When consulting with vendors on a NGFW deployment, one of the first conversations will be around the organization’s security posture. Terri Haas/IDG Create a security strategy A NGFW integrates these capabilities into a single system. Many of the features in a NGFW can be purchased as standalones, such as IPS, DPI and SSL inspections. SSL inspection: This technology inspects encrypted traffic to stop known threats, even if they’re encrypted. Deep packet inspection (DPI): This technology goes beyond just the inspection of packet headers to search for and block known threats within traffic packets as they pass through an “inspection point” within the NGFW. Intrusion prevention systems (IPS): These systems inspect network packet signatures and use advanced anomaly detection features to not only identify but also to block threats.

“They can see the general shape of things, but not the finer details of what’s actually happening.” NGFWs are packed with a multitude of new features and functionality allowing them to inspect traffic at a much finer level. Traditional, port-based, stateful firewalls are regarded as being “far-sighted,” according to a Palo Alto Networks whitepaper.

Perhaps the first question is, why do you need a next-generation firewall (NGFW) as opposed to a potentially less expensive previous generation version. So, when deploying a next-generation firewall what are the major factors to consider? Choices such as throughput capacity, deployment criteria all the way to configuration implementations are all important.

What is a next gen firewall