Next-generation firewall

A Next-Generation Firewall (NGFW) is an integrated network that is a part of the third generation of firewall technology, combining a traditional firewall with other network device filtering functionalities, such as an application firewall using in-line deep packet inspection (DPI), an intrusion prevention system (IPS). Other techniques might also be employed, such as TLS/SSL encrypted traffic inspection, website filtering, QoS/bandwidth management, antivirus inspection and third-party identity management integration (i.e. LDAP, RADIUS, Active Directory).

Next-Generation Firewall vs. Traditional Firewall

NGFWs include the typical functions of traditional firewalls such as packet filtering, network- and port-address translation (NAT), stateful inspection, and virtual private network (VPN) support. The goal of next-generation firewalls is to include more layers of the OSI model, improving filtering of network traffic that is dependent on the packet contents.

NGFWs perform deeper inspection compared to stateful inspection performed by the first- and second-generation firewalls. NGFWs use a more thorough inspection style, checking packet payloads and matching signatures for harmful activities such as exploitable attacks and malware.

Evolution of Next-Generation Firewalls

Modern threats like web-based malware attacks, targeted attacks, application-layer attacks, and more have had a significantly negative effect on the threat landscape. In fact, more than 80% of all new malware and intrusion attempts are exploiting weaknesses in applications, as opposed to weaknesses in networking components and services.

Stateful firewalls with simple packet filtering capabilities were efficient blocking unwanted applications as most applications met the port-protocol expectations. Administrators could promptly prevent an unsafe application from being accessed by users by blocking the associated ports and protocols. But today, blocking a web application like Farmville that uses port 80 by closing the port would also mean complications with the entire HTTP protocol.

Protection based on ports, protocols, IP addresses is no more reliable and viable. This has led to the development of Identity-based security approach, which takes organizations a step ahead of conventional security appliances which bind security to IP-addresses.

NGFWs offer administrators a deeper awareness of and control over individual applications, along with deeper inspection capabilities by the firewall. Administrators can create very granular "allow/deny" rules for controlling use of websites and applications in the network.

Ineffectiveness of bolt-on security solutions

Deploying stand-alone security products like Intrusion Prevention System, URL filtering, anti-virus/anti-malware, and more, proves inadequate in increasing the effectiveness of the first-generation firewalls. An organisation which makes use of multiple separate solutions might be affected complexities of cost, maintenance and management.

Why future of Security will be Context-Based?

Context-based security systems are designed with built-in ‘intelligence’ to use situational information – identity, location, time, device, business function etc. – to make more effective security decisions. They are well suited to today’s mobile and cloud-based environments as they can respond more intelligently and quickly to unexpected situations. By understanding the context of a user request, the security system or firewall can adjust the security response and control how information is delivered to the user, greatly simplifying an increasingly complex computing world.

See also

• Firewall (computing)
• Unified Threat Management
• Network Security
• Identity-based security