Traditional firewalls decide what to allow based on ports, protocols and addresses, but most modern traffic runs over the same few web ports and much of it is encrypted. A firewall that only sees "HTTPS to the internet" cannot tell a staff member using an approved cloud service from malware sending data to an attacker.
Next-generation firewalls (NGFWs) were built to close that gap. They are a core control for any distributed organisation, but they are not a complete security strategy on their own.
What does a next-generation firewall add?
An NGFW inspects traffic in far more depth than a port-based firewall and applies policy based on what the traffic actually is. The capabilities that matter most are these.
- Application awareness and control. The firewall identifies applications regardless of the port they use, so policy can allow a sanctioned file-sharing service while blocking unsanctioned ones, or allow a collaboration tool but block file transfer within it.
- User identity. Rules can be written for people and groups rather than IP addresses, which matters when staff move between offices, home and mobile networks.
- Intrusion prevention. Traffic is checked against known attack patterns and exploit techniques, and malicious sessions are blocked inline.
- Malware analysis. Suspicious files can be detonated in an isolated sandbox to observe their behaviour before they reach users, catching threats that signature checks miss.
- Encrypted traffic inspection. The firewall can decrypt, inspect and re-encrypt traffic so that threats hidden in encrypted sessions are visible.
- Reputation services. Connections to domains, IP addresses and URLs with a known bad reputation are blocked based on continuously updated threat intelligence.
- Cloud application security. Visibility and control over the cloud services staff use, including services the IT team has not approved.
Together these turn the firewall from a gatekeeper of ports into a point of policy enforcement for applications, users and content.
What should you weigh when deploying one?
The features are only valuable if they are switched on and tuned. A few decisions shape the outcome.
Encrypted traffic inspection needs a policy. Decrypting traffic has performance, privacy and legal implications. Decide which categories to inspect and which to exempt, such as banking and health sites, and document the reasons. Under the Protection of Personal Information Act (POPIA), staff should be told that traffic may be inspected, and the inspected data must be protected.
Performance must be sized for inspection. Throughput figures quoted with all security features off mean little. Size the firewall for the traffic it will carry with inspection, intrusion prevention and malware analysis enabled.
Management matters as much as hardware. Distributed organisations with many branches and remote workers need central policy management, consistent rules across sites, and clear logging. Rule sets that grow unchecked for years become a risk of their own.
Port density and connectivity. Branch and data centre requirements differ. Plan interfaces, redundancy and growth before buying.
When is a next-generation firewall not enough?
An NGFW sees traffic that passes through it. Several important risks sit outside that view.
| Gap | Why the firewall misses it | What addresses it |
|---|---|---|
| Remote and mobile users off the network | Their traffic may never cross the firewall | Cloud-delivered security and endpoint protection |
| Lateral movement inside the network | Traffic between internal systems may not be inspected | Network segmentation and internal monitoring |
| Compromised credentials | A valid login looks like normal traffic | Multi-factor authentication and identity monitoring |
| Attacks spread across many systems over time | One device sees one piece of the story | Security information and event management (SIEM) |
| Misconfigured cloud workloads | Exposure exists inside the cloud provider's environment | Cloud security posture reviews |
The firewall is one layer in a defence-in-depth design. Its logs are most valuable when they feed a central monitoring capability where they can be correlated with endpoint, identity and cloud events.
How do you know your firewall is doing its job?
Review the configuration regularly against the policy it is meant to enforce. Check that inspection and threat prevention features are actually enabled on the rules that matter. Remove rules nobody can explain. Test the firewall as part of penetration testing, and confirm that its alerts reach someone who will act on them.
What MITS Institute does about it
MITS Institute helps organisations design, configure and review network defences, including next-generation firewalls, as part of a layered security architecture. We define inspection policy, size and plan deployments, review rule sets and connect firewall logs to monitoring. Explore our cyber security solutions, and see our CloudTrack services for SIEM as a service (SIEMaaS) that turns firewall events into monitored, actionable alerts.