F5 Distributed Cloud WAF leverages F5's Advanced WAF technology, delivering WAF-as-a-Service and combining signature- and behavior-based protection for web applications. It acts as an intermediate proxy to inspect application requests and responses to block and mitigate a broad spectrum of risks stemming from the OW ASP Top 10, persistent and coordinated threat campaigns, bots, and layer 7 DoS.
N/A
Microsoft IIS
Score 7.4 out of 10
N/A
Microsoft IIS is an application server and infrastructure.
It is doing its job effectively, and its scalability is superb. So, if you have a mixed environment with cloud and on-premise systems to protect this product, provide a solution to the challenge. However, its management is more suited to DevOps teams rather than to the ones responsible for on-premise systems, making the management a bit more complex.
Publishing applications or websites is easy with Microsoft IIS. You don't need external software or complicated tutorials involving command lines and editing configuration files. On other hand, sometimes the troubleshooter needs a high knowledge of Windows Server, Registry, and tools to debug the application. If you need to host non-Microsoft technology as PHP pages or have a low budget, I recommend IIS equivalent software as Apache.
JBoss EAP is subscription based/open source platform. It's very reliable and great for deploying high transaction Java based enterprise applications. It integrates well with third party components like mod_cluster and supports popular Java EE web-based frameworks such as Spring, Angular JS, jQuery Mobile, and Google Web Toolkit.
Layer seven attacks are becoming far more common. Traditionally it was always layered three, layer four, where you get an additional firewall, but with the application layer attacks become more frequent, more popular, et cetera. So having the web application firewall protecting us, and then with the recent Log4j, that's the most recent use case when it gave us that instant level of protection whilst we remediated the Log4j that we had that and the F5 Distributed Cloud WAF was protecting us.
I have a great relationship with the account manager, my account manager, and I think he drives the best price possible, um, for me, and I'm happy with that price.
F5 Distributed Cloud WAF is always innovating and evolving.
We run a very competitive proof value where we run numerous competitors against each other, and then we evaluate from that and then make the selection, and F5 Distributed Cloud WAF was the winner.
A big advantage that we use all the time is reviewing the logs that automatically get generated in IIS. It has helped us troubleshoot various problems in our applications over the years.
IIS integrates really well with Visual Studio and TFS. We are able to quickly deploy new applications and changes to applications when requested by the business.
IIS has proven that it is easy to configure and maintain with minimal effort.
MOD_CLUSTER integration. JBoss EAP integrates pretty well with mod_cluster. This is an intelligent load balancer especially useful in highly clustered environments.
Supports enterprise-grade features such as high availability clustering, distributed caching, messaging etc.
Supports deployment in on-premise, virtual and hybrid cloud environments.
We gave it an 8 because it protects our web apps well and is reliable. The WAF is flexible and meets most of our needs. It could improve in user interface and make integrations easier, but overall, it’s a solid and effective security tool for us.
We have no intention to replace all applications running on top of the IIS platform. Not all applications support other platforms and not all support staff are skilled in Linux/Apache platform support. Whereas IIS may not be the best performing or most secure web platform available, for the aforementioned reasons, it is impossible not to continue use of this product.
I believe is a solution that was designed from the start to be simple and easy to use. Coming from Imperva, it simply eased the burden and complexity of managing and securing our apps on different environments (cloud and on-prem). It easy to scale and very quick to deploy (as a cloud waf should be), provide us with DevOps integrations, visibility and automatic insights from multiple events that guarantee peace of mind for us analysts and opp managers.
As I've mentioned earlier, Microsoft IIS is very simple and easy to use. The user interface is a little bit overloaded with a huge number of different options, but once you have a little clue of what you are doing and what you need - no issues at all.
ARR (application request routing) in Microsoft IIS Server enables the web-admins to increase the web app reliability and availability through the rule based routing and load balancing of HTTP requests which in turn provides highly available server. IIS 7.0 Manager also provides kernel as well as user mode caching for faster performance and in case if the server fails, the IIS server has good amount of details logged in its log files which help understand and debug the cause quickly. Load balancing facilitates IIS server to fight against availability issues.
In my experience, I have never had significant issues with IIS performance. Sometimes I've experienced issues with loading time, but it is mostly related to the web site code. However Amazon, Microsoft and Google providing free cloud services with very limited resources, and in that scenario, "heavy" websites on IIS could be the issue. In other situations - performance is good.
JBoss EAP is lightweight and doesn't really consumes much physical resources. It's high performing and suites well for high transaction Java enterprise applications. The out of box performance settings are not really great and you will have to configure the settings to suite your environment to leverage it's full benefits.
As mentioned earlier there is so much documentation or guides or stack overflow questions out there that someone will have faced the same or very similar scenario to what you are going through that you will almost certainly find a solution to what you are after.
The other one that I've used in the past, they're very similar and I haven't used it recently, so I can't do a side-by-side comparison today. But I can say that F5 does everything we want it to do consistent with what this other product did do and it's got enhanced features and of course we have a long history with F5 as a product set in general.
Apache is java. Java is unnecessary complex. No developer wants to invest in learning all the hundreds of text based configuration files to get something done. Also, apache gives you the most evil and un-usable user interface possible. [Microsoft] IIS makes [life] after development easy, which is already complex enough to be bothered by something as mundane as exposing your work over the internet.
Microsoft IIS Server is scalable if the underlying server configuration is done correctly. Use x64 edition v/s 32bit and using 32bit mode application pools are some of the tweaks to be done to make the IIS server scalable. There are too many small configurations need to be carried out in order to make a highly scalable IIS server hence not giving full score in this area.
The biggest gain for us was speed. Before F5 Distributed Cloud WAF, onboarding a new app to our WAF stack meant manual rule tuning, traffic sampling and regression testing. Right now, we spin up a service, tag it with the right policy and its ready (production ready) within hours
Jboss EAP is easy to deploy and configure. This lead to lower cost and faster delivery.
Even though we have large number of machines running JBoss, we have only two Jboss Administrators. It doesn't requires too much administration and maintenance on daily basis and reduces number of administrators required for large implementations.
