What a WAF is happens to be exactly what we are using F5 WAF for: a firewall for our web applications. It is a totally customizable solution. You have our signature-based rule sets and then we can customize to our heart's content depending on what our application can and can not do or what we are trying to protect against.
So we are using this for anything that is internet-facing. We are applying the WAF there and we are putting it in block mode wherever possible.