For a novice, deploying on F5 Advanced WAF is difficult. Everyone who works on the solution is expected to get trained and certified before they can be considered an administrator. Therefore, for someone who is certified, it is relatively easy to deploy.

If your environment is prepared, it should take no more than four to five hours to do the implementation. The most common issue people have is that their environment is not ready or the deployment engineer does not understand it. However, this can be quickly resolved, and then the configuration can be made, allowing you to be up and running.

Depending on the environment you are deploying in, you must first obtain the appropriate license. For example, if you are deploying in a virtual environment (VE) on-premise, you must first download the ISO file, deploy it, configure your interfaces, and then license the F5 Advanced WAF before configuring it.

I rate the initial setup of F5 Advanced WAF a ten out of ten.

The initial setup is not complex so I rate it a ten out of ten. 

For on-premises, it might take two weeks to deploy security policies which depend on application traffic. You choose a policy set type from fundamental, comprehensive, or rapid according to your needs. Then, you apply the policy. 

For example, you can deploy a quick policy for a nonfinancial side to protect from common threats. In this case, you choose the rapid security policy, choose the application language, and add the SQL or PHP server technology to implement the attack signature. This is helpful because you don't need to apply all of the OS signatures if you only have Windows. Just pull the Windows signature and it will be plugged. 

Then you proceed to the staging model for awhile to pick up the negative security model. You can proceed with a mix of negative and unboxing security models. After that, you start deploying, defining URL parameters, and setting other policies. You put it to staging and make edits. If you don't find too many suggestions or false positives, then you deploy it in blocking mode to the vendor. 

After two or three weeks, if the owner is fine with the policies and number of false positives, then you put it to blocking. 

The initial setup is more complex than FortiADC and takes about twice the amount of time. 

The initial setup for F5 Advanced WAF is user-friendly and relatively straightforward.

In terms of setting up F5 Advanced WAF, what was challenging was the network part, but the rest wasn't that difficult. It took almost two weeks to complete the setup for F5 Advanced WAF.

The initial setup is from a configuration utility.

It is easy to set up F5 Advanced WAF. Although, it is difficult to deploy and maintain compared to Fortinet. The deployment process involves gathering customer information regarding virtual servers to be protected. Later, we select the best design suitable for their requirements and start with license provisioning. Further, we configure LTM with special servers and nodes and proceed with configuring the security policy and advanced directory. It takes a week to protect the infrastructure fully. Once we have license provisioning, it is good to run.

The solution is pretty difficult to set up. You really have to have a grasp o the product to configure it correctly.

The setup takes approximately two months. It's quite a long time. If the application is not ready, then the dependency will be on the application side. Therefore, the cycle is quite long. It depends on the application readiness.

We just need one to two people to handle deployment and maintenance. 

Generally, F5 Advanced WAF initial setup is straightforward. However, our environment was more complex and it took us a little more time to customize the solution to where we needed it to be. Additionally, the customization didn't rectify everything. We had to do customization to a certain event to prevent attacks that it wasn't catching, but that might not necessarily be the solutions' fault. It could be more of our setup than the solution's fault and not being able to run the latest version or the newer version could be more of a limitation on our ability to put it in the right place.

The whole implementation to have the solution run at the level we wanted it to take approximately five months.

Our company's environment is one that we can't put a canned solution in front of. Our environment, cannot have a canned solution that might fit everybody else because of how customized this environment is. It does need a lot of tuning to meet our environment's requirements.

I rate the initial setup of F5 Advanced WAF a three out of five.

It is pretty straightforward. A typical setup for these types of projects takes three months.

Advanced WAF is a difficult product for new users, but it's not too challenging if you have experience. Nevertheless, F5 products are generally considered to be hard to deploy. 

The installation of F5 Advanced WAF is complex. Any WAF that you put in takes a lot of time to install correctly. You never really just drop it in and have it working right off the bat. The only exception I can say that I have come across to that right now is Signal Sciences. You can literally drop that solution in place and put it in blocking mode within the same day. With F5 there is a learning period where you allow it to learn and then you go back because it is based on regular expressions. So you have to go through and check to see that there is normal traffic going through your site, et cetera. In other words, there is training involved. It can take from seven to fourteen days before you get a good signature set up.  

If you just need to turn on the licensing key, that might take 10 seconds to do and that is available essentially immediately when you implement WAF. But when you are talking about implementation — and this is true with any WAF — it is time-consuming. You are integrating a piece of technology with applications that have already been written. It might be a legacy app, it might be a new app or whatever that you use for whatever your use case might be for that application. You are using WAF in order to protect that app. You have to invest time in creating the signatures. That period of time where you are creating the signature is what is complex and extends the period of the implementation.  

That is what I think the true difference is between F5 WAF and the new-gen stuff like Signal Sciences is. With Signal Sciences you literally can just drop in and turn it on.  

The initial setup was simple.

The initial setup was neither easy nor difficult. I would rate setup as a four out of five.

It is reasonably easy to set up and took about a month.

The initial setup of F5 Advanced WAF is easy.

I rate the setup of F5 Advanced WAF a four out of five.

The initial setup was moderate, and I would rate my experience as four out of five. Deployment took a month because we had to put it in learning mode, customize policies, and get the security signature.

It was a little bit complex. If you want to add an additional layer or model like APM with two-factor authentication, then it requires a little bit more integration.

The solution was deployed using network security. At the time of deployment, the appliance was there, but we did not have any person that was able to accomplish the deployment. It took six months to deploy.

The full implementation of the solution took approximately eight hours. There are sections of the configuration at can be difficult.

The initial setup is quite straightforward. I didn't experience any complexity. It could be difficult for somebody who is not familiar with application load balancers or web applications. It takes a month to understand the entire architecture. It primarily depends upon how great deployment could be.

The initial setup of F5 Advanced WAF is straightforward, but the process is lengthy.

When you are using the F5 Advanced WAF for any reason, you have to employ an expert. It's not the same as other solutions, such as FortiWeb, it is not easy to use. It's an advanced device, and you have to have an advanced person to operate it. This is the biggest problem that F5 Advanced WAF.

The initial setup is easy since I have used the technology for almost 20 years. Some applications require more attention depending on what you are doing and trying to achieve with the particular module. You need some assistance from the team in configuring the different components within the application through the web.

I rate the initial setup process a seven out of ten.

The initial setup was rather complex taking a lot of time and information to be configured. We have two administrators for maintenance. 

I was not involved in the installation.

The initial setup was very simple. It was just for the machine: the ASM port and the WAF itself, not the deployment of the appliance, which is why it was easy.

The initial setup was was easy to install. Our department wasn't installing it, the infrastructure department installed it, so we gave them the policy that we wanted to use.

The initial setup was a good experience. We had support from the WAF team and a consultancy team for implementation who also provided good support. 

The initial setup was very simple. The initial setup is done by the machine. The ASM HS, the WAF itself, not the deployment of the application. So it was very simple, I am working with VIP for almost a full year. Something like ninety percent of my activities are F5 related. I specialize in F5 now and everything in F5 is very, very simple.

The initial setup was simple and it took an hour to deploy.

This solution does not require a lot of maintenance but we need to do the patching regularly.

The initial setup for F5 Advanced WAF was straightforward.

I was not a part of the initial setup.

The solution does not require any maintenance.

The implementation was quite smooth. We migrated from CloudFlare to F5 without any major issues. The deployment took almost ten months, and it included the implementation and fine-tuning. The customer had three applications.

F5 has good documentation available on their website so deployment is relatively straightforward. 

We went through the managed service partner, so they did the deployment. Deployment took about 15 days.

We have a few IT experts for maintenance. 

There are templates for creating policies, so the initial setup is very straightforward.

If you want to do the basic installation and get the system up and running, then it's pretty straightforward. However, you have the flexibility to go very advanced and you can get into very complicated scenarios. That's what we like about the solution. There's a lot of use cases where you're required to have the ability to create some advanced features or some complicated scenarios. It gives you the capabilities to handle them.

You have the flexibility to go beyond that and have advanced scripting rules and advanced features in order to have more capability to do new things that are not as common. You need to have the space to improvise things if you need to.

While a straightforward deployment may only take a few hours, as it has a pre-defined rough template, there's always tuning to be done. It's a security product. It's not like it's plug-and-play. There's always a learning phase and tuning is necessary. This is common with any security product. That said, to get it up and operational, it's a matter of hours.

For a proper work deployment, to be frank, you need an ether professional because there's an ether configuration change. You also need a security professional to do the rules and policies and everything. Then, you need the involvement of the web application developer, so you can understand the content of the web application. Security people don't know which link is good and which link is bad inside the application. Usually, you need three people from the team - one each from network, security, and application - to have a proper deployment.

The installment was straightforward and it took us about two hours. Deployment took a week or maybe two to complete. Complete installation for such a complex system is quite fast. 

The complexity of the initial setup is on a case-by-case basis.

If the customer is primarily interested in load-balancing then it is straightforward and it takes a few days. Once the customer is ready with all of their information, it doesn't take much time. In more advanced scenarios, it can take months to fully set up and configure.

Keep in mind that this is an enterprise-level product, so many of the competitors will take less time in setup. Not every engineer can configure F5 WAF.

We've incorporated our partner and he initiated the setup of this device. He used both the manual and the automatic setup options, and then he compared the two options. And now, as we are in production, we choose either automatic setup or manual setup. The automatic setup is quite easy, but the manual setup is complicated. It all depends on what you want from the product.

Sometimes the setup is straightforward. Other times it’s more complicated. It depends on the client and the project. How long the deployment takes depends on what they want.

You only need one person to handle deployment and maintenance tasks.

Setup and installation are easy.

The initial setup was very straightforward. The solution is very compact. It takes more than one month for effective deployment.

In the market now there is a lot of information on the setup of F5 Advanced WAF. You can look for it on the company website. I didn't use F5 support directly, just the materials.

The initial setup for F5 Advanced WAF is complex.

In terms of the initial setup, for a person who is a bit experienced it is not that difficult. It is a straightforward device. You follow the same principle and the same steps and you are good to go. Just follow the steps. F5 guides you through the initial configuration, which is another of their features. If you don't want to go for the manual config you can just follow their step by step. Press - next, next, next, next then you have the initial configuration done. 

Then you can move to your own configuration according to your network and according to your need. It's an easy device to configure, it's not difficult. 

Only the graphical user interface needs some kind of improvement to make it more modern. But as far as the straightforward install is concerned, it's good and easy.

One person is enough for the deployment and for the check.

In terms of how long it takes to deploy Advanced WAF, it depends on the number of applications you have to put behind the F5 number one. 

The initial network configuration won't take so long if you have all the required data. 

You can set up the initial configuration in an hour or two. But the more applications you add will determine the length of the configuration. 

We mostly deploy Advanced WAF in automatic mode. We don't do the manual configuration of the security side. We just put application details there and we let F5 decide the learning process. It normally takes 15 to 20 days to get a good grip on the application, the language, and the do's and don'ts. We let F5 decide. 

It takes around 15 to 20 days to get it into the blocking mode. But for the configuration for one application it will hardly take 30 minutes to be configured. It all depends on the amount of applications you have.

The initial setup is complex but easy once you understand the product.

The installation is straightforward.

The initial setup is straightforward.