A next-generation firewall (NGFW) extends stateful packet filtering to inspect applications, files, and suspicious activity. It addresses the security risks created when networks, applications, and users interconnect. section 11.0 section 11.5.2
Core NGFW capabilities include:
- Application Visibility and Control (AVC) identifies applications by examining packet contents, not only addresses and ports. section 11.5.2
- Advanced Malware Protection (AMP) integrates file inspection to identify and protect against malware. section 11.5.2
- Integrated Intrusion Prevention System (IPS) inspects traffic for malicious or suspicious activity and can block detected threats. section 11.5.2
- IPS detection uses vendor-provided attack signatures and can also identify anomalies against typical network activity. section 11.5.2
Traffic inspection
An NGFW can allow or deny traffic using stateful context, identify the application inside permitted packets, inspect transferred files for malware, and block traffic matching an attack signature. IPS protection includes DoS/DDoS attacks, viruses, worms, Trojan horses, ransomware, reconnaissance attacks, and SQL injections. section 11.5.2 section 11.6
Stateful filtering considers packet relationships, such as allowing an Internet response to an internally initiated connection. Zones can define policy boundaries between areas such as inside, outside, and a DMZ. section 11.6
