NGFW
Definition
Next-generation firewall: stateful packet inspection plus application identification, integrated IPS, TLS inspection and user-identity awareness. Palo Alto, Fortinet, Check Point and Cisco Firepower are the dominant vendors.
- Core function
- Stateful inspection plus application identification
- Added capabilities
- Integrated IPS, TLS inspection, user-identity awareness
- Major vendors
- Palo Alto, Fortinet, Check Point, Cisco Firepower
Common questions
How does an NGFW differ from a traditional firewall in an investigation?+
A traditional firewall logs connections by port and IP address, while an NGFW logs the identified application and often the authenticated user, giving an investigator richer evidence of what software generated traffic and who was logged in when it occurred.
What limits the evidentiary value of NGFW TLS inspection logs?+
TLS inspection requires the firewall to terminate and re-establish encrypted connections, which some organisations disable for privacy or compliance reasons, so the presence of decrypted payload logs cannot be assumed and must be confirmed for the specific deployment.
Why does user-identity awareness matter for attribution?+
Tying network traffic to an authenticated user identity rather than just a source IP address strengthens attribution in an incident, though it still depends on the accuracy of the identity source, such as directory service integration, at the time of logging.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- IDS vs IPS
- An intrusion detection system observes copied traffic and alerts. An intrusion prevention system sits inline on the data path and blocks. Snort...
- IPSec AH and ESP
- Authentication Header provides integrity and origin authentication only. Encapsulating Security Payload provides confidentiality plus optional integrity. Almost all modern IPSec deployments use...
- Kerberos
- An MIT-designed authentication protocol using a Key Distribution Centre, ticket-granting tickets and service tickets. The backbone of Active Directory authentication. Replay-protected via...
- Stateful Firewall
- A firewall that tracks the state of TCP connections in a connection table and permits return traffic of an established flow without...