What is Next-Generation Firewall (NGFW)?
Next-Generation Firewall (NGFW) is a network security device that inspects traffic beyond port and protocol, adding application identification, user-based policy enforcement, and deep packet inspection to traditional firewall controls. NGFWs are used to block threats that simple packet-filtering firewalls cannot detect.
What it does
An NGFW sits at a network boundary and inspects every packet passing through it. Unlike older firewalls that only check source IP, destination IP, and port number, an NGFW can:
- Identify the application generating traffic, regardless of port
- Decrypt and inspect TLS-encrypted sessions
- Match traffic against intrusion prevention signatures
- Enforce policy per user or group, not just per IP address
- Block known malicious domains and URLs using threat intelligence feeds
Some NGFWs also send suspicious files to a sandbox for deeper analysis, placing them close to the Network Sandboxing category.
Why teams buy it
Port-based firewalls cannot distinguish between a video-streaming app and a command-and-control beacon both running on port 443. An NGFW closes that gap. Teams also buy NGFWs to meet compliance requirements that mandate stateful inspection and logging of network traffic. Managed service providers sometimes deploy NGFWs as a network security service delivered through a router agent, covering small business sites without on-site staff.
What to look for
- Throughput with inspection on. Vendors publish two numbers: raw throughput and throughput with all inspection features enabled. Use the second number.
- TLS inspection capacity. Most traffic is encrypted. Confirm the device can handle your encrypted traffic volume without becoming a bottleneck.
- Application library size and update frequency. A larger, frequently updated library means better coverage of new apps and evasion techniques.
- Integration with identity providers. User-based policy requires the firewall to query Active Directory or a similar directory in real time.