Bridge WAF
What is a next-generation firewall (NGFW)?
A next-generation firewall (NGFW) is a network firewall that does more than check addresses, ports and connection state. It also recognises which application a connection belongs to, and it applies policy to that application. The exact feature set differs from product to product. It is one entry in the network security glossary.
How it works
A traditional network firewall decides on the outside of the traffic. It sees the source and destination addresses, the ports, the protocol and where the connection stands, and it allows or refuses accordingly. Everything on one open port looks the same to it. That is the work of the lower layers of the OSI model.
A next-generation firewall adds a step between the packet and the rule. It looks further into the traffic to work out which application is talking, and only then picks a policy. A rule can then name an application instead of a port number. The same port can carry different applications and be treated differently for each.
In a next-generation firewall the order is: read addresses and ports, identify the application, apply the policy written for that application.
Why it matters
Ports stopped being a reliable label for traffic. Many applications now share a few common ports, so a rule that says "allow this port" says very little about what will pass through it. Application awareness was added to the network firewall to close that gap, and the name "next-generation" marks the change.
The boundary is where the firewall sits. An NGFW belongs at the edge of a network, in front of many hosts and many kinds of traffic. Its policy is about which applications may cross that edge, not about the content of each request sent to one particular web application, and it does not replace that kind of inspection.
Because marketing uses the label freely, treat it as a description of a class, not a guarantee. When a product is called an NGFW, ask what it identifies and what it does with the result.
Where a WAF differs
A web application firewall works on a different object. It reads HTTP requests aimed at one web application, at layer 7, and judges what each request asks for. A WAF can run in three modes: off, monitor and block. In monitor mode it evaluates every request and records the result without stopping anything.
The two are different tools for different questions, and neither stands in for the other. How the classes divide the work is set out on WAF vs firewall.
Related terms
The rest of the filtering vocabulary is in this glossary.