F5 Advanced WAF Reviews

Our clients mostly have their own applications, such as banking apps, and use F5 Advanced WAF to avoid vulnerabilities and threats on both the application layer and transport layer. 

We create web policies for their apps and configure ASM signatures to prevent vulnerabilities. After configuring the policies, I monitor logs continuously to block vulnerability attacks and assist clients in addressing any issues.

One of the things that surprised me the most about F5 devices is their compatibility with the existing infrastructure of most customers. They can be easily integrated between the main firewall and back end servers, making it a seamless addition to enhance security.

The traffic learning feature stands out as the most valuable. When an app is accessed, the log generated in F5 Advanced WAF provides suggestions on what actions to take. This feature is particularly beneficial in new vulnerability scenarios, offering guidance based on learned data. 

Additionally, I appreciate the way F5 Advanced WAF builds policies by configuring a basic policy and queuing it in learning mode. The solution learns from logs, and based on that learning, I configure ASM signatures.

The GUI interface can be confusing due to similar-looking tabs for policy building, traffic learning, and event logs. A more explanatory GUI would be beneficial. However, F5 solutions are a bit expensive compared to others, although they provide the best service and options.

I have been working with F5 Advanced WAF for around six months.

The solution is very stable. I would rate it a nine out of ten for stability.

F5 Advanced WAF is very scalable, and I would rate its scalability as nine out of ten.

F5 support is excellent and deserves a ten out of ten. Their technical support is responsive and helpful, making the overall experience very satisfactory.

Positive

I have not worked with many other vendors as extensively as F5, but I have some knowledge of FortiWAF. FortiWAF has fewer options compared to F5, particularly in features like iRULES, which offers more flexibility for traffic management and coding.

The initial setup is not very lengthy. Once the device is on-premises, configuring and managing it is quite efficient, though the entire project from start to end may take about a month to a month and a half.

I work with a team of five to six network engineers across different cities, providing support and collaboration for client deployments.

The return on investment is quite high with F5 solutions. Customers prefer F5 for their superior service and features, despite the higher cost.

F5 is on the expensive side but offers superior solutions and options. Customers are willing to pay for the quality and features provided.

I have some knowledge of FortiWAF, but F5 provides more options, especially with features like iRULES for managing traffic.

I would recommend F5 Advanced WAF to other users. It provides excellent features, flexibility, and support.

I'd rate the solution ten out of ten.

Our company uses two versions of F5 Advanced WAF. The solution is used to protect against web hacking bots. 

F5 Advanced WAF has improved our organization's security posture by fending off all types of attacks. The solution has been successful in mitigating not just one kind of attack but also rare attacks that disturb the OS and try to achieve a denial of service. The solution has saved our company from performance deterioration and also enhanced security.   

The solution's most valuable features include application DDoS protection, bot blocking, and HTTP header verifications. The solution protects against seven types of DDoS attacks. 

More legacy protocols should be added to the solution. The aforementioned protocols are generally less used and might have been phased out from multiple solutions. But some of the large corporations that are clients of our company are unwilling to let go of applications that have been developed.

The aforementioned clients believe that as some of the new websites do not use these technologies, it wouldn't be ideal to replace the existing applications; for example, a bank with millions of dollars connected to a software wouldn't be willing to replace it instantly.

It often takes years for enterprise-level businesses to replace applications. The vendor of F5 Advanced WAF needs to consider that even if legacy protocols are not necessarily used for new projects, existing or prior applications projects rely heavily on them, and such protocols need to be protected until they are completely phased out of the market.

The vendor needs to provide complete support for the legacy protocols, just like the latest protocols in the market, until they are assured that none of the customers are using them. 

I would like to witness the expansion of the supported protocols set by the solution. The tool should be promoted as an advanced protection solution that supports all types of protocols. In future versions, some protocols offered by the solution need to be more specialized. All public-facing protocols should be added to F5 Advanced WAF. 

I have been using F5 Advanced WAF since 2018. 

If the solution is setup by professional services, then it will exhibit outstanding stability, otherwise there might be issues. I would rate the stability an eight out of ten. 

I would rate the scalability a nine out of ten. The solution is highly scalable and accommodating. The solution also allows troubleshooting due to its scaling capacity. The backend system of the solution allows the accommodation of solutions that one can pickup. 

In our company, there are about ten users of F5 Advanced WAF, and it's being used daily. Our organization also plans to increase the usage and the number of users for the solution. The tool's performance has benefitted application delivery in our organization. 

I would rate the tech support a seven out of ten. The tech support quality is slightly above average. The support team's first responders to raise tickets are not skilled engineers.

Large enterprises usually expect their issues to be resolved within a few minutes, so in a support process where first responders collect information and if they are unable to tackle it, the issue gets escalated, which overall becomes a huge, time-consuming process. The vendor should provide highly skilled first responders to large clients of F5 Advanced WAF, as for each second the solution is down, the clients might be losing money. 

Neutral

Before F5 Advanced WAF, our organization used IPS and Fortinet. Fortinet could only handle simple tasks, and F5 Advanced WAF is better for specialized application protection and scalability. Fortinet has a quick and easy setup process that doesn't require highly skilled engineers, making it suitable for resource management. 

I would rate the initial setup a seven out of ten. F5 Advanced WAF offers an easy setup process. Our company works with both the cloud and on-premise versions of the product. The solution's deployment, including the configuration, can takefour to five days. One engineer is enough to deploy F5 Advanced WAF for a single system.

The frequency of maintenance depends upon the setup of the solution; in case of faulty setup, the administration overhead will be greater due to repeated maintenance needs to fix issues. Often, customers invest in professional services to setup F5 Advanced WAF, following which an engineer can implement the maintenance. If professional services are not availed to setup the solution, it can take up to a month. 

The solution provides an ROI. When professional services install it, it has low administrative overhead and increases performance due to its scaling capacity. The solution can be used with any specific client or application as it allows user programming to be open-source. With F5 Advanced WAF, our company is able to adapt to the versatile requirements of clients. I would rate the ROI of the solution a nine out of ten. 

I would rate the pricing as seven out of ten. Sometimes, for specific models, additional licenses over the standard one need to be purchased. F5 Advanced WAF doesn't offer a single license that fits all use cases; the user needs to choose the license format. A structured license is usually preferred for F5 Advanced WAF. 

Our company also evaluated Palo Alto products, but F5 Advanced WAF offered superior scalability. 

The solution mainly provides automated responses; once the solution is set up and trained properly, it requires minimal intervention. As the solution is completely automated our company team has to only check the reports. 

But there is an elaborate setup process where, as part of our company, we deploy applications in an environment, implement work policies, and use automated software to simulate multi-vendor attacks and web hacking to test the solution's ability to detect attacks and, accordingly, we make adjustments to the flexible solution. 

After the simulation testing, the policy implemented for the solution is put in a station period where it won't be flexible initially, and then reporting is implemented, which will escalate to the anticipated restriction level soon. 

After the policies' staging period, when the solution has completed learning through simulations and our company feels confident with the test product in the active environment, the solution becomes automated from that point, and manual intervention is not necessary. A highly skilled team is needed for the abovementioned solution training process. 

Our company develops multiple applications internally as our work sites are not ready, and varying results are expected from different work sites, webpages, or newly added features. When a new feature is added to the solution, we revert back to the deployment process to test it. Our company needs to ensure that the in-house developed features that are integrated into the solution are not prone to attacks through simulation testing every time.

Our company feels confident when the solution's policies are developed through the staging, simulation and rule enforcement process. The aforementioned process helps with reports and also with performance. In our company, we have also encountered websites that didn't function well with the solution; even though the websites were functioning properly, the performance deteriorated slowly. Many attackers nowadays venture beyond the threshold, which might be difficult to capture.

If we consider any service or web applications over the internet that is attacked beyond the threshold, it wouldn't be a blind attack for the application owners as it would get blocked immediately, but instead, they progress slowly with the attack and ramp up once they can change the IP addresses and identify a suitable angle of attack, until these attacks get blocked they can affect your service.

Sometimes, a few of our organization's clients complain about the solution working slowly, even without apparent attacks. For example, if you're a trader, the website might function well enough most of the time, but sometimes you have to buy or sell within minutes, whereas if it doesn't work, you need to visit a different website, which can also be the goal of attackers. 

F5 Advanced WAF also allows you to write your own code for the interface.  F5 Advanced WAF specializes in behavior identification, which helps in superior attack mitigation. I would advise others to get the solution setup only by specialized or professional services. I would rate F5 Advanced WAF a nine out of ten. 

The primary use case is to secure the organization's applications from web-based attacks, securing both web applications and APIs.

The product is used to secure web applications and has the ability to use API templates and bot protection features, such as blocking requests or presenting CAPTCHA pages to end users. We also implement Swagger files for API security and use custom profiles for device ID threshold management.

The main improvement needed is related to IP intelligence. Once we start receiving traffic from repetitive IP addresses, we have to report it to the SOC team to block it at the layer four level. Users would like to have an additional IP intelligence license to handle this within WAF itself without needing to engage with the SOC team.

The solution has been used for three years.

Customer service and support depend on the level of support subscribed to, such as silver or platinum support, which determines the response time.

Positive

Deploying the solution involves an application learning and blocking phase. The process includes collecting application data, creating policies, and applying them to lower testing environments like QA or dev before moving to UAT and production. The learning phase is used to handle false positives and fine-tune the policies before going live.

The in-house team manages and supports the WAF, handling incidents reported by end users when legitimate traffic is blocked. They update the policies to prevent the recurrence of similar blocks.

The pricing and support service levels affect response times from customer service, depending on whether the support level is silver, platinum, etc.

We are exploring cloud-based solutions like Azure WAF and AWS WAF.

I rate F5 Advanced WAF an eight out of ten.

My clients often seek a comprehensive security solution for their hybrid environments, with both cloud and on-premise web applications. To address this, I recommend combining F5 Advanced WAF for web application security with Fortinet solutions, including FortiGate, FortiSign, and FortiAnalyzer, for broader network security aspects like vulnerability ranking, patch management, and remediation. I focus on FortiGate and FortiAnalyzer, collaborating with a colleague who manages firewall setup, ensuring a robust and unified security approach for our clients.

F5's user-friendly interface and seamless integration stand out as the most valuable features for us. The intuitive interface streamlines tasks, providing a straightforward experience. F5's adaptability in diverse environments sets it apart, especially when compared to alternatives like FortiGate. Despite being pricier, the ease of integration and user-friendly design make F5 Advanced WAF our preferred choice for securing web applications. F5's commitment to customer engagement, exemplified by hosting a certification event in Nigeria, further shows its support and involvement in our region.

One area for improvement in the product is its SSO integration, which posed challenges and required significant effort to resolve. The complexity of SSO deployment, coupled with high associated costs, could be addressed to enhance usability. Streamlining the SSO process and revisiting cost considerations would contribute to an improved user experience.

I have been working with F5 Advanced WAF for three years.

I would rate the stability as a nine out of ten.

I would give the scalability of the solution an eight out of ten. It is quite scalable and performs well. I would recommend F5 Advanced WAF for medium-sized businesses and enterprises, primarily due to considerations around cost and sustainability. The solution is well-suited for companies of this size, ensuring that not only is it deployed effectively, but it can also be sustained over time to meet ongoing security needs.

The technical support is good. I would rate it as a seven out of ten.

Neutral

For an end-to-end solution, Fortinet stands out over F5 Advanced WAF. Fortinet's comprehensive product suite, including FortiGate, FortiAnalyzer, and integrated features like CMDD, provides a more seamless and holistic approach to security. While F5 is strong in certain areas, the integrated capabilities of Fortinet make it my preferred choice for a comprehensive security solution.

The initial setup for F5 Advanced WAF is user-friendly and relatively straightforward.

The main drawback of F5 is the cost, which can be a challenge. 

Overall, I would rate F5 Advanced WAF as a nine out of ten.

Recent progress in F5 Advanced WAF's cloud technology has broadened the use cases for web application firewalls (WAFs) to include multi-cloud environments.

The most valuable feature of F5 Advanced WAF is its grand unity of the implementation, where you have the freedom to configure based on how it affects your use case or your organization. With the default setting of implicit deny, you can gradually start defining and deploying the tool to align with your environment, whether it is outdated, recent, or futuristic. This allows you to customize the solution to protect you from threat actors. You have the ability to define what the advanced threat act should do - whether it should alert, deny, or both - and it will deliver based on your configuration. Unlike other online solutions, F5 Advanced WAF provides flexibility to deliver to your unique environment the way you want.

While F5 Advanced WAF does limit the number of partners in certain regions to ensure successful business transactions, they could also benefit from expanding their partnerships and making it easier for more people to learn about and become experts in F5 Advanced WAF. By doing so, they could increase the reach and exposure of their solution, similar to how Cisco has become widely recognized in the security industry.

I have been using F5 Advanced WAF for approximately seven years.

The solution is highly stable. I have deployed several F5 Advanced WAF sites since 2016, and they are running without any issues, such as crashes or corrupt systems. To ensure stability, all that is required is to keep the solution updated and manage the patches in a timely manner.

Over the past 10 years, they have grown and increased its strength, adapting to the ever-changing market. They have incorporated Terraform and NGINX, showing their commitment to growth and stability. 

I rate the stability of F5 Advanced WAF a ten out of ten.

F5 Advanced WAF has an outstanding technical support team that is available worldwide. They have a Service Level Agreement (SLA) in place for critical issues, which guarantees a response within an hour. The team is highly professional and will stay with you until your issue is resolved.

I rate the support of F5 Advanced WAF a ten out of ten.

Positive

For a novice, deploying on F5 Advanced WAF is difficult. Everyone who works on the solution is expected to get trained and certified before they can be considered an administrator. Therefore, for someone who is certified, it is relatively easy to deploy.

If your environment is prepared, it should take no more than four to five hours to do the implementation. The most common issue people have is that their environment is not ready or the deployment engineer does not understand it. However, this can be quickly resolved, and then the configuration can be made, allowing you to be up and running.

Depending on the environment you are deploying in, you must first obtain the appropriate license. For example, if you are deploying in a virtual environment (VE) on-premise, you must first download the ISO file, deploy it, configure your interfaces, and then license the F5 Advanced WAF before configuring it.

I rate the initial setup of F5 Advanced WAF a ten out of ten.

We used five people for the deployment of the solution.

In terms of return on investment, F5 Advanced WAF offers a high ROI.

The F5 Advanced WAF allows for easy onboarding of web applications without the need for additional investments. For example, if a company has one web application that needs to be protected, and then tomorrow they have 15 more, they can easily onboard them onto the same F5 Advanced WAF device without any extra cost. This saves both time and money. Additionally, F5 Advanced WAF provides protection for a company's assets and reputation, ensuring compliance with regulations such as PCI DSS, and improving overall business efficiency by reducing the need for troubleshooting and manpower. Overall, F5 Advanced WAF offers a high return on investment.

I rate the ROI of F5 Advanced WAF a ten out of ten.

F5 Advanced WAF is not a cost-effective solution. Although they are attempting to reduce prices with their VE and cloud options, they are more expensive than other solutions. The solution is more expensive on average.

If you are interested in F5 Advanced WAF, it is billed on a yearly basis and based on the number of requests for the service. For example, if you purchase 200 megabytes, there is specific pricing for that capacity. Every year, we will renew the service and provide support for the solution.

F5 Advanced WAF does not offer local support services unless the customer is discussing it with a vendor or partner. These services are typically provided by other partners.

F5 Advanced WAF could improve in two main areas: pricing and partnerships. The current pricing of F5 Advanced WAF can be quite high, and while they do offer options like the VE or infrastructure service, they could make further efforts to make their solutions more affordable for everyone.

I rate the price of F5 Advanced WAF an eight out of ten.

We use one person for the maintenance of the solution.

I would advise new users to familiarize themselves with the overall functionality of the solutions. Understanding F5 Advanced WAF is crucial to accessing the full range of its capabilities. Without this understanding, you may be limited to only using it for your initial intended purpose. I recommend taking the time to learn more about F5 Advanced WAF and its capabilities, as it can provide solutions for many other needs in addition to your initial use case. It's also suggested to get certified and familiarize yourself with the product portfolio.

I rate F5 Advanced WAF a nine out of ten.

F5 Advanced WAF is used for the protection of applications from current web threats, including DDoS attacks. It provides a comprehensive security solution that incorporates different protection levels.

The most valuable feature of F5 Advanced WAF is its extensive set of capabilities for application protection, including DDoS prevention, and its ability to work with Pentesters and external scanners to observe user activity and eliminate false positives. This comprehensive approach to application security enables an organization to protect its web applications from diverse web threats effectively.

All features of Advanced WAF offer numerous functions, which means tuning configuration is not simple. It's a powerful tool yet can be complex for new users. Future updates should ensure not to break the current state, as users are concerned the new version may not meet current standards.

I have been using F5 Advanced WAF for more than ten years.

F5 Advanced WAF is considered a stable product, and I would rate it as ten out of ten in terms of stability.

The solution's scalability is solid, with the option to increase capabilities through licensing and adding modules in the virtual edition. However, it requires additional expenses, so I would rate it as a seven or eight out of ten.

F5 provides one of the best technical supports, though there have been a few cases where customers were dissatisfied due to response speed. However, in general, their support is highly efficient and knowledgeable.

Positive

In the past, Imperva was the leading solution, however, now F5 is preferred as it offers a superior solution according to customer feedback.

Deploying the solution, including initial configuration, licensing, addressing, and enabling WAF, could take one to three hours. However, for a comprehensive setup, considering external factors and optimizations, the process could take up to a month.

I handle installations and other related aspects by myself, without any additional help.

There are numerous benefits for end customers, as a secure application helps prevent potential breaches and ensures the safety of customers' data, especially in sensitive sectors like banking.

F5 Advanced WAF is not cheap. That said, it offers numerous features and is known as one of the best solutions in its segment. It provides significant value by offering comprehensive protection for high-stakes environments.

I work with other vendors, such as Broadcom, Qualys, BeyondTrust, and Trend Micro, depending on the customer's needs and the vision of my company.

I would fully recommend F5 Advanced WAF for its feature-rich offerings and high detection rate of threats. I rate it a ten out of ten as it is one of the best solutions available.

We use this solution for load balancing and web application firewall (WAF) services. We use the solution standalone and not integrated with other solutions.

It provides web application security and reduces bot attacks.

The web attack signatures are very important for detecting attacks, and the bot detection capability is an important feature that works well with F5 Advanced WAF.

The product could be more user-friendly for administrators. The user interface could be easier.

I have been using it for almost three years.

The solution is very stable. I would rate its stability as nine out of ten.

Very scalable. We use this solution for multiple customers and across data centers.

The solution offers good support. That said, sometimes it takes too much time to reach the right person.

Positive

I have also worked with Citrix NetScaler and F5 products, depending on customer needs.

The initial configuration is not too difficult, but subsequent configurations can be complex because they depend on customer needs.

I don't have direct knowledge of the pricing. From what I know, it is not too expensive compared to other solutions.

I am familiar with F5 and Citrix NetScaler solutions.

I recommend this product to others because of its effectiveness in mitigating threats.

I'd rate the solution eight out of ten.

Primarily, the Advanced WAF sits behind our network perimeter. It centralizes traffic flow to our network, filters requests, and identifies any potential threats.

It helps us detect threats or malicious requests coming into the network, protecting it from being hacked. It helps guard against issues like cross-site scripting (XSS) and other similar threats.

So, F5 Advanced WAF helped mitigate bot traffic for our web applications.

Moreover, my experience is that it's pretty straightforward to use. Our firewall team handles requests through a change management tool within scheduled change windows. However, F5 is our only firewall solution.

It's a valuable tool to protect web servers exposed to the external network. With numerous web applications running on Apache or IIS servers, the F5 Advanced WAF's threat detection capabilities protect the network before traffic reaches those servers.

It's a fairly easy-to-use and user-friendly tool. My administrators and team also like its ability to customize the rules per the requirements. 

The self-service aspect could be improved. 

The user interface (UI) also seems a bit outdated. Making it more user-friendly would be beneficial.

We've been using it for approximately five to six years.

I would rate the stability a ten out of ten. It is a stable product. 

It is pretty good. I would rate the scalability a seven out of ten.

Ssometimes, the way our enterprise handles change requests might slow things down because of the internal rules and processes. But these changes, once approved, do take effect immediately on the firewall itself. 

We have a change window twice a week for these requests. I don't think the limitation is with the firewall itself; it's more about our internal procedures.

Overall, I would rate the solution an eight out of ten because I have seen that not too much customization is required during setup. The change requests we submit are usually clear and easily applied. 

Overall, the policies work well, and the threat detection is good. It catches deviations and anomalies effectively.

From a recommendation standpoint, it's a fairly easy tool to use. However, you definitely need some knowledge about scripting, OWASP fundamentals, threat detection, and general cybersecurity principles to get the most out of it.