View source for Next-generation firewall

{{short description|Part of the third generation of firewall technology}}
A '''next-generation firewall''' ('''NGFW''') is a part of the third generation of firewall technology, combining a traditional [[Firewall (computing)|firewall]] with other network device filtering functions, such as an [[Application firewall|application firewall]] using in-line [[Social:Deep packet inspection|deep packet inspection]] (DPI), an intrusion prevention system (IPS). Other techniques might also be employed, such as TLS/SSL encrypted traffic inspection, website filtering, QoS/[[Bandwidth management|bandwidth management]], [[Antivirus software|antivirus inspection]] and third-party [[Identity management|identity management]] integration (i.e. [[Lightweight Directory Access Protocol|LDAP]], [[RADIUS]], [[Active Directory]]).<ref>[http://www.esecurityplanet.com/security-buying-guides/intro-to-next-generation-firewalls.html Intro to Next Generation Firewalls] - By Eric Geier, 06 September, 2011</ref>

== Next-generation firewall vs. traditional firewall ==
NGFWs include the typical functions of traditional firewalls such as packet filtering,<ref>[http://www.cnmeonline.com/features/next-gen-security/ Next gen security] - by Ben Rossi - 07 August, 2012</ref> network- and port-address translation (NAT), stateful inspection, and [[Virtual private network|virtual private network]] (VPN) support. The goal of next-generation firewalls is to include more layers of the [[OSI model]], improving filtering of network traffic that is dependent on the packet contents.

NGFWs perform deeper inspection compared to stateful inspection performed by the [[Firewall (computing)|first- and second-generation firewalls]].<ref>[http://www.techrepublic.com/blog/it-security/next-generation-firewalls-security-without-compromising-performance/8545/ Next-generation firewalls: Security without compromising performance] - By Patrick Sweeney, 17 October 2012</ref> NGFWs use a more thorough inspection style, checking packet payloads and matching signatures for harmful activities such as exploitable attacks and malware.<ref>[http://www.networkcomputing.com/security/next-generation-firewalls-101/240149730 Next-Generation Firewalls 101] - By Frank J. Ohlhorst, 1 March 2013</ref>

== Evolution of next-generation firewalls ==
{{unsourced|section|date=August 2019}}
Modern threats like web-based malware attacks, targeted attacks, application-layer attacks, and more have had a significantly negative effect on the threat landscape. In fact, more than 80% of all new malware and intrusion attempts are exploiting weaknesses in applications, as opposed to weaknesses in networking components and services.

Stateful firewalls with simple packet filtering capabilities were efficient blocking unwanted applications as most applications met the port-protocol expectations. Administrators could promptly prevent an unsafe application from being accessed by users by blocking the associated ports and protocols. But blocking a [[Web application|web application]] that uses port 80 by closing the port would also mean complications with the entire [[HTTP]] protocol.

Protection based on ports, protocols, IP addresses is no more reliable and viable. This has led to the development of [[Identity-based security|identity-based security]] approach, which takes organizations a step ahead of conventional security appliances which bind security to IP-addresses.

NGFWs offer administrators a deeper awareness of and control over individual applications, along with deeper inspection capabilities by the firewall. Administrators can create very granular "allow/deny" rules for controlling use of websites and applications in the network.

== See also ==
*[[Network security]]
*[[Unified threat management]]

== Further reading ==

* [https://www.sunnyvalley.io/post/howto-build-your-nextgen-firewall-at-home/ How to build your next-generation firewall at home]

== References ==
<references />

[[Category:Computer security]]
[[Category:Computer network security]]

{{Sourceattribution|Next-generation firewall|1}}