What Is Next-Generation Firewall?

A next-generation firewall adds application awareness to traditional stateful inspection. Rather than deciding on addresses and ports, it identifies the application in the traffic — regardless of the port it uses — and can apply policy per application and per user identity.

That matters because port-based policy stopped describing reality. Almost everything runs over the same few ports, so permitting outbound web traffic permits most applications, including the ones you would not have approved.

What the added capabilities actually buy

Application identification allows policy expressed in meaningful terms: permit this business application, block anonymising proxies, allow file sharing for one group only. User identity integration turns rules about addresses into rules about people, which survives devices moving.

Integrated intrusion prevention and reputation-based filtering consolidate what were separate appliances. The consolidation is genuine and the marketing frequently overstates the depth of any individual capability.

TLS inspection is the decision that defines the deployment

Application awareness depends on seeing inside traffic, and nearly all traffic is encrypted. Without decryption, a next-generation firewall degrades toward the capabilities of the previous generation.

Decryption has real costs: significant performance overhead, applications that break because of certificate pinning, privacy and legal considerations around inspecting staff traffic, and the device becoming a concentrated point holding plaintext for everything.

The workable pattern is selective inspection — decrypt categories where the risk justifies it, bypass banking, health and other sensitive categories, and document the reasoning. Blanket decryption and no decryption are both common and both usually wrong.

Identity integration is the underused capability

Application awareness gets the attention; user identity integration is frequently more useful day to day. Policy written in terms of groups rather than addresses survives people moving desks, changing devices and working remotely.

It also transforms the logs. A record showing which user reached which application is directly investigable, where a record of addresses requires correlation against lease data that may no longer exist.

The integration is usually straightforward where the estate has a single identity provider, and it is one of the more reliable ways to get value from a device that has already been purchased.

Sizing is the other decision that ages badly. Throughput requirements grow, inspection features accumulate, and a device specified for a previous estate becomes the constraint that forces inspection to be disabled. Reviewing headroom annually, against measured traffic rather than projections, avoids the position where security capability is traded for bandwidth under pressure.

A common mistake worth avoiding

Whatever else is on the list, the answer worth establishing first is how much traffic is genuinely inspected rather than passed through. It is a question that can be settled in a day, it requires no procurement, and the answer determines whether the rest of the programme is addressing the largest exposure or a smaller one that happened to be easier to see.

Where to start

Establish what proportion of your traffic is actually being inspected rather than passed through encrypted. That number determines whether you are operating a next-generation firewall or paying for one.

See network security. GuardsArm runs security program reviews.