We use the solution for load balancing.
External reviews
22 reviews
from
and
External reviews are not included in the AWS star rating for the product.
A cost-effective solution for load balancing with data loss prevention
What is our primary use case?
What needs improvement?
They should improve the capability, and then they should work on the virtualization of NGINX. Currently, most environments are virtualized. F5 Advanced WAF will not be able to protect it.
For how long have I used the solution?
I have been using F5 Advanced WAF as a reseller for 5 years.
How are customer service and support?
Technical support is good but not enough. It takes a lot of time to get support.
How would you rate customer service and support?
Neutral
How was the initial setup?
The initial setup is not so easy nor not so complex. There is a learning phase, and there are policies to apply. It complies with regulations. Recently, we used it for Formula One, and it proved very effective.
What was our ROI?
ROI is covered in one year. You can see how it protects and mitigates damages in the network.
What's my experience with pricing, setup cost, and licensing?
The product is not so expensive. It depends on the assets.
What other advice do I have?
There are other solutions for data loss prevention, such as Symantec and IP solutions. There are options available for DNS blocking. While these solutions may specialize in certain aspects, They offer comprehensive coverage across various areas. Each vendor specializes in different aspects, but F5 Advanced WAF excels in its particular domain.
I recommend the solution. Most of the environment is going to virtualization.
Overall, I rate the solution an 8 out of 10.
Offers features of DDoS protection, bot blocking and HTTP header verifications
What is our primary use case?
Our company uses two versions of F5 Advanced WAF. The solution is used to protect against web hacking bots.
How has it helped my organization?
F5 Advanced WAF has improved our organization's security posture by fending off all types of attacks. The solution has been successful in mitigating not just one kind of attack but also rare attacks that disturb the OS and try to achieve a denial of service. The solution has saved our company from performance deterioration and also enhanced security.
What is most valuable?
The solution's most valuable features include application DDoS protection, bot blocking, and HTTP header verifications. The solution protects against seven types of DDoS attacks.
What needs improvement?
More legacy protocols should be added to the solution. The aforementioned protocols are generally less used and might have been phased out from multiple solutions. But some of the large corporations that are clients of our company are unwilling to let go of applications that have been developed.
The aforementioned clients believe that as some of the new websites do not use these technologies, it wouldn't be ideal to replace the existing applications; for example, a bank with millions of dollars connected to a software wouldn't be willing to replace it instantly.
It often takes years for enterprise-level businesses to replace applications. The vendor of F5 Advanced WAF needs to consider that even if legacy protocols are not necessarily used for new projects, existing or prior applications projects rely heavily on them, and such protocols need to be protected until they are completely phased out of the market.
The vendor needs to provide complete support for the legacy protocols, just like the latest protocols in the market, until they are assured that none of the customers are using them.
I would like to witness the expansion of the supported protocols set by the solution. The tool should be promoted as an advanced protection solution that supports all types of protocols. In future versions, some protocols offered by the solution need to be more specialized. All public-facing protocols should be added to F5 Advanced WAF.
For how long have I used the solution?
I have been using F5 Advanced WAF since 2018.
What do I think about the stability of the solution?
If the solution is setup by professional services, then it will exhibit outstanding stability, otherwise there might be issues. I would rate the stability an eight out of ten.
What do I think about the scalability of the solution?
I would rate the scalability a nine out of ten. The solution is highly scalable and accommodating. The solution also allows troubleshooting due to its scaling capacity. The backend system of the solution allows the accommodation of solutions that one can pickup.
In our company, there are about ten users of F5 Advanced WAF, and it's being used daily. Our organization also plans to increase the usage and the number of users for the solution. The tool's performance has benefitted application delivery in our organization.
How are customer service and support?
I would rate the tech support a seven out of ten. The tech support quality is slightly above average. The support team's first responders to raise tickets are not skilled engineers.
Large enterprises usually expect their issues to be resolved within a few minutes, so in a support process where first responders collect information and if they are unable to tackle it, the issue gets escalated, which overall becomes a huge, time-consuming process. The vendor should provide highly skilled first responders to large clients of F5 Advanced WAF, as for each second the solution is down, the clients might be losing money.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
Before F5 Advanced WAF, our organization used IPS and Fortinet. Fortinet could only handle simple tasks, and F5 Advanced WAF is better for specialized application protection and scalability. Fortinet has a quick and easy setup process that doesn't require highly skilled engineers, making it suitable for resource management.
How was the initial setup?
I would rate the initial setup a seven out of ten. F5 Advanced WAF offers an easy setup process. Our company works with both the cloud and on-premise versions of the product. The solution's deployment, including the configuration, can takefour to five days. One engineer is enough to deploy F5 Advanced WAF for a single system.
The frequency of maintenance depends upon the setup of the solution; in case of faulty setup, the administration overhead will be greater due to repeated maintenance needs to fix issues. Often, customers invest in professional services to setup F5 Advanced WAF, following which an engineer can implement the maintenance. If professional services are not availed to setup the solution, it can take up to a month.
What was our ROI?
The solution provides an ROI. When professional services install it, it has low administrative overhead and increases performance due to its scaling capacity. The solution can be used with any specific client or application as it allows user programming to be open-source. With F5 Advanced WAF, our company is able to adapt to the versatile requirements of clients. I would rate the ROI of the solution a nine out of ten.
What's my experience with pricing, setup cost, and licensing?
I would rate the pricing as seven out of ten. Sometimes, for specific models, additional licenses over the standard one need to be purchased. F5 Advanced WAF doesn't offer a single license that fits all use cases; the user needs to choose the license format. A structured license is usually preferred for F5 Advanced WAF.
Which other solutions did I evaluate?
Our company also evaluated Palo Alto products, but F5 Advanced WAF offered superior scalability.
What other advice do I have?
The solution mainly provides automated responses; once the solution is set up and trained properly, it requires minimal intervention. As the solution is completely automated our company team has to only check the reports.
But there is an elaborate setup process where, as part of our company, we deploy applications in an environment, implement work policies, and use automated software to simulate multi-vendor attacks and web hacking to test the solution's ability to detect attacks and, accordingly, we make adjustments to the flexible solution.
After the simulation testing, the policy implemented for the solution is put in a station period where it won't be flexible initially, and then reporting is implemented, which will escalate to the anticipated restriction level soon.
After the policies' staging period, when the solution has completed learning through simulations and our company feels confident with the test product in the active environment, the solution becomes automated from that point, and manual intervention is not necessary. A highly skilled team is needed for the abovementioned solution training process.
Our company develops multiple applications internally as our work sites are not ready, and varying results are expected from different work sites, webpages, or newly added features. When a new feature is added to the solution, we revert back to the deployment process to test it. Our company needs to ensure that the in-house developed features that are integrated into the solution are not prone to attacks through simulation testing every time.
Our company feels confident when the solution's policies are developed through the staging, simulation and rule enforcement process. The aforementioned process helps with reports and also with performance. In our company, we have also encountered websites that didn't function well with the solution; even though the websites were functioning properly, the performance deteriorated slowly. Many attackers nowadays venture beyond the threshold, which might be difficult to capture.
If we consider any service or web applications over the internet that is attacked beyond the threshold, it wouldn't be a blind attack for the application owners as it would get blocked immediately, but instead, they progress slowly with the attack and ramp up once they can change the IP addresses and identify a suitable angle of attack, until these attacks get blocked they can affect your service.
Sometimes, a few of our organization's clients complain about the solution working slowly, even without apparent attacks. For example, if you're a trader, the website might function well enough most of the time, but sometimes you have to buy or sell within minutes, whereas if it doesn't work, you need to visit a different website, which can also be the goal of attackers.
F5 Advanced WAF also allows you to write your own code for the interface. F5 Advanced WAF specializes in behavior identification, which helps in superior attack mitigation. I would advise others to get the solution setup only by specialized or professional services. I would rate F5 Advanced WAF a nine out of ten.
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Efficiently protect web servers exposed to the external network and robust stability
What is our primary use case?
Primarily, the Advanced WAF sits behind our network perimeter. It centralizes traffic flow to our network, filters requests, and identifies any potential threats.
How has it helped my organization?
It helps us detect threats or malicious requests coming into the network, protecting it from being hacked. It helps guard against issues like cross-site scripting (XSS) and other similar threats.
So, F5 Advanced WAF helped mitigate bot traffic for our web applications.
Moreover, my experience is that it's pretty straightforward to use. Our firewall team handles requests through a change management tool within scheduled change windows. However, F5 is our only firewall solution.
What is most valuable?
It's a valuable tool to protect web servers exposed to the external network. With numerous web applications running on Apache or IIS servers, the F5 Advanced WAF's threat detection capabilities protect the network before traffic reaches those servers.
It's a fairly easy-to-use and user-friendly tool. My administrators and team also like its ability to customize the rules per the requirements.
What needs improvement?
The self-service aspect could be improved.
The user interface (UI) also seems a bit outdated. Making it more user-friendly would be beneficial.
For how long have I used the solution?
We've been using it for approximately five to six years.
What do I think about the stability of the solution?
I would rate the stability a ten out of ten. It is a stable product.
What do I think about the scalability of the solution?
It is pretty good. I would rate the scalability a seven out of ten.
Ssometimes, the way our enterprise handles change requests might slow things down because of the internal rules and processes. But these changes, once approved, do take effect immediately on the firewall itself.
We have a change window twice a week for these requests. I don't think the limitation is with the firewall itself; it's more about our internal procedures.
What other advice do I have?
Overall, I would rate the solution an eight out of ten because I have seen that not too much customization is required during setup. The change requests we submit are usually clear and easily applied.
Overall, the policies work well, and the threat detection is good. It catches deviations and anomalies effectively.
From a recommendation standpoint, it's a fairly easy tool to use. However, you definitely need some knowledge about scripting, OWASP fundamentals, threat detection, and general cybersecurity principles to get the most out of it.
The central point of all the applications being scrubbed and checked
What is our primary use case?
We use the solution to secure web applications running in the organization.
What is most valuable?
F5 is one of the best products. We use it for multiple segments within our organization and applications. It is a central point of all the applications being scrubbed and checked.
What needs improvement?
The customer service could be improved.
For how long have I used the solution?
I have been using F5 Advanced WAF for more than ten years.
What do I think about the stability of the solution?
The product is stable.
I rate the solution’s stability a seven out of ten.
What do I think about the scalability of the solution?
The solution is scalable.
Our entire organization and clients use the solution.
How was the initial setup?
The initial setup is easy since I have used the technology for almost 20 years. Some applications require more attention depending on what you are doing and trying to achieve with the particular module. You need some assistance from the team in configuring the different components within the application through the web.
What was our ROI?
The solution is worth the money that you spend.
What's my experience with pricing, setup cost, and licensing?
The solution is expensive.
What other advice do I have?
Whatever you are looking for can be done on the platform. Some features may not be available with IO components. A few features give you the flexibility that no other product can.
Overall, I rate the solution an eight out of ten.
Has valuable monitoring tools and good scalability
What is our primary use case?
We use the product for load-balancing purposes.
What is most valuable?
The product has valuable features for load balancing, monitoring tools, and HPXpress services.
What needs improvement?
They could provide better pricing.
For how long have I used the solution?
We have been using F5 Advanced WAF for a year.
What do I think about the stability of the solution?
I rate the product's stability an eight out of ten.
What do I think about the scalability of the solution?
The product is highly scalable. It is suitable for enterprise businesses. I rate its scalability an eight out of ten.
How was the initial setup?
I rate the initial setup process a seven out of ten.
What's my experience with pricing, setup cost, and licensing?
I rate F5 Advanced WAF's pricing a three out of ten.
What other advice do I have?
I rate F5 Advanced WAF an eight out of ten.
Ensures a robust and unified security approach for our clients
What is our primary use case?
My clients often seek a comprehensive security solution for their hybrid environments, with both cloud and on-premise web applications. To address this, I recommend combining F5 Advanced WAF for web application security with Fortinet solutions, including FortiGate, FortiSign, and FortiAnalyzer, for broader network security aspects like vulnerability ranking, patch management, and remediation. I focus on FortiGate and FortiAnalyzer, collaborating with a colleague who manages firewall setup, ensuring a robust and unified security approach for our clients.
What is most valuable?
F5's user-friendly interface and seamless integration stand out as the most valuable features for us. The intuitive interface streamlines tasks, providing a straightforward experience. F5's adaptability in diverse environments sets it apart, especially when compared to alternatives like FortiGate. Despite being pricier, the ease of integration and user-friendly design make F5 Advanced WAF our preferred choice for securing web applications. F5's commitment to customer engagement, exemplified by hosting a certification event in Nigeria, further shows its support and involvement in our region.
What needs improvement?
One area for improvement in the product is its SSO integration, which posed challenges and required significant effort to resolve. The complexity of SSO deployment, coupled with high associated costs, could be addressed to enhance usability. Streamlining the SSO process and revisiting cost considerations would contribute to an improved user experience.
For how long have I used the solution?
I have been working with F5 Advanced WAF for three years.
What do I think about the stability of the solution?
I would rate the stability as a nine out of ten.
What do I think about the scalability of the solution?
I would give the scalability of the solution an eight out of ten. It is quite scalable and performs well. I would recommend F5 Advanced WAF for medium-sized businesses and enterprises, primarily due to considerations around cost and sustainability. The solution is well-suited for companies of this size, ensuring that not only is it deployed effectively, but it can also be sustained over time to meet ongoing security needs.
How are customer service and support?
The technical support is good. I would rate it as a seven out of ten.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
For an end-to-end solution, Fortinet stands out over F5 Advanced WAF. Fortinet's comprehensive product suite, including FortiGate, FortiAnalyzer, and integrated features like CMDD, provides a more seamless and holistic approach to security. While F5 is strong in certain areas, the integrated capabilities of Fortinet make it my preferred choice for a comprehensive security solution.
How was the initial setup?
The initial setup for F5 Advanced WAF is user-friendly and relatively straightforward.
What's my experience with pricing, setup cost, and licensing?
The main drawback of F5 is the cost, which can be a challenge.
What other advice do I have?
Overall, I would rate F5 Advanced WAF as a nine out of ten.
F5 is multipurpose platform for security solution
What do you like best about the product?
F5 as WAF is user friendly with multiple feature added with adding add on modules. Mitigating vulnerability is simple and processing time of application traffic is less compared to others.
What do you dislike about the product?
Nothing point of dislike still while using it.
What problems is the product solving and how is that benefiting you?
F5 can handle big time traffic and process and check for any threat in it.
F5 Advanced WAF
What do you like best about the product?
The simplicity of configuration is very good.the signature-based protection module is also very advanced.the web API is easy to understand and deploy in production newtwork.
What do you dislike about the product?
The interface could be better.more documentation should be available on best practices.
What problems is the product solving and how is that benefiting you?
Protecting web applications in very secured manner.complete end to end security need, monitoring and protection against vary array of web based attacks. Mitigating security vulnerabilities.
showing 11 - 18