What makes a next-generation firewall different from a traditional stateful firewall?
Show the answer
Say this first
A traditional stateful firewall decides on addresses, ports and session state. A next-generation firewall adds identity and content. It identifies the application from the traffic itself, whatever port it uses, maps IP addresses to users and groups from the directory, and runs intrusion prevention, URL category filtering and malware inspection in the same pass. It can also decrypt TLS to look inside. A rule can then say "finance may use this SaaS application but not upload files to it" instead of "allow TCP 443".
Go deeper
Features and typical names
| Feature | What it does | Examples |
|---|---|---|
| Application identification | names the app from payload and behavior, not port | Palo Alto App-ID, FortiGate application control |
| User identity | maps IPs to users and groups | PAN-OS User-ID, Fortinet FSSO, Cisco ISE integration |
| Intrusion prevention | signature and protocol-anomaly blocking | built into all major NGFWs |
| URL filtering | allow or block by web category and reputation | PAN-OS URL filtering, FortiGuard web filter |
| TLS decryption | forward proxy for outbound, inbound inspection for your servers | all major NGFWs |
| File and malware analysis | blocks file types, sends unknown files to a sandbox | WildFire, FortiSandbox |
| DNS security and threat feeds | blocks known bad domains and IPs, sinkholes | vendor clouds, external feeds |
A rule in PAN-OS terms
set rulebase security rules Web-Out from trust to untrust source 10.10.0.0/16 destination any application [ ssl web-browsing ] service application-default action allowapplication-default means each app is allowed only on its standard ports, so SSH tunnelled over 443
is not allowed by this rule.
TLS decryption limits
Forward proxy decryption re-signs server certificates with an internal CA that clients must trust. Applications with certificate pinning or mutual TLS break, and many companies exclude health, finance and privacy categories for legal reasons. With TLS 1.3 and forward secrecy, passive decryption with a server's private key no longer works; the firewall must sit inline as a proxy.
They will ask next
Why does the firewall need several packets before it knows the application?
It needs payload to identify most apps. The first packets are allowed while it decides, and the session's application can change as more is seen, for example from generic TLS to a specific SaaS app. Rules are re-evaluated when that happens.
What is the risk of turning everything on?
Throughput drops a lot with IPS, decryption and file inspection enabled. Size the firewall on vendor numbers measured with threat prevention and decryption on, not raw firewall throughput.
Traps
- Writing NGFW rules as "allow TCP 443" and ignoring the application, which throws away the main feature.