F5 BIG-IP APM

F5 BIG-IP Zero Trust Access is the current name for F5 BIG-IP Access Policy Manager, an access-control product for apps, APIs, and data across hybrid environments. It is best suited to organizations that need granular identity-based policies and centralized control across remote and hosted systems. Its broad authentication and VPN options are compelling, but custom pricing and advanced administration make it a considered enterprise choice rather than a simple fit for every team.

Overview

The product applies context-based checks to application access requests and centralizes access controls across locations and hosting environments. Its hybrid access model combines identity-aware policies with remote-access options, rather than treating network connectivity alone as the security boundary. Advanced administrative control gives organizations room to shape policies, but also makes this a better fit for teams prepared to manage a sophisticated access layer.

Key features

• Identity and authentication: SAML, OAuth, and OIDC support federation and single sign-on. Granular, context-based validation can make access decisions per application request, while SSO and SCIM support helps fit it into identity workflows.
• Device and risk signals: Device posture checks and integrations with VMware Horizon ONE (AirWatch), Microsoft Intune, and IBM MaaS360 let policies account for managed-device status. REST API connectors can also draw on third-party UEBA and risk engines; Azure AD Conditional Access policies can be integrated through Access Guided Configuration.
• Remote access: Per-app VPN and IPSec VPN options, alongside end-to-end encrypted remote access controls, suit organizations with a mix of application-specific and broader connectivity needs. Site-to-site networking adds another option for linking environments.
• Security and scale: Zero Trust Access clients and servers support ML-KEM post-quantum cryptography ciphers. F5 states that one BIG-IP device can support up to 1 million access sessions, and one VIPRION chassis up to 2 million. F5 BIG-IQ Centralized Management supports deployment and management at scale.

Session figures describe the stated platform capacity, while the perpetual bundle has a separate limit: 500 concurrent user sessions, scalable up to 200,000. That distinction matters when sizing a deployment; capacity claims should not be mistaken for the included bundle allocation.

Pricing

Pricing is custom. There is no free plan, but a 30-day BIG-IP VE trial includes Zero Trust Access with LTM, Advanced WAF, and Network Firewall (AFM). It supports VMware ESXi, KVM, Community Xen, Microsoft Hyper-V, AWS, Azure, OpenStack, and Google Cloud Platform, making it a time-limited way to evaluate a broad bundled deployment rather than a continuing free tier.

• Perpetual license: Custom pricing for BIG-IP Virtual Editions, hardware, or hybrid environments. The perpetual bundle lists 500 concurrent user sessions, scalable up to 200,000.
• Subscription: Custom pricing for VE subscription across public, private, or multi-cloud environments.
• Public cloud marketplace: Custom pricing for software virtual editions supporting leading hypervisors and cloud platforms.
• Enterprise License Agreement: Custom pricing covering public, private, or multi-cloud environments.

The trial lasts 30 days; no renewal terms are stated. Buyers should weigh the session bundle limit and deployment model against their expected concurrency before choosing a license route.

Platforms

Supported platforms include web, Windows, macOS, Linux, iOS, and Android, with API and self-hosted deployment also represented. The trial spans major virtualization platforms and public clouds, including VMware ESXi, KVM, Community Xen, Hyper-V, AWS, Azure, OpenStack, and Google Cloud Platform. That range suits mixed estates, though the product's advanced control model is aimed at administrators rather than casual app users.

Who it's for

F5 BIG-IP Zero Trust Access is a strong candidate for organizations managing access across hybrid environments, especially where identity federation, device posture, remote connectivity, and centralized administration need to work together. It is less compelling for small teams seeking a low-cost, self-service access product: there is no free plan, pricing is custom, and the controls are advanced.

Pros and cons

• Pro: Multiple authentication standards and per-request, context-aware policy support a more tailored access model than a single network-wide gate.
• Pro: Device posture, MDM, UEBA, risk-engine, and Azure AD Conditional Access integrations give administrators several policy signals to work with.
• Pro: Per-app VPN, IPSec VPN, and site-to-site networking cover varied remote and hybrid access patterns.
• Con: Custom pricing and no free plan make cost evaluation harder for buyers who need a published entry price.
• Con: The perpetual bundle starts at 500 concurrent sessions, so smaller deployments should verify whether that allocation and its scaling options suit their needs.
• Con: Advanced administrative control favors experienced teams; organizations looking for a simple standalone VPN may not need this breadth.

Alternatives

For organizations comparing infrastructure and traffic-management tools alongside access products, these options serve different needs:

• AWS Elastic Load Balancing is a better fit when the priority is load balancing and a free tier matters: new AWS customers receive 750 hours per month shared between Classic and Application Load Balancers, plus 15 GB of data processing for Classic Load Balancer.
• HAProxy Community Edition suits teams seeking a free Linux, self-hosted load balancer with TCP and HTTP proxying, rather than F5's identity-centered access controls.
• MetalLB is an open-source Kubernetes load-balancing option for teams that want a free project instead of a paid hybrid access platform.
• VMware Workstation Pro is a free option for running virtual machines on Windows or Linux hosts; it addresses virtualization, not the access-policy role of F5.
• Loadbalancer.org Enterprise is an alternative for buyers focused on load balancing who want a perpetual or subscription option; its Enterprise VA Basic plan is $2,360, paid once, or $150 /mo subscription, with 400Mbps throughput, 400 SSL TPS, and unlimited servers.
• OpenELB is a free Linux, self-hosted option for a Kubernetes-focused load-balancing need.
• Progress Kemp LoadMaster is another load-balancing option, with a 30-day temporary trial license.

Browse Load Balancing Software, DDoS Protection Software, Web Application Firewall Software, Cloud Network Management Software, API Security Software, and API Developer Portal Software for adjacent categories.

Verdict

Choose F5 BIG-IP Zero Trust Access if your organization needs advanced, identity-aware access controls across hybrid environments and can support its administration and custom-priced licensing. Its strength is the combination of authentication, device and risk signals, and multiple remote-access modes under centralized management. Look elsewhere if you need a free or plainly priced product, or only need a narrower load-balancing or VPN tool.