NGINX Plus with NGINX App Protect Premium - RHEL 8

I have been dealing with NGINX App Protect  and the WAF  policy. I usually recommend NGINX App Protect  for banking and telecom, and for anyone that has their own database or servers that they host websites from. Usually, this is the presales part, and they do this work. I go to show them the presentation of what we can offer or show them the POC that we are already hosting on our servers.

I really love NGINX App Protect. It has been two months, and I love the functionality. I love the ease of implementation and the NIM, the Instance Manager. It is very easy to use and very user-friendly.

Its integration with DevOps is pretty good. Currently, I am using it as an NGINX  Ingress controller, using the Plus certificate, and it is working perfectly. It is making it a lot easier than the regular one.

I assess the impact of real-time threat detection on the cybersecurity measures by testing it on the local environment and showing it to the customer. They appreciate it, and I appreciate it, so I think it is pretty good. Some threats like injection and running scripts, SQL injections, these all get stopped and rejected by the server, so I think it is doing its job.

I did not face any issues with NGINX App Protect. The only issue that we had is that someone was trying to install the POC for the customer, and he by mistake installed the Instance Manager on the same machine with NGINX Plus  and the NGINX Agent, so this caused a conflict with the packages. We had to reinstall everything. I think this would not happen if it was on Kubernetes  or something, but this was the issue, and we did not know that this was the issue.

For now, I think NGINX App Protect is good, but maybe I would like to see the logging feature added. If they can provide a real logging system, we would not have to integrate with Prometheus or any other logging tool. I think this would be a lot better, maybe a plugin that we can install. Maybe a logging portal that we can use from NGINX itself would be beneficial.

I have been dealing with NGINX App Protect for nothing more than two months.

Before working with WAF , I did not work with anything related to NGINX at all. I was just working with regular NGINX. If we have a front-end server, we implement the normal community edition just to redirect and reverse proxy, nothing related to any security.

My main use case for NGINX App Protect  is primarily in our infrastructure layer with Kubernetes , as I am using it to protect my application from attacks like DDoS and provide additional firewall protection to my application.

A specific example of how NGINX App Protect  helped defend my application was during an attempted DDoS attack, when it flagged those requests and protected one of my applications.

The best features NGINX App Protect offers include a firewall, seven layers of DDoS protection, additional API securities, and threat intelligence services.

Of the features I mentioned, I find myself relying the most on Layer 7 DDoS protection because it protected one of my applications during a DDoS attack, and that has been quite helpful.

NGINX App Protect has positively impacted my organization by adding an additional layer of security on top of my infrastructure layer, which I consider quite helpful.

I think NGINX App Protect could be improved by having it come out of the box with NGINX .

I have been using NGINX App Protect for deployments in servers for more than two to three years.

NGINX App Protect is stable in my experience.

The scalability of NGINX App Protect is good and open source at its best, and I would rate it an 8 or 9 out of 10.

The customer support for NGINX App Protect is good.

I would rate the customer support a 9 on a scale of 1 to 10.

I cannot answer regarding whether I previously used a different solution before NGINX App Protect.

I cannot give a quantifiable metric at the moment regarding return on investment from using NGINX App Protect, but it did help with our compliance.

I will not be able to answer about my experience with pricing, setup cost, and licensing for NGINX App Protect, as something different handles that in my team.

I could not recall the name of the other options, but I did an evaluation between others before choosing NGINX App Protect.

I would rate this product an 8 overall.

I'm following on a project in an initial phase and was looking for products for networking and security. I used  NGINX  App Protect, as a proxy, for the website. I have also implemented a simple web application firewall using NGINX  and naxsi years ago. I have never used other solutions with NGINX App Protect apart from the proxy and the web application firewall features.
From my hands-on experience, NGINX App Protect is mainly useful when you want solid app and API security without changing how you already use NGINX . I’ve used it to protect web applications and APIs from the usual OWASP Top 10 issues, and what stands out is that it runs close to the app, so performance stays predictable and there’s no extra hop in the traffic flow. It works really well in Kubernetes  and microservices environments, where you can apply security at the ingress or even per service and manage policies as code in the same CI/CD pipelines used by the dev teams. I’ve also seen it being effective against Layer-7 DDoS and abusive traffic, especially for APIs, because it learns normal behavior and reduces false positives.

Overall, it feels less like a traditional external WAF  and more like a native extension of NGINX that fits naturally into day-to-day operations

NGINX App Protect is a good product. I have used both versions from F5 -also the free version- (I mean the NGINX/NGINX One/App Protect free trial period), and I think it is a good product. It's stable, affordable, and easy to manage. NGINX App Protect is a comprehensive security solution that combines advanced WAF , DoS protection, API security, and DevSecOps  automation in a lightweight, scalable package ideal for modern cloud-native architectures.

The adaptive machine learning capabilities are truly commendable, as the solution can establish traffic baselines and detect anomalies in real time. It automatically adjusts security policies, minimizing the need for manual intervention and reducing false positives. Additionally, it supports scalable deployment across diverse environments, including on-premises, cloud, Kubernetes , and containers, offering both flexibility and scalability

I have experience with the web server, F5 load balancer, and similar products provided by Ergon, for eg. the web application firewall and the Microgateway for K8S. I'm also familiar with F5 BIG-IP  products.

The GUI and web GUI configuration could be improved to be easier to manage and use.

I have been using this for more or less 20 years.

NGINX App Protect is a good product and performs very well even when it is under stress.

It was not so hard. NGINX App Protect is pretty easy to manage and configure overall.

Only a consultant was involved. I'm working for Adesso Schweiz, a German company that has a business unit in Ticino, Switzerland.

It's not among the cheapest solutions but the expense is justified given the robustness it offers. My priority isn't cost optimization, but the preservation of future capabilities.

I've never used any other solutions and I'm not aware of any alternatives that are as intensive as this one.

I have created a web application firewall. I created it a couple of years ago. The timeframe for implementation would be difficult to provide because it depends on the project, many variables, and the validation process. Overall, I think NGINX App Protect is good. My review rating for this product is 7 out of 10.