Next Generation Firewalls detect common network applications based on data flows using DPI. Application IDs that are discovered can then be used in firewall policies for more granular control. Customers must indicate to the firewall vendor when application traffic is not detected or classified and wait for an appropriate signature or patch.

Appliances are location-bound and can only inspect the traffic that flows through them. This is why appliance sprawl and backhauling are needed to get inspection and enforcement to where the traffic is.

Next Generation Firewalls apply various security engines to the traffic including IPS, anti-malware, URL filtering and more. Running these engines in parallel depends on appliance capacity. Smaller devices, such as UTMs, are limited in their security enforcement due to capacity constraints.

Next Generation Firewalls need to inspect encrypted (SSL) and unencrypted traffic at line speed. Encrypted traffic places a significant load on the appliance and often creates scalability and performance issues. As the share of SSL traffic increases, forced appliance upgrades often become a necessity.

Distributed Next Generation Firewalls require an appliance at each location, with its own set of rules. Deviations from a policy template tend to happen over time and increases the likelihood of rules conflict and security exposure. Furthermore, each appliance lifecycle has to be managed separately. Appliances must be bought, deployed, configured, patched, updated and ultimately replaced either due to an End of Life (EOL) or business growth.