CirrocumulusReconteurSG,
You make a good point on where to have your security mitigations. F5 would give you two options here. First option is to replace your existing perimeter firewall and replace it with a BIG-IP device with AFM and, optionally ASM for L7 protections. See the following datasheet: f5-ddos-protection-reference-architecture. The BIG-IP hardware is, most likely, going to be better at handling DDoS attack vectors, when compared to commodity hardware/NGFWs. So this gets around a situation where the NGFW falls over before the next layer BIG-IP has a chance to assist.
The 2nd scenario is to deploy the latest Herculon Hybrid DDoS defender external to your existing firewall, see herculon-ddos-hybrid-defender-datasheet and ddos-hybrid-defender. This will be the first line in defence from DDoS attacks and take the pressure off your existing NGFW. It can also signal back to Silverline, when under attack, to perform Cloud Scrubbing too. Herculon DDoS can protect against L3/4 and L7 DDoS attacks. It can also monitor bandwidth and mitigate attacks based on a percentage of bandwidth in use - this will help ease pressure on your Edge Router.
Hope this helps,
N
