What is a next-generation firewall (NGFW), and how is it different from a traditional firewall?

Traditional firewalls control traffic mainly by IP address, port and protocol. Today a large share of traffic travels over web ports, encrypted, and that approach alone is no longer enough.

Key NGFW features

• Application awareness: identifying which software or service traffic belongs to, regardless of port.
• Intrusion prevention (IPS): inspecting packet contents and blocking known attack patterns.
• Encrypted traffic inspection: SSL/TLS inspection according to the organization’s policy.
• User-based control: policies defined by domain users and groups, not just IP addresses.
• Web filtering and anti-malware, plus secure connections for remote workers (VPN).

What to look for when choosing one

The throughput quoted on a datasheet is usually measured with all security features turned off. For a realistic comparison, use the “Threat Protection” figure, or the throughput with IPS and anti-malware enabled. Also budget for the security service subscriptions in the years that follow.

Designing the policies properly and keeping the firewall up to date matter as much as the device itself; a badly configured firewall gives a false sense of security.