Short answer
A next-generation firewall (NGFW) is a firewall that classifies traffic by application, user and content rather than by port and address alone, and enforces policy with an integrated intrusion prevention engine and TLS inspection. A stateful firewall answers allow or block on ports and protocols; an NGFW answers on the application and on the identity of the person using it.
Key facts
- A traditional firewall classifies traffic by port and protocol; an NGFW identifies the application itself, so a rule can name the application.
- User identification maps an IP address to a directory identity, so policy can name a person or a group instead of an address.
- Intrusion prevention is built into the NGFW rather than running as a separate appliance in the traffic path.
- TLS/SSL decryption is what allows application and threat inspection on encrypted sessions, and it is typically the heaviest feature.
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy, is the federal reference for selecting, configuring and managing firewalls.
- Throughput falls as inspection is enabled: read the raw firewall figure and the threat-prevention figure off the same datasheet before sizing.
By Uniqcli Team
A next-generation firewall (NGFW) is a firewall that classifies traffic by the application it carries, the user who sent it and the content inside it, rather than by port and address alone. Palo Alto Networks describes the class as a device that identifies and controls applications, users and content to enforce security policy, and that integrates core firewall functions with intrusion prevention and threat detection.
The change is what a rule can say. A stateful firewall rule names a source, a destination, a port and a protocol, and answers allow or block. An NGFW rule can name an application and a directory group — this team may use this application, everyone else may not — which is a different sentence and a different security model, because the application no longer gets to choose its own port.
Everything else follows from that. To identify an application inside an encrypted session the appliance has to decrypt it, so TLS inspection becomes part of the design. To act on what it finds it needs an inspection engine, so intrusion prevention moves into the same chassis. Those three capabilities are why an NGFW is sized differently from the firewall it replaces.
What does an NGFW add to a stateful firewall?
Application identification is the first addition. A stateful firewall classifies traffic by port and protocol, so anything running over 443 looks the same. An NGFW inspects the traffic itself and names the application, which means a policy can permit one application on a port while blocking another that uses the same port.
User identification is the second. The appliance maps an IP address to a directory identity, so a rule can name a person or a group rather than an address that changes when a laptop moves. That is what makes a policy portable across wireless, wired and remote access without being rewritten per subnet.
The third is inspection: content scanning and an intrusion prevention engine built into the firewall rather than sitting behind it as a separate appliance. Together with TLS/SSL decryption — which is what makes the first and third work on encrypted sessions — these are the capabilities that separate an NGFW from stateful inspection, and NIST SP 800-41 Rev. 1 remains the federal reference for choosing, configuring and managing any of them.
What does it cost in throughput?
Every feature above reads more of every packet, so the appliance does more work per bit. Vendors publish this openly: a datasheet carries a raw firewall throughput figure measured with inspection off, and lower figures for threat prevention and for TLS-decrypted traffic. The numbers are not comparable across vendors unless the test conditions match, but within one datasheet they tell you the shape of the drop.
The sizing rule that follows is simple and frequently ignored: read both numbers off the same datasheet, size against the one that matches how you will actually run the box, and leave headroom. An NGFW sized on its raw firewall figure and then switched into full inspection is a bottleneck that arrives on the day the security team turns the features on.
Decryption deserves its own line in that calculation. It is usually the heaviest single feature, and it also carries policy questions — which categories are decrypted, which are exempted for privacy or legal reasons, and how certificate distribution is handled on managed endpoints.
How do you choose one?
Start with the segments you intend to protect and the interfaces they need, then the throughput at the inspection level you plan to run. Port count and media type constrain more purchases than raw performance does — an appliance with the right throughput and the wrong interfaces is still the wrong appliance.
Then read the licensing. On most platforms application control is included, while intrusion prevention, URL filtering, malware analysis and sandboxing are subscriptions with their own terms and renewal dates. A quote that compares hardware alone is comparing the smaller half of the cost.
Finally, weigh management. Per-appliance web and command-line management is fine for one site; multiple sites usually want central policy, which is a platform decision rather than a box decision. Confirm that the logging format is one your existing platform reads, because an NGFW generates considerably more event data than the firewall it replaces.
Key takeaways
- An NGFW classifies traffic by application, user and content instead of by port and address alone.
- Application identification means a rule can name the application rather than a port, so an application cannot escape policy by changing ports.
- User identification maps an address to a directory identity, so a policy can name a person or group and stay valid as devices move.
- Intrusion prevention is integrated into the appliance rather than being a separate box in the path.
- TLS/SSL decryption is what makes application and threat inspection work on encrypted sessions — and it is usually the heaviest feature.
- Size on the datasheet figure that matches how you will run the box, not the raw firewall throughput.
Shop it at Uniqcli
Parts for this job
Six-port desktop or rack
Sophos
Sophos XGS 108 Network Security/Firewall Appliance
XG108Z00ZZPCUS
A six-port Sophos appliance with 2.5GBase-T and 1000Base-X interfaces, listed at 12.21 Gbit/s of firewall throughput and one expansion slot.
The firewall figure is the raw number; ask for the threat-prevention figure from the same datasheet before sizing.
$873.73Back-orderedSmall office
Check Point Software Technologies
Check Point Quantum Spark 1535 Network Security/Firewall Appliance
CPAP-SG1535-SNBT
A six-port Check Point appliance rated at 1000 Mbit/s of firewall throughput with 100 VPN tunnels, sized for a small office rather than a campus edge.
$960.75Back-orderedWireless branch
WatchGuard Technologies
WatchGuard Firebox T115-W Appliance Only
WGT116000
A three-port WatchGuard Firebox with an integrated wireless radio, listed at 1.02 Gbit/s of firewall throughput — the appliance on its own, without a service bundle.
$192.50In stockFrequently asked
- What is a next-generation firewall?
- A firewall that classifies traffic by the application it carries, the user who sent it and the content inside it, rather than by port and address alone, and that enforces policy with an integrated intrusion prevention engine. Palo Alto Networks describes the class as a network security device that identifies and controls applications, users and content to enforce security policy.
- What is the difference between a firewall and an NGFW?
- A stateful firewall makes allow or block decisions on ports, protocols and connection state; it cannot tell one application from another when both run over the same port, and it cannot see inside an encrypted session. An NGFW identifies the application and the user, decrypts TLS where policy allows, and runs intrusion prevention in the same chassis. The cost is throughput and licensing.
- Does an NGFW replace a separate IPS appliance?
- On most current designs, yes — intrusion prevention is an engine inside the firewall rather than a box behind it. Some networks still deploy a dedicated IPS at an internal chokepoint, either because the segment needs different rules from the perimeter or because the firewall there has no capacity left for inspection. The engine is the same idea in both cases.
- Do I need TLS decryption to get value from an NGFW?
- For application identification and threat inspection on encrypted traffic, yes — without decryption the appliance sees a destination and a certificate, not an application or a payload. Many organizations decrypt selectively, exempting categories such as banking and healthcare, which keeps the privacy and legal position defensible while still inspecting most sessions. Decryption is also the heaviest feature, so it belongs in the sizing calculation.
Sources
- 1.Palo Alto Networks — what is a next-generation firewall (NGFW)paloaltonetworks.com
- 2.NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policycsrc.nist.gov
- 3.NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)csrc.nist.gov
Keep reading