Next Generation Firewall: What It Is & How It Works
A next-generation firewall (NGFW) is a network security device that combines a traditional stateful firewall with deep packet inspection, application awareness, and intrusion prevention. It goes beyond filtering by port and protocol to identify and control traffic based on the application, user, and content, giving you far more granular control over what enters and leaves your network.
Background: From Packet Filters to NGFW
Traditional firewalls, including stateful ones, have been around for decades. They work by inspecting packet headers—source and destination IP addresses, ports, and protocol—and comparing them against a set of static rules. This approach works well when traffic is predictable, but modern networks are dominated by applications that hide inside common ports. For example, a web browser uses port 443 for HTTPS, but so do social media apps, video conferencing tools, and even malware. A traditional firewall sees all of that as simply “HTTPS traffic� and lets it through.
The term “next-generation firewall� was popularized in the mid-2000s by analyst firms and security vendors to describe a device that could classify traffic by application, not just port. The core idea is that the firewall should understand what is being communicated, not just where it is going. This shift was driven by the rise of web-based applications, cloud services, and encrypted traffic, which made port-based filtering nearly useless for security policy.
How an NGFW Works: Key Capabilities
An NGFW typically integrates several distinct security functions into a single platform. The most important are:
- Application identification: The firewall uses deep packet inspection (DPI) to look inside the payload of each packet, not just the header. It can identify the specific application—like Facebook, Skype, or Salesforce—even if that application is using a non-standard port or is encrypted.
- User identity awareness: Instead of only seeing IP addresses, an NGFW can integrate with Active Directory, LDAP, or other identity providers. This allows policies like “block marketing staff from using file-sharing tools� or “allow the finance team to access the accounting app.�
- Intrusion prevention system (IPS): The firewall actively inspects traffic for known exploit signatures, malicious patterns, and abnormal behavior. When it detects an attack, it can block the session in real time.
- Encrypted traffic inspection: Because most web traffic is now HTTPS, an NGFW can decrypt, inspect, and re-encrypt traffic to look for threats that would otherwise be hidden.
These functions work together. For example, when a user tries to access a website, the NGFW first identifies the application (browser), then the user (via login), then checks the destination URL against a reputation database, and finally inspects the content for malware—all before allowing the session.
How to Choose an NGFW
Selecting an NGFW is a matter of matching the device’s capabilities to your network’s size, traffic volume, and security needs. Key factors to consider:
- Throughput: Look at the firewall’s “stateful throughput� and “IPS throughput� figures. These are measured in megabits or gigabits per second. Ensure the device can handle your peak traffic without becoming a bottleneck.
- Number of users or devices: Most vendors offer models sized by concurrent sessions or user count. A small office might need a device rated for 50 users, while a data center might need one rated for 10,000.
- Application coverage: Check how many applications the firewall can identify. A broader database is better, but also check how frequently it is updated.
- Management interface: Is it a cloud-based dashboard, an on-premise console, or both? Consider how your team will monitor and configure it.
- Integration with other tools: Does it connect to your SIEM, threat intelligence feeds, or cloud security platforms?
It is also important to consider the cost of subscriptions. Many NGFWs require annual licenses for threat intelligence updates, IPS signatures, and URL filtering. The hardware cost is often a small fraction of the total ownership cost.
Common Problems and Misconceptions
One of the most common misconceptions is that an NGFW is a “set it and forget it� device. In reality, an NGFW requires ongoing tuning. Signature updates must be installed, rules need to be adjusted as new applications emerge, and false positives from the IPS need to be reviewed. Without this maintenance, the device’s effectiveness degrades over time.
Another issue is performance degradation. When you enable deep packet inspection, IPS, and especially encrypted traffic inspection, the throughput of the firewall drops significantly. A device that can handle 10 Gbps of simple stateful traffic might only manage 2 Gbps with full inspection enabled. Many organizations underestimate this and purchase a model that is too small for their needs.
Encrypted traffic inspection also raises privacy concerns. To inspect HTTPS traffic, the firewall must act as a “man in the middle,� presenting its own certificate to the client. This means the firewall can read all decrypted traffic. Some users and even employees may object to this level of monitoring, so it is important to have a clear policy and communicate it.
NGFW vs. Traditional Firewall vs. UTM
To understand the NGFW’s place, it helps to compare it with two other common terms:
- Traditional firewall: Filters by IP, port, and protocol. It does not look at application data. It is fast but blind to what is inside the traffic.
- Unified threat management (UTM): A UTM is a single appliance that includes a traditional firewall plus antivirus, web filtering, and often IPS. The difference is that a UTM is typically aimed at small and medium businesses and is simpler, while an NGFW is more enterprise-focused, with deeper application control and better performance under heavy inspection.
- NGFW: A true NGFW combines the firewall, IPS, and application awareness into a single, high-performance engine. It is designed for large networks and data centers where granular control is essential.
In practice, the lines have blurred. Many UTM products now include application control, and many NGFWs are sold to small businesses. The key difference is the depth of inspection and the scalability.
Costs and Deployment Models
NGFWs can be purchased as physical appliances, virtual machines, or cloud-based services. The cost varies widely depending on the model and the subscription level. A small office appliance might cost a few hundred dollars, while a carrier-grade device can cost tens of thousands. The subscription for threat updates is typically an annual fee, often 20–30% of the hardware cost.
Deployment models include:
- Hardware appliance: A dedicated box placed at the network edge. It offers predictable performance and is easy to install.
- Virtual NGFW: Runs as a virtual machine on a hypervisor. This is common in private clouds and virtualized data centers. It offers flexibility but may have lower throughput than a physical device.
- Cloud-delivered NGFW: Offered as a service, often integrated with a cloud provider’s network. This is useful for protecting cloud workloads without deploying hardware.
There is also the option of a “firewall as a service� (FWaaS), which is essentially an NGFW delivered entirely from the cloud, with no on-premise hardware. This is growing in popularity for organizations with distributed offices.
Safety and Best Practices
To get the most out of an NGFW, follow these safety and operational practices:
- Keep signatures up to date: Enable automatic updates for IPS signatures, application identification, and URL databases.
- Use a layered approach: An NGFW is not a replacement for endpoint protection, email filtering, or user training. It is one layer in a defense-in-depth strategy.
- Test your rules: Before deploying a new policy, test it in a lab or on a small group of users to avoid accidentally blocking legitimate traffic.
- Monitor logs: Review the firewall logs regularly to identify anomalies, false positives, and attempted attacks.
- Plan for encrypted traffic: Decide which traffic you will decrypt and inspect. Some organizations decrypt all web traffic, while others only decrypt traffic to specific high-risk categories.
- Have a backup: If the NGFW fails, what happens? Many devices have a “fail-open� mode that allows traffic to pass without inspection, which keeps the network up but reduces security. Know which mode you are using.
Frequently Asked Questions
What is the difference between a firewall and a next-generation firewall?
A traditional firewall filters traffic based on IP addresses, ports, and protocols. A next-generation firewall adds application awareness, user identification, and intrusion prevention to the same device. This allows it to make more intelligent decisions, such as blocking a specific app even if it uses a standard port.
Do I need an NGFW for a small business?
It depends on your risk tolerance and the sensitivity of your data. Many small businesses use a UTM device, which offers similar features in a simpler package. If you handle customer payment information or health data, an NGFW can help meet compliance requirements and provide better visibility into threats.
Can an NGFW inspect encrypted traffic?
Yes, most NGFWs can decrypt HTTPS traffic, inspect it, and then re-encrypt it. This is called SSL/TLS inspection. It requires installing a certificate on client devices so they trust the firewall. This feature is essential for catching threats hidden in encrypted connections, but it can impact performance and raises privacy considerations.
How often are NGFW threat signatures updated?
Most vendors update IPS signatures and application identification databases multiple times per day. These updates are delivered automatically through a subscription service. It is critical to keep these updates current, as new vulnerabilities and attack techniques are discovered constantly.
What is the best way to test an NGFW before buying?
Most vendors offer trial units or cloud-based demos. You can also check independent review sites and industry reports for performance benchmarks. The best test is to run your own traffic through the device in a lab environment, measuring throughput and checking that your critical applications work correctly.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.