Cisco GSS. Previously, Cisco load balancing or Microsoft NLB had always been the preferred options. However, since Cisco discontinued most of their load balancing products, it makes it very difficult to find products of the same grade and functionality. Since we began using F5 that gap in functionality has been filled. With F5, you get not just standard load balancing, but an array of other highly useful products to boot.

The licensing pricing seems relatively easy enough to get your head around. I would advise anyone to ensure that you have a conversation with an F5 consultant before purchasing, as you would with most products. An F5 consultant is the best placed to understand your needs and ensure that you purchase the correct licensing and products for your requirements.

We did evaluate other options. We had already used products such as NetScaler, Microsoft NLB, and a vast array of Cisco load balancing products. F5 was chosen due to the level of power that the product has. I have not seen many single solutions that fulfill all the criteria that an F5 BIG-IP appliance can.

It is not superior to its competitors due to how advanced the features are and the modules that can be used. The product can be used with iRules, which are an advanced ways of making functions available on a load balancer via use of scripting in TCL.

I would strongly advise seeking technical consultation throughout purchasing and during implementation. This is usually because you can get good advice around best practises as well as utilising as much of the F5 features as possible. In some cases, you might even find yourself finding a solution to scenarios that you might not have been aware had a solution.

I rated this product four and a half stars, because of the level of advanced features available in the product versus cost. Though functionality is high, its cost can be considered slightly higher than its competitors.

LTM: Load balancing, SSL offloading, iRules, iApp,

LTM has been able to demonstrate an immediate return on investment, reducing the cost of server estate upgrades (both in terms of the numbers of required tin, reduced service impact through upgrades, server/website availability managed up to near 100% through redundancy management, improved human resource management (moving OOH work into daylight, reducing operational budget requirements)

LTM – the product is fine and all features that I have deployed have proven to be stable. TMOS release schedule is very dynamic. Major releases (9-10, 10-11) could have been made easier if configuration migration assistants had been more finessed prior to release.

4 years

No major issues with deployment. Care must be taken with infrastructure deploys – close engagement is required with Network Support and Firewall Support areas, but once the platforms are stable, module deployment is very simple. As per my previous comment, moving from release to release can be complicated by things like bigpipe command deprecation (or removal: thank you v11!!), especially if a large iRule base has been developed on the modules.

At the module level, no. They are not as stable as System Z, but they are not far off. Hardware can be a little more susceptible to failure at the component level.

None. Appliance based options (physical and virtual), blended with Viprion/vCMP mean that these solutions have been able to scale to support enterprise class ADC offerings.

Customer Service: First class. F5 have demonstrated a willingness to support us through all issues, from architecture, deployment BAU support and high incidents. I can’t recommend them and their product offering highly enoughTechnical Support: Again, first class. It can sometimes be challenging to find even support partners with the requisite knowledge of the most cutting edge features, but only because F5 seem to develop at such a blistering rate.

No. F5 was a virgin solution to a point problem and quickly grew to a central position in the management of our enterprise infrastructure and digital tier by demonstrating quickly a value contribution made to our live service offering.

Straightforward and complex. Infrastructure setup on the boxes themselves was straightforward, although challenges in working with Network/Firewall departments made the exercise slightly more interesting. Basic LTM configuration OOB is very easy. IRules demand considerably more time and attention to develop properly.

In house, and I would rate their level of expertise as of the very best, since it was myself and a single colleague that built the entire infrastructure.

Significant and immediate.

Full analysis of the ADC space was undertaken, evaluating all competitors in the GMQ. All were discounted because of the vast distance between technologies and their capabilities. F5 was the clear and only choice for us.

Look to Enterprise Architecture before striking a key. These boxes are multiply capable, so allowing development through capability can lead to hugely complex deployments. There is (almost) nothing these boxes can’t do, including providing “tactical” solutions to application issues. Left unconstrained by a robust Architecture model, these boxes WILL grow like topsy, and the complexity of the solutions demanded by any business hungry for rapid delivery will grow into a box of fixes that only SME-level network/security/F5 technicians can manage on even a day-to-day basis. Make sure that the Enterprise Architecture model is strong and well-defined, and stick to it like glue.

I've checked out the market and I think Big-IP/Viprion is the best ADC your money can buy at the moment. It has the features and innovations that demanding organizations like us desire in an ADC especially for diverse and complex application environments. F5 has a solid offering with its iRules, iControl and iApps and we use its DevCentral portal. We take advantage of the integration with both Eclipse and .NET/Visual Basic which is a nice plus.

It’s quite expensive compared to the other vendors. F5 lacks a pay-as-you-grow licensing scheme as offered by other companies, which makes acquiring their products more expensive at the outset.F5’s support for low-end platforms is also dismal, with continued restrictions imposed on such systems making it difficult for them to cater to small to medium-sized business. You might be forced to buy more expensive systems just to get the features you want and not the performance benefits of the more expensive system.I'm also concerned about F5’s continued push on new hardware platforms to generate sales.Finally, one must be able to handle the complexity and knowledge required for deploying F5’s ADC products. Selecting a reliable and experienced partner is crucial to get the right configuration for your needs and for you to be able to maximize your ADC investment.

Top of the line ADC with great features. Just make sure you have the right partner in implementing your solution so as the business value of such an expensive product is maximized.