F5 BIG-IP APM

F5 BIG-IP Zero Trust Access, previously called BIG-IP Access Policy Manager, secures access to applications, APIs, and data across on-premises, cloud, and mixed environments. It suits organizations that need identity-aware controls, network connectivity, and centralized administration in one access layer. The trade-off is an enterprise-oriented product with custom pricing and a level of control that rewards experienced administrators.

Overview

An identity-aware proxy evaluates each application request using context, rather than granting one broad network-level decision. The hybrid access model supports both hosted and local resources, while advanced administrative controls let security teams build detailed policies. That breadth is useful for distributed organizations, but excessive for teams seeking a small, self-service access gateway.

F5 states that one BIG-IP device can support up to 1 million access sessions, rising to 2 million on a VIPRION chassis. Its perpetual bundle starts at 500 concurrent user sessions and can scale to 200,000, so buyers should distinguish the platform's maximum session capacity from the entitlement in a particular bundle.

Key features

• Identity and authentication: SAML, OAuth, and OIDC support federation, modern authentication, and single sign-on. SSO and SCIM fit established identity workflows, while per-request validation applies policy at application level.
• Device and risk context: Device-posture checks can use integrations with VMware Horizon ONE (AirWatch), Microsoft Intune, and IBM MaaS360. REST API connectors can also bring signals from third-party UEBA and risk engines into access decisions. Azure AD Conditional Access policies can be incorporated through Access Guided Configuration.
• Remote access: Per-application VPN, IPSec VPN, and end-to-end encrypted remote access cover both narrowly scoped application use and broader network connectivity. This flexibility helps organizations with mixed remote-work requirements, though it adds policy and operational complexity.
• Security architecture: Zero Trust Access clients and servers support ML-KEM post-quantum cryptography ciphers. Audit logs provide an administrative record, and F5 BIG-IQ Centralized Management supports deployment and management at scale.
• Traffic and application controls: The platform includes TLS termination, Layer 4 and Layer 7 routing, global traffic management, managed rule sets, API protection, bot management, and rate limiting. These controls make it more than an identity gateway, particularly where access and application-delivery functions need to be coordinated.
• Deployment: It runs in self-hosted and cloud environments and supports web, Windows, macOS, Linux, iOS, and Android access. The access model and deployment model are both hybrid, allowing organizations to combine locations and hosting environments.

Pricing

F5 uses custom pricing rather than a published public rate, and there is no free plan. The Perpetual license is offered for BIG-IP Virtual Editions, hardware, or hybrid environments. The Subscription is a VE subscription for public, private, or multi-cloud deployments. A Public cloud marketplace option provides software virtual editions for leading hypervisors and cloud platforms, while an Enterprise License Agreement covers public, private, or multi-cloud environments.

The perpetual bundle lists 500 concurrent user sessions and can scale to 200,000. That is a meaningful starting limit for larger access estates, but the absence of a posted price makes direct budgeting impossible without a quote. A 30-day BIG-IP VE trial includes Zero Trust Access together with LTM, Advanced WAF, and Network Firewall (AFM). It can run on VMware ESXi, KVM, Community Xen, Microsoft Hyper-V, AWS, Azure, OpenStack, and Google Cloud Platform, giving prospective buyers a substantial way to assess the combined stack before committing.

Platforms

Supported client and access platforms are web, Windows, macOS, Linux, iOS, and Android. Deployment options include self-hosted environments, BIG-IP Virtual Editions, hardware, and public or private cloud infrastructure.

Who it's for

Choose it when your organization needs granular, identity-based access across hybrid infrastructure, device and risk signals in policy, VPN choices, and centralized control at substantial scale. It is particularly appropriate for security and infrastructure teams that can operate advanced administration and evaluate perpetual, subscription, cloud-marketplace, or enterprise-agreement licensing.

Look elsewhere if you need a transparent, low-cost entry plan, a simple user-managed setup, or a product focused only on private network connectivity. The custom-quote model and broad feature surface make it a considered enterprise procurement rather than an impulse purchase.

Pros and cons

Pros

• Granular application decisions: Identity-aware proxy checks each request using context.
• Broad access coverage: Per-app VPN, IPSec VPN, encrypted remote access, SSO, and SCIM address different access patterns.
• Enterprise scale: F5 cites up to 1 million sessions per BIG-IP device and 2 million per VIPRION chassis.
• Integrated controls: Routing, global traffic management, API protection, bot management, rate limiting, and managed rules extend beyond basic SSO.
• Hybrid and future-oriented security: Cloud, self-hosted, and hardware options combine with ML-KEM cipher support.

Cons

• Custom pricing: No public rate or free plan makes initial comparison and budgeting harder.
• Administrative overhead: Advanced controls are valuable to mature teams but can overwhelm organizations wanting a lightweight access tool.
• Trial is time-limited: The evaluation lasts 30 days, even though it includes several adjacent BIG-IP security products.

Alternatives

Cloudflare Access is the better starting point for teams wanting a freemium service, including a free plan for under 50 users and a published $7.00 USD-per-month pay-as-you-go plan.

Tailscale fits smaller deployments that can use its free Personal plan, which allows up to six users and unlimited user devices.

ZeroTier is a freemium alternative for straightforward virtual networking, with a Personal plan covering 10 devices and one network.

Cilium is the choice for teams seeking free, open-source networking on Linux and self-hosted infrastructure.

Infoblox Cloud Network Automation suits organizations seeking token-based cloud network automation licensing.

EfficientIP SOLIDserver DDI is an option centered on DDI through hardware and virtual appliances.

NetBox is a freemium choice for teams that need hosted or self-hosted network documentation and source-of-truth capabilities.

OpenStack Neutron is a free option for API-driven networking in Linux and self-hosted OpenStack environments.

Verdict

F5 BIG-IP Zero Trust Access is a strong fit for enterprises that need identity-aware application access, device and risk-aware policies, VPN options, and large-scale hybrid deployment under centralized administration. Its main reason to choose it is the combination of access control and traffic-management capabilities; its main reason to look elsewhere is custom pricing and the operational sophistication required to use the platform well.