Compare F5 Distributed Cloud Services

Mitigate application and API vulnerabilities with F5's core WAF technology, backed by our advanced signature engine containng over 8,500 signatures for CVEs, plus other known vulnerabilities and techniques including Bot Signatures identified by F5 Labs and threat researchers.

Combination of violations, evasions and http protocol compliance checks. 

Self-learning, probabilistic model that suppresses false positive triggers.

Users can mask sensitive data in request logs by specifying http header name, cookie name, or query parameter name. Only values are masked. By default, values of query parameters card, pass, pwd, and password are masked.

When a request or repsonse is blocked by the WAF, users have the ability to customize the blocking response page served to the client.

User can specify which HTTP response status codes are allowed.

Rate limiting controls the rate of requests coming into or going out of an application origin. Rate limiting can be controlled for apps using key identifiers IP address, Cookie name, and/or HTTP header name. 

Analyzes IP threats and publishes a dynamic data set of millions of high-risk IP addresses maintained by F5, to protect app endpoints from inbound traffic from malicious IPs. IP treat categories include Spam Sources, Windows Exploits, Web Attacks, Botnets, Scanners Denial of Services, Phishing and more.

Data Guard prevents HTTP/HTTPS responses from exposing sensitive information, like credit card numbers and social security numbers, by masking the data. 

Rules that define the signature IDs and violations/attack types that should be excluded from WAF processing based on specific match criteria. The specific match criteria include domain, path, and method. If the client request matches on all these criteria, then the WAF will exclude processing for the items configured in the detection control.

Allows users to easily configure/specify the appropriate, allowed source domains.

Cookie Protection provides the ability to modify response cookies by adding SameSite, Secure, and Http Only attributes.

 The WAF engine inspects GraphQL requests for vulnerabilities and will block traffic based on the F5 signature database.

Network Firewall controls allowing users to block ingress traffic from specific sources, or apply rate limits to  network traffic from a specific source. Enhanced protections allow for filtering traffic based on source address, source port, destination address, destination port, and protocol.

Multi-layered,  volumetric attack mitigation including a combination of pre-set mitigation rules with automitigation and advanced routed DDoS mitigation scrubbing with full packet analysis via BGP route advertisement or authoritative DNS resolution.

Anomaly detection and alerting on abnormal traffic patterns and trends across apps and API endpoints, leveraging advanced machine learning (ML) to detect spikes, drops and other changes in app and API behavior  over time by analyzing request rates, error rates, latency and throughput with the ability to deny or rate limit endpoints.

Machine Learning (ML) based functionality that enables auto mitigation to be configured for abnormal layer 7 traffic based on analysis of individual client behavior and app performance over time including requests rates, erros rates, latency and more.

"Slow and low" attacks tie up server resources, leaving none available for servicing requests from actual users. This feature allows for the configuration and enforcement of request timeout and request header timeout values.  

F5 Distributed Cloud App Firewall supports inspection of the two most popular API protocols - GraphQL, and REST.

Advanced machine learning, enables markup and analysis of API endpoint traffic (requests & responses) for applications in order to discover API endpoints and perform behavioral analysis. This includes request and response schemas, sensitive data detection and authentication status. Providing inventory and shadow API sets with OpenAPI spec (OAS) generation.

Integrate into code repositories. Advanced machine learning enables automatic analysis of application code in order to discover and document API endpoints. This includes with automated OpenAPI spec (OAS) generation.

Import OpenAPI spec files to define API groups and set rules to control access to and enforce behavior of APIs.

API spec enforcement functionality enables a positive security model for APIs, allowing organization to easily enforce desired API behavior based on characteristics for valid, API requests. These characteristics are used to validate input and output data for things like data type, min or max length, permitted characters, or valid values ranges.

Includes the capability to learn and detect the authentication type and status of API Endpoints plus API risk scoring.  API Endpoints Risk Score feature provides users with a comprehensive measure of the risk associated with their API endpoints. The risk score is calculated using a variety of techniques, such as vulnerability discovery, attack impact, business value, attack likelihood, and mitigating controls. This helps organizations evaluate and prioritize API vulnerabilities in order to quickly identify APIs that require additional security measures.

Organizations can granularly control API endpoint connectivity and request types. They can identify, monitor, and block specific clients and connections all together or set particular thresholds. These includes deny listing (blocking) based on IP address, region/country, ASN or TLS fingerprint, plus more advanced rules defining specific  match criteria guiding app and API interactions with clients, including HTTP method, path, query parameters, headers, cookies, and more. This granular control of API connections and requests can be done for individual APIs or an entire domain.

Rate limiting controls the rate of requests coming into or going out of API endpoints.

Detect generic (credit card, social security number) or less common and custom PII data patterns (addresses, names, phone numbers) within API  responses, then mask the sensitive data or block API endpoints that are transmitting sensitive information.  

Identify API endpoints that are impacted by specific regulatory and compliance regimes and discover, tag and report on specific sensitive data. Including over 400 data types associated with over 20 different frameworks (PCI-DSS, HIPPA, GDPR etc.) when observed in API code and/or through traffic.

The WAF signature engine includes unique signatures for automated threats and bot techniques including crawlers, DDoS/DoS and more.

Protects apps from automated attacks by leveraging JavaScript and API calls to collect telemetry and mitigate sophisticated attacks with constant ML analysis of signal data to rapidly respond to bot retooling, dynamic updates of real-time detection models​ designed to protect against all bot use cases e.g. credential stuffing, account takeover, fake accounts etc.

Provides multi-phase protection for web applications against Formjacking, Magecart, digital skimming and other malicious JavaScript attacks. This multi-phase protection system includes detection, alerting, and mitigation.

Layer 3 network transit between public clouds, on-premises datacenters and distributed edge sites.

Integrate third-party network firewall services such as BIG-IP and Palo Alto Networks across multiple cloud networks.

Granular network isolation and microsegmentation to secure network segments on premises and across public cloud networks.

Native TLS encryption for all data transit across networks.

Automated provisioning and orchestration of public cloud network constructs.

Distributed load balancing services for TCP, UDP and HTTPS requests between app clusters across clouds.

Granular security policies to control access to API endpoints and clusters in distributed cloud environments.

Identify service availability across distributed app clusters.

Route based policy enforcement fo HTTP and HTTPS traffic.

Native TLS encryption for all data transit across networks.

AI/ML powered malicious user detection performs user behavior analysis and assigns a suspicion score and threat level based on the acitivity of each user. Client interactions are analyzed on how a client compares to  others—the number of WAF rules  hit, forbidden access attempts,  login failures, error rates, and more. Malicious user mitigation is an adaptive response and risk-based challenge capability - serving different challenges such as Javascript or Captcha challenge or block temporarily based on user threat level.

Enables micro segmentation and support for advanced security at the application layer with development of allow/deny lists, Geo IP filtering and custom rule creation to act on incoming requests including match and request constraint criteria based on a variety of attributes/parameters TLS fingerprint, geo/country, IP prefix, HTTP method, path, headers and more.

Automatically scan and map any domain to find all exposed services and infrastructure including server versions, and operating systems along with identifying known vulnerabilities (CVEs). Paired with dynamic application security testing (DAST) to run automated penetration tests of any domain, to uncover unknown vulnerabilities and deliver remediation guidance.

Cross-Origin Resource Sharing (CORS)  is useful in any situation where the browser, by default, will disallow a cross-origin request and you have a specific need to enable them. CORS policy is a mechanism that uses additional HTTP header information to inform a browser to allow a web application running at one origin (domain) have permission to access selected resources from a server at a different origin.

Identification of real client IP addresses for monitoring, logging, defining allow/deny policies etc. Security events and request logs will show this real client IP address as the source IP, when this feature is enabled. 

Support for both TLS and mutual-TLS for authentication with policy-based authorization on the load balancer/proxy provides the capability to enforce end-to-end security of application traffic. Mutual TLS supports the ability to send client certificate details to origin servers in x-forwarded-client-cert (XFCC) request headers.

Support provided in a variety of methods including in console ticketing, email and phone support.