What a Next-Generation Firewall Actually Does
A traditional firewall decides whether traffic is allowed based on addresses and port numbers. That model stopped being sufficient when almost everything started running over the same two ports and encrypted itself on the way. A next-generation firewall looks at what the traffic actually is, which is more useful and considerably more expensive in processing terms.
The short version
- Application control identifies traffic by what it is, not which port it uses.
- Intrusion prevention inspects content for known attack patterns.
- Web and DNS filtering blocks known-bad destinations before a connection completes.
- TLS inspection is what makes the rest work on encrypted traffic — and it is the expensive one.
Why ports stopped being meaningful
A classic firewall rule permits outbound traffic on the ports used for web browsing. That rule now permits file sharing, remote access tools, messaging, streaming, and data exfiltration, because essentially everything travels over those same ports and is encrypted.
Application control solves this by identifying the application from traffic characteristics rather than the port number. It lets you write a rule that means "permit web browsing but not this remote access tool", which is impossible to express in ports alone.
A firewall advertised at several gigabits is usually quoting raw stateful throughput with no inspection enabled. Turn on intrusion prevention, antivirus, and TLS inspection and real throughput can fall to a fraction of that figure. Vendors publish these separately — find the "threat protection" or equivalent number and size against it. This single misunderstanding causes more undersized firewall purchases than anything else.
What each feature actually does
| Feature | What it buys you |
|---|---|
| Stateful firewalling | The baseline. Tracks sessions so return traffic is permitted without opening the door in both directions. Every firewall does this. |
| Application control | Identify and control applications regardless of port. Useful for blocking unsanctioned remote access and file sharing tools, which is a real exfiltration path. |
| Intrusion prevention (IPS) | Matches traffic against signatures of known exploits and blocks them. Most valuable protecting services you expose, and unpatched internal systems. |
| Antivirus / anti-malware | Scans files in transit. A useful additional layer, not a replacement for endpoint protection — it only sees what crosses the firewall. |
| Web filtering | Blocks categories of site and known-malicious domains. Often as much an acceptable-use tool as a security one. |
| DNS filtering | Blocks resolution of known-bad domains. Cheap in processing terms and surprisingly effective, because most malware needs to resolve a name. |
| TLS inspection | Decrypts, inspects, and re-encrypts. Without it, the features above are largely blind on modern traffic. Expensive in CPU and carries real privacy and compatibility considerations. |
| VPN | Site-to-site links between offices, and remote access for staff. Usually included rather than a separate subscription. |
| SD-WAN | Uses multiple internet links intelligently, steering traffic by application and link quality. Genuinely useful for multi-site businesses. |
TLS inspection, honestly
Most traffic is encrypted. That is good, and it means a firewall cannot see inside sessions unless it terminates and re-establishes the encryption itself — acting as a deliberate man in the middle for traffic you own.
It works, and there are four things to understand before enabling it.
- It is processor intensive. This is where throughput falls most sharply, and it is why the threat protection figure matters.
- Clients must trust the firewall's certificate. That means deploying a certificate to every managed device. Unmanaged and guest devices will show warnings.
- Some traffic must be excluded. Applications using certificate pinning break when inspected, and banking, health, and similar categories are commonly excluded for privacy reasons. Expect to maintain an exclusion list.
- It has policy implications. You are decrypting staff traffic. Make sure that is covered by your acceptable use policy and, depending on your jurisdiction, that staff are informed.
DNS filtering blocks a large share of malware activity for almost no processing cost and no certificate deployment, because it acts before the encrypted session is established. It is the highest return per unit of effort in this whole list. Get that working, then decide whether full TLS inspection is worth its cost and complexity for your environment.
Subscriptions, and why the hardware price is only part of it
Next-generation features depend on threat intelligence that updates constantly, so they are sold as subscriptions. The firewall keeps forwarding traffic when a subscription lapses, but the signatures stop updating — which means it quietly becomes a stateful firewall with an out-of-date view of the world.
- Bundles package the security services with hardware for a term, and are usually better value than buying services separately.
- Term length matters. Longer terms cost less annually and commit you to the platform.
- Budget it as recurring cost. A firewall with expired subscriptions is a common and quiet failure — nothing breaks, so nobody notices.
- Check what is included versus extra. VPN is typically included; IPS, antivirus, and web filtering typically are not.
- Set a renewal reminder independent of the vendor's email, which will go to whoever bought it three years ago.
When security service subscriptions lapse, traffic keeps flowing and users notice nothing. The firewall continues to enforce your rules while its threat intelligence ages. Monitor subscription status the same way you monitor anything else that matters, because there is no outage to alert you.
What a firewall does not do
- It does not protect traffic that never crosses it. Device-to-device traffic on the same VLAN is invisible to it — which is an argument for segmentation.
- It does not replace endpoint protection. Laptops leave the building.
- It does not replace patching. IPS buys time against known exploits; it is not a substitute for fixing the vulnerability.
- It does not stop credential theft. Legitimate credentials used by the wrong person look legitimate.
- It does not back anything up. Worth stating, because firewalls are frequently the ransomware conversation and backups are the actual answer.
Official manufacturer resources
Feature availability, throughput figures per inspection mode, and subscription bundles are model-specific. Confirm against the datasheet for the exact part number.
Not sure which features you actually need?
Tell us your internet speed, user count, and what you are trying to protect against. We will tell you which inspection features are worth enabling and which will just cost you throughput.
Still stuck? Talk to someone who works on this hardware daily.
Tell us the model, what you have already tried, and what you are seeing. We will tell you whether it is a setting, a consumable, or a part — and we will say so if you do not need to buy anything.
