Next-Generation Firewall (NGFW)

Overview

• NGFWs are the third generation of firewall technology.
• They combine conventional firewalls with advanced network filtering functions.
• Key features include:
  • Deep packet inspection (DPI)
  • Intrusion prevention system (IPS)
  • Application firewall capabilities
  • TLS-encrypted traffic inspection
  • Website filtering
  • Quality of Service (QoS) and bandwidth management
  • Antivirus inspection
  • Integration with third-party identity management (e.g., LDAP, RADIUS, Active Directory)
  • SSL decryption

Historical Context

• NGFW term was first mentioned in a 2004 Gartner document.
• Unified Threat Management (UTM) is a related term; speculated to be coined by IDC.

NGFW vs. Traditional Firewalls

• Traditional firewalls perform functions like packet filtering, NAT, stateful inspection, and VPN support.
• NGFWs aim for more comprehensive network traffic filtering by incorporating more OSI model layers.
• Significant differences:
  • NGFWs include IPS and application control.
  • Perform deeper inspection than stateful inspection in earlier firewalls.
  • Check packet payloads and match signatures for malicious activities.

Evolution of NGFWs

• Address modern threats such as web-based malware, targeted attacks, and application-layer attacks.
• Over 80% of new malware targets application weaknesses.
• Traditional stateful firewalls are less effective due to reliance on port-protocol pairings.
• Identity-based security approaches evolved as port/protocol/IP-based protections became unreliable.
• NGFWs provide detailed application awareness and control, allowing for granular allow/deny rules.

Related Topics

• Comparison of antivirus software
• Comparison of firewalls
• Internet security
• Network security
• Unified threat management

References

1. Intro to Next Generation Firewalls by Eric Geier
2. Evolution and Emergence of Next-Generation Firewalls by Hazar Sayar
3. UTM security with Fortinet: Mastering FortiOS
4. Next gen security by Ben Rossi
5. Defining the Next-Generation Firewall by John Pescatore and Greg Young
6. Next-generation firewalls: Security without compromising performance by Patrick Sweeney
7. Next-Generation Firewalls 101 by Frank J. Ohlhorst