What is a Next-Generation Firewall (NGFW)?
A Next-Generation Firewall (NGFW) expands traditional stateful firewall capabilities (IP addresses, ports, and protocols) by combining Deep Packet Inspection (DPI), Layer 7 Application Identification (App-ID), Intrusion Prevention Systems (IPS), SSL/TLS decryption, and threat intelligence.
Core Inspection Engine Architecture
- Stateful Connection Table (L3/L4): Tracks every session state (TCP SYN, SYN-ACK, ESTABLISHED, FIN/RST). Outbound requests dynamically create temporary return pinholes.
- Application Identification (App-ID / L7): Inspects actual packet payload content regardless of port/protocol (e.g., identifies BitTorrent masking over Port 443 HTTPS).
- Intrusion Prevention & Threat Engine (IPS): Scans decrypted payload streams against vulnerability signatures, malware hashes, and malicious URLs.
- Security Policy Engine: Enforces access rules using rich context:
[Source Zone + User ID -> Destination Zone + App-ID -> Security Profile].
Key Security Terminology
- Security Zones: Logical grouping of interfaces (e.g., INSIDE / Trust, DMZ, OUTSIDE / Untrust) enforcing default implicit deny rules between zones.
- Stateful Pinholing: Automatic opening of temporary reverse paths for return traffic initiated from higher-security trust zones.
- SYN Flood Defense: Hardware/software SYN proxying or cookies to mitigate Denial-of-Service attacks targeting session table exhaustion.