F5 BIG-IP Advanced Firewall Manager (AFM)
Network security policy management (NSPM) software
Network security software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if F5 BIG-IP Advanced Firewall Manager (AFM) and its alternatives fit your requirements.
Contact the product provider
Free Trial
Free version unavailable
Small
Medium
Large
-
What is F5 BIG-IP Advanced Firewall Manager (AFM)
F5 BIG-IP Advanced Firewall Manager (AFM) is a network firewall module that runs on the BIG-IP platform to enforce L3–L4 security controls such as stateful packet filtering, network DDoS protections, and policy-based traffic handling. It is used by network and security teams to protect data center and edge ingress/egress traffic, often in environments already standardizing on BIG-IP for application delivery. AFM integrates with BIG-IP objects (e.g., virtual servers, VLANs, route domains) and supports centralized policy workflows when paired with F5’s management tooling.
High-throughput stateful firewalling
AFM provides stateful L3–L4 firewall capabilities designed for inline deployment on BIG-IP. It supports policy constructs commonly needed for north-south traffic control, including rule-based filtering and network-level protections. For organizations already using BIG-IP, this can consolidate network security controls onto the same traffic-handling tier. The module approach can reduce the need to introduce a separate appliance for basic network firewall functions at the edge.
Tight BIG-IP traffic integration
AFM policies can be applied in the context of BIG-IP configuration elements such as virtual servers and network segments, aligning security enforcement with how traffic is actually delivered. This enables security rules to follow application exposure patterns (e.g., specific listeners or VIPs) rather than only device-wide constructs. It also supports operational workflows where ADC and network security changes are coordinated. This integration is a practical differentiator versus tools that focus primarily on discovery or configuration auditing.
Automation and centralized management options
AFM supports programmatic configuration through BIG-IP automation interfaces, which can help standardize policy deployment across environments. In larger estates, it can be managed alongside other BIG-IP systems using F5’s centralized management products to improve consistency and reduce manual device-by-device changes. This is useful for teams that need repeatable deployments across multiple sites or tenants. The approach fits environments that treat network security policy as part of infrastructure-as-code workflows.
Primarily L3–L4 focus
AFM is centered on network-layer firewalling and related protections, not full next-generation firewall feature sets across all layers. Organizations needing deep application-layer security inspection, broad threat prevention bundles, or extensive cloud-native firewall services may require additional products. This can increase architectural complexity when requirements extend beyond network controls. Buyers should validate which security functions are provided by AFM versus other BIG-IP modules or separate security platforms.
BIG-IP platform dependency
AFM is not a standalone product; it requires the BIG-IP platform (hardware or virtual editions) and fits best where BIG-IP is already deployed. This dependency can raise total cost and operational overhead for organizations that only need a firewall function without ADC alignment. It can also limit flexibility if the organization prefers heterogeneous firewall vendors across sites. Platform lifecycle and capacity planning become part of the firewall decision.
Policy operations can be complex
Managing firewall rules in environments with many applications, segments, and change requests can become complex, especially when policies are tied to BIG-IP objects and multi-tenant constructs. Teams may need specialized BIG-IP expertise to design, troubleshoot, and audit rule behavior at scale. Centralized management can help, but it introduces additional components and governance processes. Organizations should plan for role separation, change control, and audit reporting requirements.
Seller details
F5, Inc.
Seattle, Washington, USA
1996
Public
https://www.f5.com/
https://x.com/f5
https://www.linkedin.com/company/f5/
