F5 APM vs SSOGEN: What Each Product Documents

F5 APM vs SSOGEN compares a module on the BIG-IP system, which F5 documents as covering network, portal, application and web access, with an identity product whose Gateway and Web Agent cover sign-in for web applications. The table sets out what each documents.

Request a Quote

F5 APM vs SSOGEN overlaps on one job: authenticating people before a request reaches an internal web app. BIG-IP Access Policy Manager (APM) is a software component of the BIG-IP system, and F5 documents it as doing more than web sign-in.

SSOGEN is a complete identity provider with a Gateway and a Web Agent. It signs people in, applies policy and MFA, and passes their identity to an unchanged web app.

The table sets each capability side by side, row by row. This page does not rank the products and says nothing about pricing or quality. For a migration plan, see the F5 APM alternative page.

Capability table

Last compared 2026-10-09. Vendors change their products; check each one’s current release.

F5 statements come from F5’s APM 11.4 manual, introduction and its page about per-request policies, both read 2026-10-09. The first covers an older release, so newer ones may differ.

Capability	F5 APM (own documentation, read 2026-10-09)	SSOGEN (own documentation)
What it is	A software component of the BIG-IP system that gives users secured connections to Local Traffic Manager virtual servers, specific web applications, or the whole corporate network (11.4 introduction).	A complete identity provider, with a Gateway and a Web Agent for protecting applications.
Access types	Four: network access, portal access, application access and web access management (11.4 introduction).	Web applications through the Gateway App Proxy, or the Web Agent inside Apache or Oracle HTTP Server. Remote desktop and terminal through Remote Access.
Policy model	A Visual Policy Editor (F5 describes “a built-in policy editor that is graphically based,” 11.4 introduction). APM “executes per-session policies when a client attempts to connect to the enterprise,” and after a session starts, “a per-request policy runs each time the client makes an HTTP or HTTPS request” (per-request policies).	Named sign-in policies with a strength such as Plus a second factor, chosen in the Register application wizard. A hostname can carry its own policy, and rules can use network-zone conditions. Rules form an ordered list rather than a graph of nodes, and the first match decides.
Authentication methods	Standard AAA methods, including LDAP directories, Active Directory and Windows Domain servers, RADIUS servers and HTTP authentication, plus native RSA SecurID, and signed client digital certificates to authenticate devices (11.4 introduction).	Local accounts, Active Directory or LDAP over LDAPS, CSV import, and SAML 2.0 or OpenID Connect identity providers, with MFA, passkeys and step-up in the sign-in policy.
Client-side security checks	Client integrity checking, browser cache cleaner, secure virtual keyboard, and support for many antivirus and firewall packages (11.4 introduction).	Sign-in rules read the network zone, the time and a sign-in risk score, then require a second factor, require a passkey or block the sign-in.
Network tunnel	Network access is one of the four access types listed, described as a full VPN connection to internal network resources (11.4 introduction).	SSOGEN grants access per application, not to the network. The Gateway is not a VPN and forwards no arbitrary network ports. It delivers only the hostnames, back ends, remote hosts and directory connections in its signed configuration.
Audit and reporting	Full-session audit trails, drill-down session queries, and customizable reports and queries (11.4 introduction).	The Admin Console has an Audit page: who did what and when, an integrity check, and an export. Remote Access sessions (SSH, RDP and VNC in the browser, with approvals) keep an audit trail.
Resource list for users	The introduction lists a network access webtop, a portal access webtop and a full webtop among its configuration objects (11.4 introduction).	Applications appear on My Apps.
Identity passed to the web app	Not covered on the pages we cite.	A fixed set of identity headers: the person’s user name, email, display name and groups (at most 64 groups), the sign-in strength, and the application and route. A browser cannot supply its own copy.
Sign-in to the back end	Not covered on the pages we cite.	Identity headers, form login (each person’s own saved password, or a shared account), or Kerberos constrained delegation with protocol transition (form fill and Kerberos).
Back ends and health	Not covered on the pages we cite.	Up to 32 back-end servers per route, an HTTP or connection health check with set intervals, and optional sticky sessions. It balances requests across a route’s back ends.
Certificates	Not covered on the pages we cite.	A chain and a PKCS#8 key per hostname. Route hostnames are exact, and a certificate may carry a wildcard name. The console warns at 30 days or fewer before expiry.
Oracle web tier	Not covered on the pages we cite.	The Web Agent puts the check inside Apache or Oracle HTTP Server for Oracle E-Business Suite, PeopleSoft and JD Edwards.

Where an F5 cell says “Not covered on the pages we cite”, we did not research that area for this page. It does not mean the capability is missing.

Policy models are different

F5 APM. One policy runs when a session starts and another runs on every HTTP or HTTPS request.
F5 tooling. You build both in the Visual Policy Editor.
SSOGEN sign-in policy. SSOGEN has a sign-in policy per application, which a hostname can override, plus step-up rules.
SSOGEN access rules. One organization-wide list of access rules decides which applications each signed-in person may reach, on every launch, including through the App Proxy.
Mapping. Map your APM rules to SSOGEN policies one by one, and test each with What if.

What the SSOGEN Gateway does when a decision is missing

Normal flow. The App Proxy sends a person to SSOGEN to sign in, applies the app’s policy, then forwards the request.
Missing decision. If the gateway cannot get a sign-in decision, it refuses the request instead of passing it through.
Client address. A listener behind your load balancer trusts the forwarded client address only when the balancer presents its own client certificate.
Protocol. The gateway speaks HTTP/1.1 to browsers and load balancers.

Where F5 APM fits

Remote users need a full network tunnel.
You check the endpoint (antivirus, firewall, integrity) before granting access.
The same BIG-IP already terminates and shapes the traffic, and your team has years of policies in the Visual Policy Editor.
The BIG-IP also load balances other services. SSOGEN balances across each route’s own back ends.

When SSOGEN fits

The remaining need is internal web apps, including old ones that cannot change, and you want sign-in, MFA, policy and the audit trail in one identity product.
You want an agent inside Apache or Oracle HTTP Server for Oracle apps, with no proxy hop.
You want browser SSH, RDP and VNC with approvals, and identity for AI agents, from the same product.

SSOGEN has run in production since 2016, and Microsoft lists it in the Microsoft Entra gallery. See identity-aware proxy for the pattern behind the Gateway and single sign-on software for the full product.

Questions people ask

Does SSOGEN cover the whole BIG-IP?

No. SSOGEN covers identity and the web-app sign-in layer, the jobs this page compares.

How does a move from APM to the Gateway work?

One hostname at a time: each internal web app is published through the Gateway on a new hostname.

Which is cheaper?

This page makes no pricing claims.

About this comparison. SSOGEN Corporation prepared this page from F5, Inc.’s public documentation and web pages, last read on 2026-10-09.

We took care to be accurate, but products, plans and prices change.

We may have misread or missed something, so some statements may be wrong or out of date. This page is for general information only and comes without any warranty.

SSOGEN is not responsible for errors, omissions or decisions made from it. Check the vendor’s own pages and test the products yourself before you decide. If you see a mistake, tell us and we will correct it.

F5, BIG-IP, BIG-IP Access Policy Manager, APM, Local Traffic Manager, Visual Policy Editor, webtop, Active Directory, RSA SecurID, Oracle, Oracle HTTP Server, Oracle E-Business Suite, PeopleSoft, JD Edwards, Apache and Kerberos are names or trademarks of their respective owners.

SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page. Except for Oracle, the owners named are not affiliated with, endorsed by or sponsored by SSOGEN.

Sources, all read 2026-10-09: F5 APM 11.4 manual, introduction, F5 about per-request policies.