AWS WAF vs. Barracuda Web Application Firewall vs. F5 Distributed Cloud WAF (Web Application Firewall)

Well Suited: 1. To prevent DDOS attacks: AWS WAF has a lot of managed rules to prevent DDOS attacks based on traffic origination from a particular IP or IP reputation etc. 2. To rate-limit requests: Well it sounds familiar like preventing DDOS attacks, but it can also be used to rate-limit requests originating from the same IP address. We have used this feature so that we can test multiple failure scenarios for our application. 3. To prevent Data crawling: The BOT control feature allows us to prevent BOTs from crawling data on our websites. Not Suited: 1. To integrate applications outside of AWS Cloud: As I mentioned in my previous comments, this type of integration requires a custom implementation of another AWS resource.

Incentivized

Easy to use and reliable, with very little maintenance required and zero downtime to date. For the education sector, ease of use is hugely important as IT Managers/Technicians are often "Jack of all trades" with a good, broad general knowledge but perhaps lacking specific expertise in certain aspects. Being provided with easy-to-follow tutorials and instructions has been very useful in setting up and configuring the firewall, especially as my background is more in desktop support.

Incentivized

It helps our website to manage well during high traffic seasons and Holidays. This plaform manages the website overall performance and also protect it against DDoS attacks during these High demand period. It also protects transactions done on our website for the booking of services and products buying by our customers and keep their data safe.

Incentivized

• Protect any application against the most common attacks.
• Provides better visibility of web traffic.
• It allows us to control the traffic in different ways in which it is enabled or blocked through the implementation of security rules developed personally according to our needs.
• It is able to block common attacks such as SQL code injection.
• It allows defining specific rules for applications, thus increasing web security as they are developed.

Incentivized

• Attack patterns are regularly updates through contents via Barracuda Web Application Firewall update servers
• Bot Protection has a good line feature to verify between the genuine clients like browsers and bots
• Dos Protection also good level of protection to mitigate Layer 7 attacks
• Allow Deny Rules provides a lot of granular controls to allow and deny the traffic
• URL profiles has a very granular control to mitigate false positives
• Parameter profiles has a very granular control to mitigate false positives
• Risk score feature for the clients to mitigate attacks is also very good feature
• Client fingerprint module can be used against malicious user to enhance security
• Separate XML and JSOn profile for all the URL profiles of the application is plus
• API security is very much effective and shadow API can also be identified

• Layer seven attacks are becoming far more common. Traditionally it was always layered three, layer four, where you get an additional firewall, but with the application layer attacks become more frequent, more popular, et cetera. So having the web application firewall protecting us, and then with the recent Log4j, that's the most recent use case when it gave us that instant level of protection whilst we remediated the Log4j that we had that and the F5 Distributed Cloud WAF was protecting us.
• I have a great relationship with the account manager, my account manager, and I think he drives the best price possible, um, for me, and I'm happy with that price.
• F5 Distributed Cloud WAF is always innovating and evolving.
• We run a very competitive proof value where we run numerous competitors against each other, and then we evaluate from that and then make the selection, and F5 Distributed Cloud WAF was the winner.

Incentivized

• AWS WAF is a bit costly if used for single applications.
• they should provide attack-wise protection, like if my certain type of application is vulnerable to DDOS then I should be able to buy WAF, especially for that attack.
• CLI tool to test in offline mode if possible.

Incentivized

• STM crashes sometimes happen due to unusual traffic pattern
• Obfuscation on the client side user credentials which appears in the developer tools of browser
• URL Profiles redundancy during the learning of traffic needs to be fixed
• Dos Protection should be more granular like escalation period to throw JS challenge, Captcha and rate limit when escalation period hits until the WAF stops the attack
• Client Fingerprinting should work as expected when verifying the clients as in rare some scenarios, it creates issues

• Lack of warnings, currently the console does not provide a warning when deleting key-value entry.
• The web GUI could use some tweaking, currently no undo option when removing exclusion rules.
• Configuration complexity, currently menus and options are hidden, making it hard to configure vs on prem.

We have been using AWS WAF for the past 3 years in front of our websites. We find it useful in preventing data crawling, DDOS attacks, etc on our websites, and hence we are going to use it in the future as well. AWS WAF is one of the best Firewalls in business.

Incentivized

We gave it an 8 because it protects our web apps well and is reliable. The WAF is flexible and meets most of our needs. It could improve in user interface and make integrations easier, but overall, it’s a solid and effective security tool for us.

Incentivized

The product is highly scalable. It is easy to configure the rules and thereby helps us to mitigate many vulnerabilities. The interface and programming of the firewall provisions were easy to setup. Amazon clearly spent a lot of time figuring this out and perfecting it. It allows users to do customized configurations based on their needs. It provides protection against a number of security issues like XSS, SQL injection, etc. I would definitely recommend this for protecting your infra as you scale, since this basically protects and filters all requests hitting your application server.

Incentivized

-User friendly interface for quick learning -Quick deployment for deploying applications -Easy to manage for naive -System components and upgradation of the WAF is very easy go with -Back restoration is very to make it up and ready anytime -Seperate JSON and XmL profiles for each URLs of the application is plus -Amazing and world class support engineer in comparison other vendors and always available to support -Quick resolution on bugs with their patch applying process

I believe is a solution that was designed from the start to be simple and easy to use. Coming from Imperva, it simply eased the burden and complexity of managing and securing our apps on different environments (cloud and on-prem). It easy to scale and very quick to deploy (as a cloud waf should be), provide us with DevOps integrations, visibility and automatic insights from multiple events that guarantee peace of mind for us analysts and opp managers.

Incentivized

Seems no issue

Incentivized

Unnoticed slowness

Incentivized

If you're intending to use AWS WAF, I would say that you absolutely should sign up for support. AWS Support is excellent and they can help you in a really good way to solve your issues.

Incentivized

The Barracuda Web Application Firewall is easy to use. Support from Barracuda is great also. Load Balancing of the Web Application Firewall is also nice. This allows you to do maintenance or have large loads for the end-user. Threat monitoring of our network and traffic coming into our services within our cloud solution.

Incentivized

I never contacted support for this product.

Incentivized

Online training saves me lots of time

Incentivized

Just make sure you origin servers have F5 IPs allowed.

Incentivized

Easy of use. Setup and configuration is fairly quick. There are the usual advantages of it being a cloud solution where you can buy into the solution, configure it and set it up and get it up and running. If you are already a subscriber to AWS, having a native service has its advantages.

Incentivized

We have been using their Backup products especially Backup Appliances and legacy products like Intronis. We are also using their Cloud Backup Solutions for O365. This is the reason we opted for this product.

It provides fewer false positives and a more granular approach to eliminating them, allowing us to focus on threats. Also, with the need to secure both on-premise and cloud-based web applications, we can only use Azure on the cloud part, but we still need to cover on-premise apps with WAF, so we would need to double the time to deploy and manage. Also, its flexibility of deployment scenarios offers us a faster time to deploy WAF without adjusting the app delivery process to WAF's existence.

Incentivized

Dont see any issue so far

Incentivized

• Implementing this AWS service has been really favorable because when creating custom rules we give more specific protection to our applications against vulnerabilities that cause them to be consuming other resources or running with errors.
• It allows us to control the traffic of our business applications, which is really favorable, given that in this way we can decide that you can access them and not.
• It is extremely advantageous that we can establish rules in a centralized way since it saves time, as well as it allows us to protect several applications at the same time by reusing the rules established above.
• It allows you to save time and money because we only pay for what is used.

Incentivized

• Much better response times for remote transactions
• 4 year refresh cycle included with active support contracts
• More expensive than traditional firewalls (however its superior to those, not apples to apples)

Incentivized

• The biggest gain for us was speed. Before F5 Distributed Cloud WAF, onboarding a new app to our WAF stack meant manual rule tuning, traffic sampling and regression testing. Right now, we spin up a service, tag it with the right policy and its ready (production ready) within hours

Incentivized