What is a next generation firewall (Nextgen or NGFW)?

Firewalls that operate higher in the network protocol stack are typically called next generation firewalls, and traditional firewalls, often called stateful firewalls, operate lower in the network protocol stack. While a traditional firewall typically provides stateful inspection of incoming and outgoing network traffic at the TCP (transmission control protocol) and IP (internet protocol) levels, a next-generation firewall goes deeper to inspect more details within the data stream at the application level of the protocol stack. This is often called deep-packet inspection. As part of the deep-packet inspection, NGFWs provide an intrusion detection system (IDS), intrusion prevention system (IPS), advanced malware & virus detection, application control, and SSL/encrypted traffic inspection.

What does a next gen firewall do?

Let’s use an analogy to help understand this concept. The analogy we will use is mailing a letter through the postal system (I know, not done much anymore). A traditional firewall could be configured so that no one from China could get a letter through to the United States. But a NGFW could be configured so that anyone could mail a letter into the United States if it did not have improper content. In other words, the NGFW will open the letter and review the contents before approving release. This NGFW concept applies to emails, webpage traffic, streaming traffic, etc., inspecting deep into the traffic for malicious content, then blocking or cleaning before releasing it to the user, thus protecting the user and the business.

What is the difference between a traditional firewall and a next-generation firewall?

Traditional firewalls, often called stateful firewalls, operate lower in the network protocol stack, whereas next-generation firewalls operate higher in the network protocol stack. A traditional firewall typically provides stateful inspection of incoming and outgoing network traffic at the TCP/IP levels, but a next-generation firewall goes deeper to inspect more details within the data stream at the application level of the protocol stack.

What are Next-Generation Firewall Disadvantages?

Next-generation firewalls do more, so they cost more. They have more and better resources (CPU, memory, etc.) to handle the extra work it takes to inspect deeper into the data packets and dissect what is there to determine if it is good or bad. As you may realize by now, there are security features on a NGFW that require constant updating. Like your computer’s anti-virus or EDR software, updates are constantly needed to the firewall’s security features to keep it up to date for finding and blocking the ever-changing attack threats. This is called a firewall security subscription and it must be renewed periodically like your computer’s security software. So, this also adds another cost above a traditional stateful firewall. As mentioned, because a NGFW works harder, it needs more processing power. This means you may be more likely to have performance issues if the firewall is not to proper specifications for your needs. It is important to properly size your firewall for the speed of your internet circuit and the number of users behind the firewall. The encrypted traffic inspection feature (or SSL inspection) in particular needs a lot of firewall resources, but it is an important feature because the vast majority of web traffic today is encrypted. It must be decrypted to inspect the contents. Sometimes people find they have to turn off some security features in order to get the speed and performance they need. You don’t want to be in that situation. This potential performance issue is not as likely with the traditional stateful firewall but is it possible. [Diagram representing a next generation firewall ] Because a NGFW does more, it is more complex than a traditional stateful firewall. While the stateful firewall does require a quality technical resource to properly configure and maintain, the NGFW requires even more. But on the other hand, many companies that used a traditional firewall had separate systems to perform some of the other security features, like an intrusion prevention system (IPS), which is now part of the NGFW. So, the complexity can be lower or at least consolidated. But a NGFW does require more on-going configuration and maintenance than a traditional stateful firewall.

Who makes Next Generation Firewalls? Next-Gen Firewall Companies / Vendors

There are many companies who design and manufacture next-generation firewalls. Gartner Magic Quadrant Gartner, Inc. is an organization that provides reviews and ratings on many things including network firewalls. Their reports are insightful and can help business owners make decisions. Their Magic Quadrant report is quite useful where they rank the firewalls into a quadrant that shows the ability to execute and the completeness of vision. The four quadrants are Niche Players, Challengers, Visionaries, and Leaders. The Leaders quadrant is the upper right quadrant and where firewall vendors want to be. I will mention three firewall vendors here which have been consistently in the Leaders quadrant. Fortinet/Fortigate United States based manufacture Fortinet is a leader in the firewall market with their Fortigate next-generation firewall. They manufacture different models for different resources needs and offer the ability to purchase base features all the way to full features. We find them to be a very good fit for small and medium-sized businesses. They are a top performing firewall with great value pricing. We (IntegriCom) are a Fortinet partner and consistently sell their firewalls and provide design, installation, configuration, and support services. Check Point Software Technologies Israel based manufacture Check Point Software Technologies is also a leader in the firewall market, and their technology is also very good. They have historically produced firewall models for enterprise companies and not so much for the small to medium-sized business, however, they did add firewall models for the SMB market a few years back. Their SMB models have improved over time. They have top performing technology with a matching price tag. We (IntegriCom) are a Check Point partner and sell their firewalls and provide design, installation, configuration, and support services. Palo Alto United States based manufacture Palo Alto Networks is a top next-generation firewall producer with very good technology. They have historically targeted larger companies but do have models for smaller branch offices. Their pricing is not the lowest for sure, but their quality is high. We (IntegriCom) have configured and installed Palo Alto firewalls for our clients.

Why do I need a next-generation firewall? Are they worth it?

Because of today’s threat landscape, having a quality firewall is imperative. Breaches are very costly, and many times unprepared businesses never recover. And data shows that small businesses are just as vulnerable to threats as larger companies – don’t think you are not an important target. A next-generation firewall is a good way to protect your business, and it is worth it.

The Reliable IT Services Blog - IntegriCom

Fortifying Security with Trust Level 1

by Calvin Thain | Sep 1, 2023 | News

We are excited to announce that we have earned Trust Level 1 from Galactic Advisors. This designation shows our relentless improvement in fortifying our security measures. and exemplifies how we control our internal security.

Questions to Ask IT Manager Applicants: August Newsletter

by Joel Thain, CISSP | Aug 3, 2023 | Employee Certifications, IT Staffing, Newsletters

How to Hire an IT Manager for Small Business: 22 Questions to Ask If you are an interviewer without technical knowledge, it can be challenging to...

How to Hire an IT Manager for Small Business: 22 Questions to Ask

by Joel Thain, CISSP | Aug 1, 2023 | Managed IT Business Services

If you are an interviewer without technical knowledge, it can be challenging to assess the accuracy of an IT Manager candidate’s answers. In this article, we’ll go over questions you can ask during the interview process when hiring an IT Manager or Director

On-Premise vs. Cloud Data Storage Pros and Cons: July Newsletter

by Joel Thain, CISSP | Jul 11, 2023 | News, Newsletters

On-Premise vs. Cloud Data Storage Pros and Cons: Which is Best for Your Business? In the ever-evolving landscape of modern business technology, the...

Passwords & People Security

by Calvin Thain | Jul 3, 2023 | Cybersecurity

We are excited to introduce two cutting-edge security products that will empower our clients to safeguard their digital assets like never before....

IntegriCom Ranked Among Elite Managed Service Providers on Channel Futures 2023 NextGen 101 List

by Joel Thain, CISSP | Jul 2, 2023 | Uncategorized

IntegriCom has been named as one of the world’s premier managed service providers on the prestigious Channel Futures 2023 NextGen 101 rankings.

Cloud vs. On-Premise Data Storage Pros and Cons: Which is Best for Your Business?

by Joel Thain, CISSP | Jul 1, 2023 | IT Cloud Services

In the ever-evolving landscape of modern business technology, the choice between on-premise and cloud solutions has become a pivotal decision for organizations across various industries.

What Are Managed IT Services?

by Joel Thain, CISSP | Jun 13, 2023 | Co-Managed IT Services, Cybersecurity, IT Cloud Services, Managed IT Business Services

What are managed IT services? Learn everything about what is included in Managed IT Services and how they can benefit your business.

HIPAA Compliance: June Newsletter

by Joel Thain, CISSP | Jun 6, 2023 | Employee Certifications, HIPAA Compliance Consulting, Microsoft Windows, Newsletters

HIPAA Compliance Consulting Services HIPAA Compliance Consulting services provide organizations with expert guidance and support in adhering to the...