- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
F5 NGINX One
NGINX already fronts your services. Nobody can say which version each one runs — F5 NGINX One wraps NGINX Plus, F5 WAF for NGINX and two Kubernetes controllers in one package, run on hosts you choose and watched from one console — the same engine at the edge of VMs and clusters.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The F5 platform family
This page covers F5 NGINX One — NGINX Plus, F5 WAF for NGINX, the Kubernetes controllers and both managers. The rest:
Quick facts
30-second orientation- Product
- NGINX Plus, F5 WAF for NGINX, Ingress Controller, Gateway Fabric and two managers, sold as one package
- Maker
- F5, Inc., Seattle (NASDAQ: FFIV); NGINX is F5’s software family for apps, Kubernetes and APIs
- Launched
- NGINX One was introduced in July 2024; IDC published an IDC Link on it in September 2025
- Price
- None on f5.com; AWS Marketplace software fees are $0.50/hour (Standard) and $0.14/hour (Developer)
- Licence
- F5 describes NGINX One licensing as consumption-based; the AWS listing adds a 365-day contract
- Kubernetes
- NGINX Ingress Controller for Ingress, NGINX Gateway Fabric for the Kubernetes Gateway API
- Managed editions
- NGINXaaS for Azure and F5 NGINXaaS for Google Cloud, bought through each cloud
- Security note
- CVE-2026-42945 (rewrite module, CVSS 8.1) was exploited in May 2026; fixed after NGINX Plus R36
- India
- Self-hosted data plane on servers you place; PhonePe runs every UPI transaction through NGINX Plus
- In India via
- TechBag — instance count, INR quote with GST, WAF rollout and upgrade plan
Understand NGINX packaging before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is NGINX One?
One package around the NGINX engine: NGINX Plus, a WAF, two Kubernetes controllers and two managers.
Open-source NGINX on every box vs one supported NGINX estate — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Open-source NGINX on every box | F5 NGINX One |
|---|---|---|
| Who supports the proxy | Forums and whoever wrote the config | F5 support on NGINX Plus builds |
| Seeing the whole fleet | SSH into each box and diff by hand | One Console or Instance Manager view |
| Kubernetes entry | A separate ingress tool per cluster | Ingress Controller or Gateway Fabric |
| Web and API screening | A WAF appliance one hop away | F5 WAF for NGINX in the proxy itself |
| Patching an exploited flaw | Hunt for every version by hand | Versions listed, then a Plus release |
| What it is NOT | — | A developer portal or a published f5.com price |
The cheapest test is the 30-day trial on the AWS Marketplace listing: put one service behind NGINX Plus, connect it to the console, and see what it replaces.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
NGINX Plus
NGINX Plus sits in front of your services as the load balancer, reverse proxy and API gateway, on VMs, bare metal or cloud instances you run, including hourly AWS images.
Kubernetes
Inside a cluster, the NGINX Ingress Controller serves Ingress resources and NGINX Gateway Fabric implements the newer Kubernetes Gateway API, both on the same NGINX engine.
F5 WAF
The web application firewall once sold as NGINX App Protect runs with NGINX itself; F5 renamed it F5 WAF for NGINX and split denial-of-service protection into F5 DoS for NGINX.
Management
The NGINX One Console is F5’s SaaS view of every NGINX instance; NGINX Instance Manager is the second manager in the package, for teams that keep tooling on their own servers.
One NGINX engine everywhere — NGINX Plus on your hosts, two controllers in your clusters, a SaaS console over all of it.
Nine capabilities. Deliver, protect, operate.
F5 NGINX One puts a supported NGINX, a WAF and Kubernetes ingress under one console.
One proxy at the front door
NGINX Plus spreads requests across upstream servers and terminates connections as a reverse proxy; F5 files it under Load Balancing.
APIs behind the same engine
F5 sells NGINX as the F5 NGINX API Gateway too, so API routing can live on the proxy you already run rather than in a new product.
Cluster entry by Ingress
The NGINX Ingress Controller turns Kubernetes Ingress resources into NGINX config, so cluster entry uses the same engine as the VMs.
Ready for the Gateway API
NGINX Gateway Fabric implements the Kubernetes Gateway API, the successor model to Ingress, for teams moving cluster routing over.
A WAF that runs inside NGINX
F5 WAF for NGINX, formerly NGINX App Protect, screens web and API requests where NGINX already runs, on VMs or in containers.
Fixes arrive as Plus releases
When CVE-2026-42945 was exploited in May 2026, NGINX Plus got fixes in releases after R36, while open-source 0.6.27–0.9.7 stayed unfixed.
Every instance on one screen
The SaaS NGINX One Console lists NGINX instances across data centres, clouds and clusters, so drift and versions are seen in one place.
A manager you can host
NGINX Instance Manager ships in the same package, for estates that want fleet management on their own servers instead of the SaaS console.
Or let a cloud run it
NGINXaaS for Azure and F5 NGINXaaS for Google Cloud are managed editions bought through each cloud, with no NGINX hosts to patch.
Watch F5 NGINX One in action
F5’s 2024 launch of NGINX One, Medallia’s NGINX Plus story, and getting started with and migrating to NGINXaaS for Azure.
Introducing NGINX One
F5’s launch of the NGINX One package and its console, from July 2024.
Medallia Secures Fast Website Access with Less Effort Using NGINX Plus
How Medallia uses NGINX Plus to keep its website quick to reach.
Getting started with F5 NGINXaaS for Azure | NGINX
Standing up the managed NGINX edition inside an Azure subscription.
Migrate Workloads with F5 NGINXaaS for Azure
Moving existing NGINX workloads onto the Azure-managed edition.
Want a live, India-context walkthrough for your environment?
Book a guided demo →NGINX spreads one box at a time. NGINX One brings every instance under one console.
Here’s what genuinely sets it apart — and exactly where it stops.
Most teams already run the engine
NGINX is often the proxy a team installed years ago. NGINX One wraps NGINX Plus, a WAF, Kubernetes controllers and a console around that engine, so moving up is a licence and a migration, not a rewrite. PhonePe swapped open-source NGINX and Traefik for NGINX Plus.
VMs and clusters, one edge
NGINX Plus serves VM and cloud-instance traffic, the Ingress Controller serves Kubernetes Ingress, and Gateway Fabric serves the Gateway API. One package covers all three, so services moving into Kubernetes keep the same proxy behaviour and WAF on both sides.
A WAF where the traffic already is
F5 WAF for NGINX, once called NGINX App Protect, is in the bundle, so web and API screening runs inside the proxy rather than at a separate hop. Older quotes still say App Protect; denial-of-service protection is now named F5 DoS for NGINX.
Where it stops
No price on f5.com; the only public figures are AWS Marketplace software fees, EC2 extra. It is a proxy-first gateway, not an API management suite with a developer portal. You patch it: CVE-2026-42945 was exploited in May 2026. The SaaS console’s data location is unstated.
The numbers behind the platform
What your F5 NGINX One rollout looks like
Count every NGINX you run
List open-source and Plus instances on VMs, cloud hosts and clusters, with versions, so the quote and the patch plan start from facts.
Pilot on an hourly image
Start NGINX Plus from the AWS Marketplace listing on its 30-day trial and move one service’s traffic behind it.
Connect the console
Register the pilot and a few existing hosts with the NGINX One Console, or Instance Manager if management must stay in-house.
Bring in the WAF and clusters
Run F5 WAF for NGINX in monitoring mode first, then choose Ingress Controller or Gateway Fabric for the first cluster.
Sign and set a patch rhythm
Get the quote in INR with GST for the full count, then agree who applies NGINX Plus releases after each F5 advisory.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We had open-source NGINX on forty VMs with forty slightly different configs. The One Console showed the drift on day one.”
“Moving our services into Kubernetes, we kept NGINX at the edge through the Ingress Controller. Nobody had to relearn routing.”
“Turning on the WAF inside NGINX saved us a separate appliance hop. Tuning false positives took two sprints, not two days.”
“Pricing was the slow part. The AWS hourly listing let us pilot, but the enterprise quote for our data centre took weeks.”
“After the May 2026 rewrite-module advisory we patched every Plus instance in a day because the console listed versions.”
“It is a strong gateway engine, but we still needed a separate developer portal for partners consuming our APIs.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the API gateway market — tap any vendor to see why it sits where it does.
TechBag API Gateway Grid
Execution strength vs product vision — the classic market map, minus the paywall.
NGINX Plus, WAF and K8s controllers; launched 2024.
Self-Run Choice × Traffic Roles
The grid nobody publishes — how many places you can run the gateway yourself vs how many traffic jobs one product covers.
Own hosts, K8s or NGINXaaS; LB, proxy, API, WAF, ingress.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
F5 NGINX One vs the API gateway field
Against Kong Konnect, Layer7 API Gateway, AWS API Gateway, Azure API Management and Google Apigee — on deployment, traffic roles, price, limits, security and India.
| Dimension | F5 NGINX One | Kong Konnect | Layer7 API Gateway | AWS API Gateway | Azure API Management | Google Apigee |
|---|---|---|---|---|---|---|
| What it is | Proxy, gateway and WAF | Hosted API control plane | Self-run API gateway | AWS-managed API front | Microsoft-run API mgmt | Google’s API platform |
| Deployment | Your hosts, or NGINXaaS | Serverless to self-host | Appliance to Kubernetes | Inside AWS only | Self-host on two tiers | Hosted; hybrid by deal |
| Traffic roles | LB, proxy, API, ingress | APIs, Kafka, LLM calls | HTTP, WebSocket, GraphQL | Three API types | APIs, LLMs, MCP, A2A | APIs plus LLM policy |
| Pricing model | Quote; hourly on AWS | Control plane + usage | Quote only | Per million requests | Unit-hours or per call | Calls + environment fee |
| Published entry price | $0.50/hour on AWS | $25/month serverless | No list price | $1.00 per 1M HTTP | First 1M calls free | $365/month per region |
| Included vs add-on | WAF in the bundle | Core in, extras metered | Portal sold separately | Transfer on top | AI policies on all tiers | Security is extra |
| Scale and limits | Sized by your hosts | Plus stops at 10M | No caps published | Tiers past 20B a month | Unlimited on Premium v2 | QPS by tier |
| Security depth | In-proxy WAF | Plugins + Kong Identity | OAuth server, OWASP | IAM, Cognito, AWS WAF | Content-safety checks | Paid Advanced Security |
| Kubernetes and clouds | Two K8s controllers | Operator, decK, AWS | Operator, Graphman | AWS back ends | Azure plus AI models | Google Cloud first |
| Fleet governance | Console or self-hosted | SSO is Enterprise-only | Fits your IAM | IAM, resource policies | Entra ID with RBAC | Google Cloud IAM |
| India data location | Your Indian servers | IN geo, no city named | Self-managed in India | Mumbai region | Central India | Mumbai runtime |
| Support | With the F5 quote | Email on Plus | Two majors serviced | Your AWS plan | SLA plus Azure plan | SLA by tier |
| Lock-in and exit | Same core as OSS | Declarative export | Layer7 assertions | Bound to AWS | Bound to Azure | Apigee proxy bundles |
| Best fit | Teams already on NGINX | Multi-cloud API teams | Regulated, on-premises | Serverless on AWS | Microsoft estates | Google Cloud estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose F5 NGINX One if…
- ✓NGINX already fronts your services and you want a supported build, a WAF and one view of every instance
- ✓Your traffic runs on VMs and in Kubernetes, and you want one engine at the edge of both
- ✓Traffic must stay on servers you control in India, as PhonePe does for UPI
Compare alternatives if…
- ✓You need a developer portal and API catalogue as much as a gateway — Kong Konnect and Apigee bundle both
- ✓All your APIs live in one cloud — AWS API Gateway or Azure API Management may need nothing else to run
- ✓You want a price before a sales call — Kong, AWS and Azure publish rate cards, f5.com does not
Do not expect…
- ✓A price on f5.com; the AWS Marketplace hourly fee is the only public figure
- ✓A full API management suite with partner onboarding and monetisation
- ✓Freedom from patching: an NGINX flaw was exploited in May 2026
F5 NGINX One is one of 35 developer tools products TechBag carries. The Developer Tools guide narrows them to a shortlist and shows the reasoning. →
What does an unmanaged NGINX fleet cost you?
Drag the sliders (NGINX instances; engineer-hour cost). Estimates model engineering time spent finding config drift, checking versions after advisories and hand-tuning each instance at an assumed 1.5 hours per instance a year, with 70% of it removed by one console and a supported build. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published: only AWS Marketplace software fees, sold by NGINX, Inc. — NGINX Plus Standard on Ubuntu 24.04 is $0.50 an hour and the Developer listing $0.14 an hour, with a 30-day free trial and a 365-day contract option; EC2 is billed on top. f5.com prints no NGINX One price, and F5 describes the licensing as consumption-based. TechBag counts your instances first, then gets the quote in INR with GST.
NGINX Plus on AWS Marketplace
Best for pilots and cloud-hosted proxies
- AWS Marketplace software fee $0.50/hour (Standard)
- Developer listing $0.14/hour; 30-day free trial
- EC2 billed separately by AWS
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
F5 NGINX One
Best for fleets across data centres and clusters
- Quoted by F5; described as consumption-based
- WAF, Ingress Controller, Gateway Fabric included
- One Console (SaaS) or Instance Manager
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
How many NGINX instances run today, open-source and Plus, across VMs, cloud hosts and Kubernetes clusters?
Do you need the whole NGINX One bundle, or would NGINX Plus alone cover the load balancing you run?
Will clusters use Ingress resources, the Gateway API, or both? That decides Ingress Controller or Gateway Fabric.
Will F5 WAF for NGINX replace a WAF elsewhere, and who will tune its policies before blocking is switched on?
Is the SaaS One Console acceptable, or must fleet management stay on your servers with Instance Manager?
Where does the One Console keep instance data? F5’s pages we read do not say, so ask in writing before you sign.
Are all instances past the fixed releases for CVE-2026-42945, and who owns the next NGINX Plus upgrade?
Does the quote name the licence unit, term and support level? Ask for INR with GST and the marketplace option.
Questions buyers ask
Ready to evaluate F5 NGINX One?
Count your NGINX instances and versions first, or let a TechBag advisor scope a pilot that moves one service behind NGINX Plus and the WAF.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.