F5 BIG-IP APM

F5 BIG-IP APM, now called F5 BIG-IP Zero Trust Access, controls access to apps, APIs, and data across locations and hosting environments. Its identity-aware proxy checks each application request using context, and authentication options include SAML, OAuth, and OIDC for federation and single sign-on. Remote access can use per-app VPN, IPSec VPN, or encrypted controls. The product connects with mobile device management systems such as VMware Horizon ONE (AirWatch), Microsoft Intune, and IBM MaaS360, and REST API connectors can draw on third-party risk and UEBA engines to inform access policies. Access Guided Configuration integrates with Azure AD Conditional Access policies. Deployment options cover virtual editions, hardware, and public, private, or multi-cloud environments. Pricing is available on request; there is no free plan, but a 30-day BIG-IP VE trial is available. That trial includes Zero Trust Access with LTM, Advanced WAF, and Network Firewall (AFM).

F5 BIG-IP Zero Trust Access combines identity-aware controls with several remote access and policy integrations. Buyers should request pricing and check whether the trial's included components fit their evaluation needs.

It suits organizations that need centralized access controls across applications, APIs, and data in hybrid environments. Its integrations and advanced administrative controls may fit teams managing identity, devices, and access policies.

F5 BIG-IP Zero Trust Access (formerly BIG-IP Access Policy Manager) controls access to applications, APIs, and data across hybrid environments. It is best suited to organizations that need detailed access policies across managed devices, remote users, and varied hosting environments. The breadth of identity and remote-access controls is a strength; advanced administration and custom pricing make it a deliberate enterprise choice.

Overview

An identity-aware proxy applies context-based validation to each application access request, while per-app VPN, IPSec VPN, and encrypted remote access cover connectivity needs. That combination can help teams apply policy at both the application and network-access layers. It is less compelling for buyers seeking a lightweight tool with minimal administration: the control level is advanced, and a managed service is not offered.

F5 states that a BIG-IP device can support up to 1 million access sessions and a VIPRION chassis up to 2 million. Those are substantial stated capacities, but the perpetual bundle is sized differently: it starts at 500 concurrent user sessions and can scale to 200,000. Buyers should match the capacity figures to the deployment and licensing option they intend to use.

Key features

• Identity and policy: SAML, OAuth, and OIDC support authentication, federation, and single sign-on; SSO / SCIM support and Azure AD Conditional Access integration can fit into existing identity workflows. The proxy checks each app request in context, giving administrators a more granular policy point than a broad network-level decision alone.
• Device and risk signals: Device posture checks and integrations with VMware Horizon ONE (AirWatch), Microsoft Intune, and IBM MaaS360 let policies account for managed-device status. REST API connectors can draw on third-party UEBA and risk engines, which adds flexibility but also means policy decisions may depend on other systems.
• Remote access and cryptography: Per-app VPN and IPSec VPN provide different access patterns, alongside end-to-end encrypted remote access controls. ML-KEM post-quantum cryptography ciphers are supported by the Zero Trust Access clients and servers, a relevant option for organizations planning for post-quantum security.
• Central operations: F5 BIG-IQ Centralized Management supports deployment and management at scale. Advanced admin controls offer room to tailor access, though teams need administrators equipped to operate that complexity.
• Traffic and API controls: The product supports TLS termination, Layer 4 and Layer 7 routing, global traffic management, managed rule sets, API protection, bot management, and rate limiting. These capabilities make it relevant to broader traffic and API protection requirements as well as access control; they may be unnecessary for a buyer focused only on basic remote access.

Pricing

There is no free plan. Pricing is on request across the four purchase routes, so buyers should compare the deployment and licensing terms directly with F5.

• Perpetual license: Custom pricing for BIG-IP Virtual Editions, hardware, or hybrid environments. The bundle lists 500 concurrent user sessions, scalable up to 200,000; this is the option to consider when a perpetual license fits the deployment model.
• Subscription: Custom pricing for a VE subscription across public, private, or multi-cloud environments. It fits buyers who want a subscription route for virtual editions rather than a perpetual license.
• Public cloud marketplace: Custom pricing for software virtual editions supporting leading hypervisors and cloud platforms. This route suits deployments aligned with a supported cloud platform or hypervisor.
• Enterprise License Agreement: Custom pricing covering public, private, or multi-cloud environments, making it the route to consider for an organization procuring across those environments.

A 30-day BIG-IP VE trial includes Zero Trust Access with LTM, Advanced WAF, and Network Firewall (AFM). It supports VMware ESXi, KVM, Community Xen, Microsoft Hyper-V, AWS, Azure, OpenStack, and Google Cloud Platform. Because the trial bundles several products, evaluators should account for those included components when judging whether it fits their intended purchase.

Platforms

Supported platforms include web, Windows, macOS, Linux, iOS, and Android. The trial also supports VMware ESXi, KVM, Community Xen, Microsoft Hyper-V, AWS, Azure, OpenStack, and Google Cloud Platform. API and self-hosted access are supported as well, giving the product scope across client, infrastructure, and deployment environments.

Who it's for

F5 BIG-IP Zero Trust Access is a strong fit for organizations with hybrid infrastructure, advanced access-policy requirements, and administrators able to manage a detailed control layer. Its identity federation, posture checks, risk integrations, and VPN options can serve teams coordinating access across applications, devices, and locations. Buyers who need managed operations or a simpler, lower-cost entry point should look elsewhere.

Pros and cons

• Pro: SAML, OAuth, OIDC, SSO / SCIM, device posture, and risk integrations support layered access decisions across identity and device context.
• Pro: Per-app VPN, IPSec VPN, and encrypted remote access provide more than one approach to remote connectivity.
• Pro: F5 states session capacity up to 1 million on BIG-IP and 2 million on VIPRION, while BIG-IQ supports centralized management at scale.
• Con: Custom pricing across all four purchase routes makes budgeting harder before a sales discussion.
• Con: Advanced administration and the absence of a managed service place operational responsibility on the buyer.
• Con: The 30-day trial bundles LTM, Advanced WAF, and Network Firewall with Zero Trust Access, which may not mirror an evaluation focused on access alone.

Alternatives

For teams evaluating adjacent security categories, these AI Security Testing Tools, AI Red Teaming Tools, DDoS Protection Software, API Security Software, Load Balancing Software, and API Developer Portal Software lists offer category-specific options.

• Project Moonshot is a free option with API, Linux, macOS, self-hosted, web, and Windows platforms for buyers comparing a no-cost alternative.
• AgentScan is a freemium alternative with a free plan at no cost (billed $0/month), including 5 scans per month, 185 attack vectors, 5 categories, automatic agent-format detection, and JSON results. Consider it when those scan limits fit better than an enterprise access platform.
• Crucible is a freemium option with Linux and self-hosted platforms; consider it if those deployment choices are the priority.
• OpenSecureAI Scanner is a freemium alternative whose Pro plan costs $49 a month (billed $49/month) and includes 50,000 API requests per month, 120 requests per minute per key, hosted AI remediation, LLM Gateway completions, and priority email support.
• PromptGuard offers a free plan at no cost with 20,000 scans a month, one API key, one project, and 24-hour log retention. It may suit buyers looking for a capped free tier instead of custom-priced access controls.
• AIRTA Red Team is a free, open-source option with no license fee or subscription and requires users to bring their own LLM API key.
• AIRTaaS is a free web-based alternative.
• Augustus is free, Apache 2.0-licensed open-source software for Linux, macOS, self-hosted, and Windows; API use may require provider credentials.

Verdict

Choose F5 BIG-IP Zero Trust Access if your organization needs granular identity-aware access across hybrid environments and has the expertise to manage an advanced policy layer. Its strongest case is the combination of authentication, device and risk signals, remote-access methods, and centralized operations. Look elsewhere if you need a managed service, transparent pricing, or a simpler access product.