2.1.3. Next-Generation Firewalls and IPS
Traditional firewalls were basically bouncers checking IDs—they looked at source/destination IPs and ports, and that was it. But attackers got clever: malware hides in legitimate web traffic on port 443, and data exfiltration looks like normal HTTPS. A traditional firewall can't tell the difference between you browsing the news and an attacker stealing your database—both are "HTTPS to the internet."
Next-Generation Firewalls (NGFW) solve this by inspecting the actual content of traffic, not just the envelope. They understand applications (is this really Netflix or a VPN tunnel pretending to be Netflix?), decrypt TLS to inspect what's inside, and even identify users regardless of what IP they're on.
What NGFWs do that traditional firewalls can't:
- Application awareness—block BitTorrent even if it's running on port 80
- User-based policies—allow Slack for marketing, block it for finance
- Intrusion prevention—detect and block exploits in real-time
- Malware detection—sandbox suspicious files before they reach users
Intrusion Prevention Systems (IPS) sit inline in the traffic path and actively block malicious packets. Unlike an IDS (detection only, sends alerts), an IPS drops threats before they reach their target. The trade-off: if your IPS misconfigures or crashes, it can take down your network.
Stateless vs stateful: A stateless packet filter (such as a router ACL) judges every packet on its own, so return traffic needs its own permit rule. A stateful firewall records each connection in a state table and automatically allows the matching replies; NGFWs keep that behavior and add application awareness on top.
Cisco Platform: Cisco Secure Firewall (formerly Firepower)
