Difference Between a Firewall and a NGFW

The choice between a next-generation firewall and a traditional firewall is crucial for enterprises looking to defend their networks.

The distinction between these two types of firewalls lies in their capabilities, as they respond to the escalating sophistication of cyber threats.

Traditionally, firewalls have been the steadfast guardians of network security, but with the introduction of specific technology, a new era of enhanced capabilities and functions has developed.

NGFW is specifically engineered to combat advanced security threats at the application level through intelligent, context-aware security features.

It integrates traditional firewall functions like packet filtering and stateful inspection with additional capabilities to enhance decision-making regarding permitted traffic.

Distinguishing itself, an next-generation firewall possesses the capacity to filter packets based on applications and thoroughly examine the content within packets, extending its reach to layer 7 (the application layer) in the OSI model.

This marks a significant advancement compared to earlier firewall technologies, which were confined to operating solely up to layer 4 (the transport layer).

As attacks targeting layers 4–7 of the OSI model become more prevalent, the NGFW's ability to address threats at these higher layers becomes increasingly crucial.

Compared to an next-generation firewall, a conventional firewall has restricted functionalities.

It scrutinizes incoming and outgoing network traffic, focusing on packet state, source/destination IP address, port number, and protocol.

If there is a match with prohibited IP addresses, ports, or protocols, the firewall triggers an alert, essentially governing packet flow in one or both directions.

While traditional firewall may provide basic protection to your network systems, the particularities and sensitive nature of running a business require deeper protection, one only a next-gen firewall can provide.

In summary, firewall serves as the primary defense for your network, making them indispensable for ensuring security.

However, selecting the right firewall solution is a complex task due to the diverse range of firewall types available today.

The traditional firewall solution represents a relatively straightforward firewall that focuses solely on inspecting headers.

In contrast, NGFW solution is more sophisticated, offering advanced features and comprehensive protection to address the evolving landscape of cyber threats.

A NGFW combines the functions of a traditional firewall with additional features like intrusion detection and prevention, URL filtering, Antivirus/Anti malware, identity awareness, time-based decisions and location awareness.

Most importantly, a NGFW provides ‘application awareness.’ A traditional firewall is based solely on network-layer attributes (like IP address, port and protocol) but this is not enough information to accurately identify or police an application.

A NGFW looks for abnormal information in the headers of a message and even within the data itself, and can be set to look for specific character strings (words or phrases) within the message body to identify an application.

From there it makes context-based decisions on application traffic in order to protect the network, typically this would be internal users heading outside the network.

Although a NGFW can identify an application regardless of the port and protocol being used this is not the same as application fluency, which needs the ability to truly understand how an application works rather than just what it is.

none

Next-generation firewalls (NGFWs) are, as you might expect, the more advanced of the two types, offering the most robust protection for business networks. A traditional firewall is designed to police the flow of traffic that goes in and out of a network, based on port, protocol, source address and destination address. When we talk about ‘traditional’ firewall features, we’re essentially talking about the functions that preceded NGFWs – functions such as: Packet filtering, which ensures that incoming and outgoing packets are inspected before they are allowed to pass through. Packets that match the filter’s set of rules are forwarded; packets that do not are dropped. Stateless inspection or stateful inspection, which refers to the way in which packets are inspected (more about that below). Virtual private network (VPN) support, to keep the private network secure when users traverse public networks such as the internet. Stateless inspection means that the firewall can only check each packet individually, and is unable to discern its wider context. Many traditional firewalls only operate on a stateless (or ‘state-unaware’) level. The more sophisticated traditional firewalls have stateful inspection capability, which means that they can identify the operating state of packets that are trying to enter the network. In other words, they are ‘state-aware’ and can distinguish between the safe, the potentially unsafe and the outright malicious. NGFWs, as we’ll cover further down, go one step further than standard stateful inspection. NGFWs have many of the traditional firewall’s common functions – plus several more. In plain terms, NGFWs have more layers of security built into them, to protect against more sophisticated threats. Crucially, they go beyond the static inspection that traditional firewalls are limited to, instead having application-level control. Application awareness enables an organisation to view packets through proper context, and set application-specific rules. An extension of the intrusion detection system (IDS), IPSs have the capability to actively block intrusions once detected – dropping malicious packets, and logging the IP addresses and blacklisting all future traffic from them. Whereas standard packet filtering only reads the header of a packet, DPI ensures thorough inspection of the packet’s contents, including its source, which means that the NGFW is able to see the full context of each packet.

The earliest form of the firewall was capable of operating on the first four layers of the OSI (Open Systems Interconnection) model, namely the Physical layer, Data Link Layer, Network Layer and Transport Layer.

This firewall was simple but capable of examining the properties of every individual packet of data passing through the network and checking if it matched a configured set of rules.

Over the next decade, there were several advancements in the world of firewalls and these advancements gave birth to the Next-Generation Firewalls (also known as the third generation of firewalls) most businesses and internet users use today.

However, the initial next-gen firewalls only started looking deeper into the Transport layer headers and would not become the powerful mode of protection we know today until 2008, when Palto Alto Networks created the first NGFW.