Next Generation Firewall (NGFW)

What Are the Key Capabilities of an NGFW?

An NGFW has all the capabilities of a traditional firewall, including basic packet filtering, stateful inspection to associate packets to legitimate sessions, and application awareness that allows it to detect and block risky applications. In addition, according to the official Gartner definition, an NGFW provides advanced capabilities including deep packet filtering, intrusion prevention, and threat intelligence. We’ll describe each of these capabilities in more detail below.

• Packet filtering

  Data transmitted over a network or the Internet is broken down into individual data packets. Because these data packets contain content that is about to enter the network, the firewall checks them and prevents packets that appear to be malicious from entering.

  Packet filtering works by determining the source and destination IP addresses (this occurs at Level 3 of the OSI model), ports and protocols (this occurs at Level 4) associated with each packet. Based on this evaluation, and a set of rules defined by the firewall administrator, the firewall allows or blocks data packets.

  The most common example of packet filtering is when a firewall blocks traffic from any IPs that do not belong to a carefully defined allowlist. Another example is a firewall that blocks traffic from vulnerable protocols, such as Remote Desktop Protocol, or protocols not expected to be used in a business setting, such as BitTorrent.

• Deep packet inspection (DPI)

  An NGFW improves packet filtering by performing deep packet inspection (DPI). While traditional firewalls could only inspect packets using information available at network Layer 3 and Layer 4, DPI can checks the body and header of each packet. 

  Specifically, DPI checks the packet body for malware signatures and other potential threats. It compares the contents of each packet with the contents of a known malicious payloads, and blocks any malicious content it detects. This enables advanced features like malware detection and intrusion prevention.

• Application Awareness and Control

  NGFW blocks or allows data packets depending on the application to which they are sent. This is done by analyzing the traffic at network Layer 7 – the application layer. Traditional firewalls do not have this capability because they only analyze Layer 3 and Layer 4 traffic.

  Application awareness allows administrators to block potentially dangerous applications, or vulnerable functions within a trusted application. If malicious application traffic cannot cross the firewall, there is no threat to the network.

• Intrusion Prevention

  Intrusion prevention analyzes incoming traffic, identifies known and potential threats, and blocks them. An NGFW provides intrusion prevention as part of its DPI capabilities. While analyzing the content of packets, the NGFW can detect threats using:

  Signature detection – scanning information in incoming packets and compares them to known threats.

  Anomaly detection – scanning traffic to detect anomalous changes in behavior compared to a known baseline.

  Stateful protocol analysis – analyzes activity via a specific network protocol and compares it to normal protocol usage.

• Threat intelligence

  Threat intelligence gives the NGFW information about potential attacks. Attack methods and malware inventories continuously update, and fresh threat intelligence is essential to block new attacks. NGFWs can consume threat intelligence from external sources and respond to new attacks advertised by those sources.

  Threat Intelligence provides an NGFW with
  IP reputation information, allowing it to identify IP addresses that were used for malicious activity. The NGFW can then dynamically block these IP addresses.