What is a Next-Generation Firewall (NGFW)?

A next-generation firewall (NGFW) is a firewall that layers application awareness, intrusion prevention, and content inspection on top of traditional stateful packet filtering, so policy can be enforced by application identity and user or group rather than by IP address, port, and protocol alone.

Key takeaways

• NGFW extends stateful filtering with app-aware, Layer 7 policy.
• It bundles IPS, URL filtering, and TLS inspection in one control point.
• Applications are identified by signature, heuristic, and statistical analysis.
• Deployments range from perimeter appliances to cloud-delivered NGFWaaS.
• Versa’s NGFW module runs inside VOS as part of its security stack.

On this page: Why it matters · How it works · Types · NGFW & Versa · FAQ

Why is NGFW important?

Classic stateful firewalls decide what to allow based on source and destination IP address, port, and protocol. That model made sense when each application had its own port, but it breaks down when dozens of applications – sanctioned and unsanctioned – share the same HTTPS port and look identical at Layer 4. A firewall that only sees “port 443 traffic” cannot tell a SaaS app from a file-sharing site or a hidden malware channel.

NGFW matters because it closes that visibility gap. Inspecting traffic up through the application layer, it identifies the application and user behind a session, applies intrusion prevention against known exploits, filters destinations by URL category, and inspects inside encrypted sessions – all from one enforcement point. That consolidation reduces the number of separate security tools a network has to stitch together, and lets policy follow what traffic actually is, not just where it’s headed.

What is an NGFW?

An NGFW is a firewall that adds deep packet inspection and application identification on top of conventional stateful filtering. A traditional firewall matches a session against source/destination address, port, and protocol, and stops there. An NGFW keeps evaluating: it applies signature-based, heuristic, and statistical methods to determine which application generated the session – even tunneled over a common port – then enforces policy against that identity.

Layered on top are the capabilities that give NGFW its name: intrusion prevention that blocks known exploits, URL and web filtering that categorizes destinations, TLS/SSL decryption that inspects encrypted sessions instead of passing them through blind, and QoS controls tied to the recognized application. Together these turn the firewall into a single enforcement point spanning Layer 3 through Layer 7.

Types of NGFW deployment

NGFW capability is delivered in a few distinct forms. Appliance-based NGFW runs as dedicated hardware at a network perimeter or branch edge – the traditional model, sized to the site’s throughput. Virtual NGFW runs the same inspection engine as a virtual machine or container in a data center, private cloud, or public cloud, trading a physical box for elastic compute. Cloud-delivered NGFW, often marketed as firewall-as-a-service or NGFWaaS, enforces policy from distributed cloud points of presence rather than a fixed location, which is how NGFW functions are typically consumed inside a SASE or SSE architecture. A fourth pattern, NGFW embedded in an SD-WAN edge device, folds the firewall into the WAN edge itself – the model Versa’s VOS platform uses.

NGFW & Versa

Versa’s NGFW is a security module built into the Versa Operating System, distinguishing traffic beyond simple port, protocol, and IP-address matching. It includes an application firewall, an intrusion prevention system, TLS/SSL encrypted-traffic inspection, website filtering, and QoS and bandwidth management. Administrators configure it by creating an access policy profile (an ACL) and rules matching Layer 3/4 criteria plus Layer 7 criteria – application and URL category – using predefined and custom objects for applications, application filters, groups, services, URL categories, and URL reputation.

NGFW is enabled per VOS device through its service node group, then per tenant through organization limits. Policy rules then apply security profiles to matching traffic: IP filtering, antivirus, vulnerability/IPS, URL filtering, DNS filtering, CASB, DLP, ATP, and RBI. Threat data lands in Versa Analytics dashboards reporting on URL categories and rule activity. See Configure Next-Gen Firewall (NGFW) for the full workflow.

Frequently asked questions

What is the difference between an NGFW and a traditional firewall?

A traditional firewall filters traffic only by source/destination IP address, port, and protocol. An NGFW adds application identification, intrusion prevention, and URL filtering on top of that, so policy is based on what an application actually is, not which port it uses.

How does an NGFW identify applications inside network traffic?

NGFWs combine signature matching, heuristics, and statistical analysis to identify the application generating a session, even when it’s tunneled over a common port like 443. Versa’s NGFW applies these methods during a session’s first packets, then anchors policy to the identified application.

Can an NGFW inspect encrypted (TLS/SSL) traffic?

Yes. Most NGFWs include TLS/SSL decryption, commonly via forward-proxy interception, so IPS, URL filtering, and antivirus profiles can inspect content that would otherwise be opaque and unpoliced. Versa’s VOS NGFW module supports this decryption as one of its core traffic-inspection functions.

Does an NGFW replace a separate IPS and URL filtering solution?

Typically yes for policy enforcement – IPS and URL filtering are usually delivered as built-in profiles applied by NGFW rules rather than as standalone appliances. In Versa’s VOS, both are configured as security profiles attached directly to NGFW access policy rules.

Is NGFW only a hardware appliance?

No. NGFW capability also ships as a virtual machine, a container, or a cloud-delivered service (NGFWaaS) consumed as part of a SASE or SSE architecture, in addition to running embedded in an SD-WAN edge device such as a VOS appliance.

More on NGFW

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about NGFW, these are worth looking at next.