Barracuda Web Application Firewall Room for Improvement

Carlo Bertini - PeerSpot reviewer
It consultant and Project Manager/ CTO technology officer at Cabar at Cabar SRL

One of Barracuda's limitations is its user interface. The GUI for configuration is not intuitive and has remained largely unchanged for the past 10 to 12 years. This is something I've discussed with Barracuda representatives here in Italy as well. It needs more modernization.

View full review »
UmeshKumar2 - PeerSpot reviewer
Senior System Administrator at a tech vendor with 10,001+ employees

I have issues with the load balancing of the solution which is slow. The connection pooling in Barracuda also doesn't work. There is an issue when someone needs access to a site quickly. The issue is with HTTPS services. I am not sure if they have changed all these in the solution’s latest version.

View full review »
VijayKumar8 - PeerSpot reviewer
Network Security Engineer at Progressive Infotech Pvt. Ltd.

The Barracuda team just needs to improve their product as per their competitors, like F5 and Imperva. They should improve their features, so they easily compare to the competition.

They could always continue to improve their security so that they maintain up-to-date on any current threats. 

View full review »
Buyer's Guide
Barracuda Web Application Firewall
March 2024
Learn what your peers think about Barracuda Web Application Firewall. Get advice and tips from experienced pros sharing their opinions. Updated: March 2024.
765,234 professionals have used our research since 2012.
Carlo Bertini - PeerSpot reviewer
It consultant and Project Manager/ CTO technology officer at Cabar at Cabar SRL

The usability of the interface could be improved. 

The interface is not easy to use or to configure.

A feature that could be very powerful would be the capability to provide the monitoring of the security analogies, and proactive alerts in case of potential issues.  

The firewall protects and logs, but does not provide you with an analogy on that data. 

View full review »
Anuraj Nair - PeerSpot reviewer
Presales Engineer at SNSIN

There are some vulnerabilities that are reported across the tools offered by Barracuda for some devices, which need to be taken care of from an improvement perspective.

View full review »
Sami Esber - PeerSpot reviewer
Cyber Security Consultant at a engineering company with 10,001+ employees

The graphical user interface (GUI) of this solution needs improvement. Sometimes it hangs, so you'll need to restart it.

We have a problem with the license because we are unable to migrate the license from a permanent license to a one-year license, or from a temporary license to a permanent license. This is a critical point because we need support from the Barracuda team for this, all the time. They can't change it successfully from their side.

When you start on the licensing, usually during the deployment, we give the customer a temporary license. You can create this token from the website, then when the customer buys the license, you need to upgrade the current license from a one month license to a permanent license for one year, two years, or three years, depending on the license. 

Sometimes, when we are uploading from the old verification, e.g. from the old token to the new token, the VM hangs, and we'll need support from Barracuda's side: from the backend. Their  support team does it like this, and helps us from their side.

The firewall is a little bit complicated.

View full review »
Phakedi Mphela - PeerSpot reviewer
IT Project Manager at Brilliant telecommunications

The platform's pricing needs improvement.

View full review »
SF
Technical Program Manager, Security - Mergers at a tech vendor with 10,001+ employees

I would like to see a native multi-cloud cover. Right now if I have applications that run both on Amazon and Google, I have to have two distinct licenses and two distinct implementations. But we are multi-cloud, so I do not want to have to deploy policies on essentially two apps that are essentially the same policies. I would prefer to have a multi-cloud console, in other words, one set of policies that apply to multiple implementations.

View full review »
PS
Manager at Inspira Enterprise

An area for improvement in Barracuda Web Application Firewall is attack identification. Other banks identified attacks and tracked logs that the solution wasn't able to identify because of its ready-made rules pre-deployed by the vendor. My organization raised this issue with the technical support team.

Another area to improve in Barracuda Web Application Firewall is its service desk. The team resorted to stonewalling because they couldn't accept that a feature was missing in the solution, and it was only after a lot of drilling down that the service desk team accepted that, and would be adding that feature in the future.

My organization had to submit a report to the Reserve Bank of India with information on the logs identified and the attacks that happened, and that there was a failure on the part of the Barracuda Web Application Firewall. The Reserve Bank of India conducts a tri-monthly cyber risk audit in all Indian banks. Even smaller banks identified and caught attacks that my organization wasn't able to do, so I was looking into other solutions that competitor banks could be using because Barracuda Web Application Firewall failed to identify some of the attacks.

View full review »
Anuraj Nair - PeerSpot reviewer
Presales Engineer at SNSIN

Barracuda Web Application Firewall's load balancing feature could be improved.

View full review »
SubhajitChatterjee - PeerSpot reviewer
Sr IT Manager at a financial services firm with 11-50 employees

We encountered a few glitches while implementing API security features into the product. Secondly, they could provide transparency for different types of protection parameters available. It will be beneficial if there is some visibility for the same. We faced some downtime issues the last two times due to Barracuda infrastructure. Thus, we are searching for alternate WAF solutions.

View full review »
RM
Network Security and Infrastructure Engineer at LDC

Layer four could be more secure like layer seven to prevent HTTP and HTTPS attacks. 

There are issues when upgrading firewalls and we experience different issues across customers. The communication metrics, ports, traffic, source, destination, and service must be enabled to upgrade firmware but there is no documentation or article for opening the communication matrix to upgrade smoothly. 

STM crashes are a repeat issue and they wipe out appliances. Each time, we have to open a ticket with support and get Apache to fix the issue. It is unclear why appliances have issues or fail and need to be recovered with Apache. 

Firmware upgrades cause automatic configuration changes without providing notifications. Configurations such as ports should not be changed automatically because they negatively affect customers. One customer's configuration issue was within the third layer and took seven days to solve. Support mitigation and work describes policies created automatically after upgrading firewalls but we already created and want to retain our own policies. 

View full review »
KA
Sophos Certified Product Architect at Softech Microsystems

In the Barracuda Web Application Firewall, there should be more affordable options for WAF as a service. These options should cater to smaller businesses, with a focus on single-size configurations for fewer users and cloud applications. We currently offer WAF as a service for cloud-deployed applications, but the pricing is somewhat on the higher side. To enhance the service, I suggest that they work on improving their pricing strategy. It's crucial to provide competitive pricing in comparison to other competitors in the market.

View full review »
Wealie Antar - PeerSpot reviewer
Manager, Systems, Information Technology at Icddr, b

They could improve their performance, support, and their upgrades. Their updates used to be good. Their improvements were right on the money but nowadays, the updates are minor. 

I don't really like the product. They restricted the number of servers we can protect. They restrict how many servers you can protect based on appliance.

They also don't support additional ATP. Customers also want ATP. They want something extra apart from the basic security package. 

Their appliances are very cheap. The quality is not that good. Their appliances should be more robust. 

View full review »
ВН
Presale Engineer at Softprom by ERC

Barracuda Web Application Firewall’s scalability needs improvement.

View full review »
MN
IT Administrator at SPSP

We get false positives about phishing emails. The vendor must improve Barracuda Email Security Gateway.

View full review »
Ahmed MohammedKhan - PeerSpot reviewer
Network secur eng at Qatar Free Zone

While the UI is good, it can get a little bit complicated. It's not like Next-Gen Firewalls. I need to remember all of the tabs. The sub-tabs should be at the right as they are in the Next-Gen. Mostly, Next-Gen firewalls have everything on the left panel and it will reappear. It would be nice if there was a little more consistency.

I only really have one year of experience with the solution. Therefore, it's hard to discuss missing features. I need more time to explore the product first. 

View full review »
SolomonAwosina - PeerSpot reviewer
CTO at GCET

The reporting aspect of the solution needs improvement. I don't find that it's very good. They could do some work on it to make it much better. It's not that the reporting isn't secure. It's just that I would prefer to store my reports for an extended period of time. Right now, that's not possible and I'd prefer it if that could change. I also would say that the reports themselves are expensive.

View full review »
IB
Security Engineer at a tech services company

I think the main area for improvement in this product is learning it, as can be seen when comparing it to the F5 web application firewall. F5 has a very powerful learning phase when you start using your web application firewall against your site. The company at this time collects information and parameters about all requests, such as: file downloads, file uploads, authentication, authorization processes, etc. During this period, F5 provides you with the ability to collect most of the necessary information to make a security provision for your web application firewall.

Barracuda has something like this, but not with the same functionality from my point of view. Barracuda is a little bit lower in comparison with other web application firewalls, so the best way to improve Barracuda is to develop and add new features in this area.

A good point for developing this area is to describe some particular use cases. For example, the implementation demands configuration of the application in conjunction with Web Application Firewall to make it available and hosted on the internal web services of Azure. It would be great to have instructions for Barracuda with Azure infrastructure, so we could get a step-by-step manual starting from the creation of the application interface and finishing with the available site including Barracuda. We implemented Barracuda Web Application Firewall and we see who checks the whole process. Each part of this manual relates to a particular service, but it would still help those who implement it to be quicker.

The bottom line is I would like to see an improved learning model to make the creation of the first policy easier and more transparent for an engineer.

View full review »
SolomonAwosina - PeerSpot reviewer
CTO at GCET

I would like to see an improved capacity to store logs so that they will be available for a longer time. From my experience, and over time, I have noticed that Barracuda appliances do not store logs for a very long time. What this means is that people have to buy the Barracuda Reporting Server. This is quite expensive, at three or four times the price of the equipment. So, if users have only one or two appliances then it doesn't make sense for them to buy a Reporting Server. If they decide to export those logs from the Barracuda appliance to a SIEM then the format of the report gets lost because Barracuda has custom reports.  Where I used to work, our logs would last for about one week. However, where I am now, we do not have logs beyond one day.

View full review »
AB
Chief Information Security Officer at a insurance company with 10,001+ employees

I wouldn't say that the solution is flexible. The technology is moving towards having the firewall, which is distributed to each workload, rather than having a static firewall pertaining to a particular application or a cohort of applications. There are other solutions that are much more flexible in this regard. VMware, for example, gives good flexibility in this regard.

The solution needs to leverage some additional features to a broader scale of software-defined networks.

Given the distributed computing and decentralized architecture with people working in hybrid modules, there'll be lesser and lesser control. People would like to have, for example,  edge computing, et cetera, which is going to be the future for computing. Hence every organization would like to scale the design to the extent where they would like to have their defenses also go along with their workloads. 

If, for an SDN, I need to go to VMware, and, for WAF, I need to go to Barracuda, or different other firewalls, the company is losing market share. They need to increase flexibility, agility, scaling, et cetera, as that is going to be the new normal, maybe in the next two to five years. 

View full review »
DP
Especialista en Informática at a maritime company with 5,001-10,000 employees

We've had some blocks of the application and some false positives. Barracuda needs to ensure there are fewer false positives in general. There also needs to be less of a learning curve on the application in general. That might help us eliminate false positives as well. Basically, they need to help new users better learn and understand the solution.

I have an issue with the console currently. I cannot access the console from inside the network. When I access the entire network, it kicks me off all the time. I opened a case with technical support. We've checked the firewall the perimeter firewall, and we've tried to fix that problem, however, it's still the problem. I have to access the console from outside all the time to this day.

View full review »
JB
Manager Information Technology at a tech services company with 11-50 employees

Occasionally, upon installation of the Energize Updates, the plans will go off track, something which necessitates us calling up their support team for another update. 

The frequency of the release of the updates is also an issue. In the production environment, Firmware cannot be frequently updated. It would be better if their updates would be released annually. 

View full review »
Porleng Phatt - PeerSpot reviewer
Pre-Sales Engineer at eCam Solution Co., Ltd

The policy updates could be improved. 

View full review »
WW
IT Manager at Toshiba Tec Poland

The incident reporting needs to be improved.

The local technical support in Poland is not very reliable.

View full review »
AG
Consultant & Instructor -Cyber Security,GovernanceRIskCompliance (CISO as a Services) at Independent

I would like this solution to be more detective of the needs of the organization.

View full review »
it_user848259 - PeerSpot reviewer
Network & Security Engineer at a tech services company with 11-50 employees

This product could easily progress to be among the industry leaders. I think they need to improve enterprise level automation. It integrates with a small number of vulnerability scanners, so report results should be imported manually; same for SIEM integration.

View full review »
MS
Presales Solutions Architect at Hilal Computers

The deployment isn't very user-friendly.

There are a lot of up and coming competitors in the space, and there's always new technology coming out. The solution needs to make sure that it keeps up with what's going on in the industry to make sure they don't get left behind.

The documentation is lacking. It's not like what you'd get if you were using Juniper or Cisco. They need to expand on it and make it more useful.

View full review »
it_user1030257 - PeerSpot reviewer
Senior Operations Manager at samergl

The solution could use more reports.

View full review »
HA
Assistant to the General Manager at a tech services company with self employed

I would like to see better controlling of the traffic. 

View full review »
FS
Director Of Technology at PT Exa Teknologi Indonesia

There should be some some simple case settings offered, as well as documentation and video. 

As most people are aware, the implementation is not easy. 

View full review »
DP
Especialista en Informática at a maritime company with 5,001-10,000 employees

Sometimes when we put it in action, we have some blogs that appear as false positives. I think that it's improving. Barracuda should minimize false positives. 

They should make it easier to learn how to use applications. 

View full review »
MM
Security Consultant at Global Solutions

Its interface can be better. It is not very friendly.

View full review »
it_user1194 - PeerSpot reviewer
Head of Infrastructure at a tech company with 51-200 employees
1) Generally speaking, the more complex your web application is, the greater the risk. Older sites are highly vulnerable to application layer security threats. Barracuda Networks Web Application Firewall is not tightly equipped to handle application layer security threats. 2) For SSL enabled sites, Barracuda Networks Web Application Firewall requires the duplication of the SSL certificate. This can pose SSL penetration and also significant scalability challenges. 3) Customer service and online support system is a bit slow and needs improvement. View full review »
Buyer's Guide
Barracuda Web Application Firewall
March 2024
Learn what your peers think about Barracuda Web Application Firewall. Get advice and tips from experienced pros sharing their opinions. Updated: March 2024.
765,234 professionals have used our research since 2012.