Jump to content

Next-generation firewall

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by ~2025-31382-12 (talk | contribs) at 18:28, 5 November 2025 (The 80% figure appears in some older vendor materials but is not supported by recent authoritative reports. For example, the 2025 IBM X-Force Threat Intelligence Index states that one in four (25%) attacks exploited vulnerabilities in public-facing applications. Presenting an outdated or inflated statistic as current misrepresents the threat landscape and could mislead on the urgency of application-focused defenses.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

A next-generation firewall (NGFW) is a part of the third generation of firewall technology, combining a conventional firewall with other network device filtering functions, such as an application firewall using in-line deep packet inspection (DPI) and an intrusion prevention system (IPS). Other techniques might also be employed, such as TLS-encrypted traffic inspection, website filtering, QoS/bandwidth management, antivirus inspection, third-party identity management integration (e.g. LDAP, RADIUS, Active Directory),[1] and SSL decryption.[2]

History

One of the first mentions of the NGFW term was in a 2004 document by Gartner. Kenneth Tam speculated that the term Unified Threat Management (UTM) was coined by IDC because they did not want to adopt the name of their competitor.[3]

Next-generation firewall versus traditional firewall

NGFWs include the typical functions of traditional firewalls such as packet filtering,[4] network- and port-address translation (NAT), stateful inspection, and virtual private network (VPN) support. The goal of next-generation firewalls is to include more layers of the OSI model, improving filtering of network traffic that is dependent on the packet contents. The most significant differences are that NGFWs include intrusion prevention systems (IPS) and application control.[5]

Next-generation firewalls perform deeper inspection compared to stateful inspection performed by the first- and second-generation firewalls.[6] NGFWs use a more thorough inspection style, checking packet payloads and matching signatures for harmful activities such as exploitable attacks and malware.[7]

Evolution of next-generation firewalls

Modern threats like web-based malware attacks, targeted attacks, application-layer attacks, and more have had a significantly negative effect on the threat landscape. In fact, one in four[8] attacks exploit vulnerabilities in public-facing applications, as opposed to weaknesses in networking components and services.

Stateful firewalls with simple packet filtering capabilities were efficient blocking unwanted applications as most applications met the port-protocol expectations. Administrators could promptly prevent an unsafe application from being accessed by users by blocking the associated ports and protocols. But blocking a web application that uses port 80 by closing the port would also mean complications with the entire HTTP protocol.

Protection based on ports, protocols, IP addresses is no more reliable and viable. This has led to the development of identity-based security approach, which takes organizations a step ahead of conventional security appliances which bind security to IP-addresses.

NGFWs offer administrators a deeper awareness of and control over individual applications, along with deeper inspection capabilities by the firewall. Administrators can create very granular "allow/deny" rules for controlling use of websites and applications in the network.

See also

References

  1. ^ Geier, Eric (6 September 2011). "Intro to Next Generation Firewalls".
  2. ^ Sayar, Hazar. "Evolution and Emergence of Next-Generation Firewalls". Network Devices.
  3. ^ UTM security with Fortinet: Mastering FortiOS. S.l.: Syngress. 2013. p. 19. ISBN 978-1-59749-977-4.
  4. ^ Rossi, Ben (7 August 2012). "Next gen security".
  5. ^ Pescatore, John; Young, Greg. "Defining the Next-Generation Firewall". Gartner. Retrieved 12 October 2009.
  6. ^ Sweeney, Patrick (17 October 2012). "Next-generation firewalls: Security without compromising performance".
  7. ^ Ohlhorst, Frank J. (1 March 2013). "Next-Generation Firewalls 101".
  8. ^ "IBM X-Force 2025 Threat Intelligence Index". IBM. Retrieved 2025-11-05.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Next-generation_firewall&oldid=1320598632"