Course contents

Unit 12: Network Security FundamentalsLesson 12.3 (3 of 5 in this unit)87 of 104 in the Network Fundamentals course

NGFW vs NGIPS

Firewalls decide whether a connection may exist. Intrusion prevention asks whether the traffic inside an allowed connection is an attack. Today the two are often combined in one product, but knowing which engine does which job helps you configure and troubleshoot them.

Intermediate · 10 min read · Before this: Firewall basics, Network security basics

Covers Stateful firewall, Application and user control, Intrusion prevention, TLS inspection and NGFW or NGIPS.

Technical definition

A next-generation firewall (NGFW) is a firewall that goes beyond address, port and session state: it identifies applications and users, includes intrusion prevention and can inspect encrypted traffic. A next-generation IPS (NGIPS) is an inline engine that detects and blocks attacks, using context about hosts, applications and users.

NGFW and NGIPS: what each one adds
NGFW and NGIPS: what each one addsA next-generation firewall stacks features: a stateful firewall that decides by address, port and session; application and user awareness that decides by which application and which user; and an integrated intrusion prevention engine that blocks known exploits. A next-generation IPS is a dedicated engine focused on detecting and blocking attacks inline, with context about hosts, applications and users to judge which attacks matter. A NGFW enforces policy; an IPS looks for attacks inside traffic that policy already allows.Next-generation firewall (NGFW)1. Stateful firewalladdress, port, protocol and session state2. Application and user controlwhich application, which user, which group3. Integrated IPS and TLS inspectionblocks known exploits, reads decrypted trafficJob: enforce policy at the boundaryDefault: deny what no rule allowsExamples: FortiGate, Cisco Secure Firewall,Palo Alto firewallsNext-generation IPS (NGIPS)Inline sensorsits in the traffic path and can drop packetsSignature and behaviour detectionrecognises exploits and unusual activityContext awarenessknows hosts, applications, users, vulnerabilitiesJob: find attacks inside allowed trafficOften a module or a dedicated applianceTuned to cut false positives withknowledge of what is on the network

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Policy answers 'who may talk to what'. An IPS answers 'is this allowed traffic an attack'. Many products combine both, so the question is usually which engine does which job.

Firewall first: policy at the boundary

A traditional stateful firewall decides by source and destination address, port, protocol and session state. It tracks sessions, so replies to outgoing connections are allowed without an inbound rule, and traffic with no matching rule is denied. This is the foundation of an NGFW.

What makes it next-generation

An NGFW adds knowledge of the traffic itself. Application control identifies the application, such as a video call or a file-sharing service, even when it uses ordinary web ports. User identity lets a rule apply to a person or a group instead of an address. An integrated IPS blocks known exploits, and TLS inspection lets those engines see inside encrypted sessions.

What an IPS does

An intrusion prevention system sits inline, in the traffic path, and checks traffic against signatures of known attacks and against behaviour that looks wrong. When it finds a match it can drop the packets or reset the connection. A next-generation IPS adds context: it knows which hosts, applications and operating systems are on the network, so it can judge whether an exploit could succeed and rank what matters.

NGFW and NGIPS compared
NGFW and NGIPS compared; NGFW; NGIPS. Main question: May this traffic exist at all? Is this allowed traffic an attack? Decides by: Policy: address, application, user Signatures, behaviour and context Default stance: Deny what no rule allows Allow, and block what matches an attack Placement: At the boundary between zones Inline in a path, or inside an NGFW Typical work: Segmentation, access, VPN, web control Exploit and malware blockingNGFWNGIPSMain questionMay this traffic exist at all?Is this allowed traffic an attack?Decides byPolicy: address, application, userSignatures, behaviour and contextDefault stanceDeny what no rule allowsAllow, and block what matches anattackPlacementAt the boundary between zonesInline in a path, or inside an NGFWTypical workSegmentation, access, VPN, webcontrolExploit and malware blocking

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Header row, topics and answers use different colours so each row reads across.

Tuning and trade-offs

Inspection costs CPU and memory, so enable what each policy needs rather than everything on every rule. Keep signature databases current, start new rules in a monitoring mode where the product allows it, and review blocked events for false positives. On a FortiGate the same ideas appear as security profiles on a firewall policy; see Inspection in the packet path.

Test yourself

Predict · scenario 1

Which device can drop packets that match a known exploit while sitting inline?

Predict · scenario 2

A rule must apply to the Finance group instead of to IP addresses. Which NGFW feature provides this?

Predict · scenario 3

Why might an IPS miss an attack inside HTTPS?

FAQ

Is an IPS the same as an IDS?
No. An IDS detects and alerts, usually from a copy of the traffic. An IPS sits inline and can block the attack as it passes.
Does an NGFW replace a separate IPS?
Often yes: most NGFWs include an IPS engine. A dedicated NGIPS can still make sense for deep inspection at a specific point, or where a separate team runs it.
Why do NGFWs need TLS inspection?
Most traffic is encrypted, so signatures and application detection cannot see inside it. TLS inspection decrypts, inspects and re-encrypts, which adds load and needs trusted certificates on clients.