Model catalogue

48 models and 35 licence SKUs across the three vendors. Tick up to six models from any vendor to compare them side by side.

F5 Imperva Citrix NetScaler

F5 · BIG-IP Advanced WAF (formerly ASM)

F5 sizes a WAF on layer-7 requests per second with the security policy enabled, together with new TLS handshakes per second at the key type in use. The L4 headline throughput on a datasheet is never the WAF number: Advanced WAF with signatures, bot defence and behavioural L7 DoS delivers a fraction of the raw L7 rate.

Model	Family	Form	WAF req/s	WAF throughput	L7 without WAF	TLS/s RSA-2K	TLS/s ECDSA	Bulk TLS	Connections	Apps	Interfaces
BIG-IP VE 200 Mbps Lab, a small internal application, or a single low-traffic site.	Virtual Edition	Virtual	4K/s	200 Mbps	200 Mbps	800/s	2K/s	200 Mbps	200K	3	Hypervisor / cloud vNICs
BIG-IP VE 1 Gbps The usual starting point for a virtual WAF pair.	Virtual Edition	Virtual	18K/s	1 Gbps	1 Gbps	3.5K/s	9K/s	1 Gbps	1M	8	Hypervisor / cloud vNICs
BIG-IP VE 3 Gbps Mid-size virtual deployment on 4 to 8 vCPU.	Virtual Edition	Virtual	45K/s	3 Gbps	3 Gbps	9K/s	22K/s	3 Gbps	3M	15	Hypervisor / cloud vNICs
BIG-IP VE 5 Gbps Needs 8 vCPU with SR-IOV or DPDK to reach the rating.	Virtual Edition	Virtual	75K/s	5 Gbps	5 Gbps	15K/s	38K/s	5 Gbps	5M	25	Hypervisor / cloud vNICs
BIG-IP VE 10 Gbps High-performance VE; needs a tuned hypervisor and pinned cores.	Virtual Edition	Virtual	140K/s	10 Gbps	10 Gbps	28K/s	70K/s	9 Gbps	10M	40	Hypervisor / cloud vNICs
BIG-IP VE High Performance (16 vCPU) vCPU-licensed high-performance VE for cloud-native estates.	Virtual Edition	Virtual	240K/s	18 Gbps	20 Gbps	48K/s	120K/s	16 Gbps	18M	60	Hypervisor / cloud vNICs (SR-IOV)
BIG-IP i2800 Entry hardware WAF, with hardware TLS offload and a FIPS option.	iSeries	1U Rack	90K/s	4 Gbps	10 Gbps	9K/s	18K/s	4.4 Gbps	14M	20	8x 1GbE RJ45, 4x 10GbE SFP+
BIG-IP i4800 The common single-site enterprise WAF.	iSeries	1U Rack	140K/s	6 Gbps	15 Gbps	14K/s	28K/s	7 Gbps	24M	30	8x 1GbE RJ45, 4x 10GbE SFP+
BIG-IP i5800 Mid-range data-centre platform with 40G uplinks.	iSeries	1U Rack	230K/s	10 Gbps	25 Gbps	22K/s	45K/s	12 Gbps	36M	50	8x 10GbE SFP+, 4x 40GbE QSFP+
BIG-IP i7800 High TLS handshake rate for busy public estates.	iSeries	1U Rack	340K/s	16 Gbps	40 Gbps	40K/s	80K/s	20 Gbps	48M	80	8x 10GbE SFP+, 4x 40GbE QSFP+
BIG-IP i10800 Large data-centre consolidation.	iSeries	1U Rack	480K/s	24 Gbps	60 Gbps	60K/s	120K/s	30 Gbps	60M	120	16x 10GbE SFP+, 4x 40GbE QSFP+
BIG-IP i15800 Top of the iSeries range.	iSeries	2U Rack	850K/s	45 Gbps	110 Gbps	130K/s	260K/s	60 Gbps	100M	200	4x 100GbE QSFP28, 16x 10GbE SFP+
F5 rSeries r2600 F5OS platform running BIG-IP or BIG-IP Next tenants.	rSeries	1U Rack	110K/s	5 Gbps	12 Gbps	11K/s	26K/s	6 Gbps	16M	24	8x 25GbE SFP28
F5 rSeries r2800 Multi-tenant entry platform.	rSeries	1U Rack	160K/s	7.5 Gbps	18 Gbps	17K/s	40K/s	9 Gbps	20M	32	8x 25GbE SFP28
F5 rSeries r4800 Mid-range rSeries with 100G uplinks.	rSeries	1U Rack	300K/s	14 Gbps	35 Gbps	34K/s	78K/s	18 Gbps	34M	60	8x 25GbE SFP28, 4x 100GbE QSFP28
F5 rSeries r5900 High-density data-centre WAF.	rSeries	1U Rack	520K/s	26 Gbps	65 Gbps	65K/s	150K/s	34 Gbps	64M	100	8x 25GbE SFP28, 4x 100GbE QSFP28
F5 rSeries r10900 Flagship fixed-form rSeries.	rSeries	1U Rack	950K/s	50 Gbps	130 Gbps	140K/s	320K/s	70 Gbps	110M	200	4x 100GbE QSFP28, 8x 25GbE SFP28
VELOS CX410 with BX110 blades Chassis for service providers; scale by adding BX110 blades.	VELOS	Chassis	2.4M/s	120 Gbps	320 Gbps	360K/s	800K/s	180 Gbps	300M	500	Modular blades (100G / 25G)
NGINX App Protect WAF (per instance) Per-instance figure on 4 vCPU. Scale out horizontally rather than up; it carries the same F5 signature set as Advanced WAF.	NGINX	Virtual	30K/s	2 Gbps	5 Gbps	6K/s	15K/s	2 Gbps	500K	10	Host NICs / container network
F5 Distributed Cloud WAAP SaaS WAAP with DDoS, bot defence and API security. Sized by request volume and bandwidth, not by hardware.	Distributed Cloud	SaaS	2M/s	100 Gbps	100 Gbps	500K/s	1M/s	100 Gbps	200M	1000	Anycast global network

0 models in the shortlist (six at most).

F5 licensing

What each line does, and whether it is mandatory on every deployment of this platform.

Licence / subscription	Type	Mandatory	What it covers
BIG-IP Advanced WAF (per appliance or VE instance)	Module	Yes	The WAF itself: positive and negative security policies, the F5 signature set, protocol compliance, behavioural L7 DoS, bot defence and credential-stuffing protection. Mandatory - LTM alone does not include it.
BIG-IP BEST bundle	Bundle	Optional	LTM, Advanced WAF, APM, DNS and AFM in one licence. Usually cheaper than Advanced WAF plus the modules bought separately, and the normal choice when the platform also load-balances.
BIG-IP LTM (local traffic manager)	Module	Optional	Load balancing, TLS offload, persistence and health monitoring. Included in BEST; needed separately if the WAF also fronts a server pool.
BIG-IP VE subscription (per Gbps or per vCPU)	Subscription	Optional	Virtual Edition entitlement, licensed by throughput tier (200 Mbps to 10 Gbps) or by vCPU for high-performance VE. Term-based, and portable between hypervisors and clouds.
F5 Flex Consumption Program	Subscription	Optional	Pooled, drawdown licensing across hardware, VE and Distributed Cloud. Worth modelling when the estate will grow or move between on-premises and cloud during the term.
IP Intelligence subscription	Subscription	Optional	Reputation feed for anonymous proxies, scanners, botnet C2 and known-bad source addresses, evaluated before the policy runs.
Threat Campaigns subscription	Subscription	Optional	Curated, low-false-positive signatures for campaigns F5 Labs is tracking, updated far more often than the base signature set.
F5 Distributed Cloud Bot Defense	Subscription	Optional	JavaScript and mobile SDK telemetry with cloud-side ML to separate real users from automation that has defeated the on-box bot signatures. Priced by transaction volume.
F5 Distributed Cloud API Security	Subscription	Optional	API discovery from live traffic, schema enforcement against an OpenAPI definition, and per-endpoint rate limiting.
F5 DataSafe	Module	Optional	Application-layer encryption of form fields in the browser, so credentials and card data are protected from client-side malware and keyloggers.
SSL Orchestrator	Module	Optional	Policy-based decryption and re-encryption with service chaining to other inspection devices. Relevant when the WAF is one of several inspection steps.
BIG-IQ Centralized Management	Management	Optional	Central policy, licence and configuration management with role-based access and change staging. Effectively required once there are more than a handful of devices.
F5 Support (Standard / Premium / Premium Plus)	Support	Yes	Software updates, signature updates and hardware replacement. Premium gives 24x7 and a one-hour response on site-down; Premium Plus adds a named account engineer.

F5 datasheets →

Figures are indicative values held for relative sizing between models, last reviewed 2026-09. Confirm the final model against the current vendor datasheet before quoting.