Cyber Security
Next-generation firewall explained: what SMEs really need
A next-generation firewall sees applications, users and threats, not just ports and addresses. This article explains the features, sizing, high availability and what SMEs really need.
Q-entra editorial teamPublished on 6 min read
Contents
Key takeaways
- A next-generation firewall (NGFW) adds application control, intrusion prevention, URL and DNS filtering and user-based rules to the classic stateful packet filter.
- Size the firewall by its throughput with all security features enabled, not by the headline figure on the datasheet.
- TLS inspection improves detection but touches on privacy and employment law: in Austria, clarify it with the works council and data protection first and take legal advice.
- Most SMEs need segmentation, VPN with MFA, IPS and web filtering; sandboxing and high availability depend on risk and downtime tolerance.
- A firewall is only as good as its operation: updates, licences, rule reviews and logging belong in the plan from the start.
What is a next-generation firewall?
A next-generation firewall (NGFW) decides not only by IP addresses and ports, but also by application, user and content. It recognises, for example, whether a connection belongs to Microsoft Teams, a private cloud storage service or known malware, and applies the matching rules. Typical features are application control, intrusion prevention (IPS), URL and DNS filtering, VPN and integration with user accounts.
In small and medium-sized businesses, the firewall is usually the central control point between the internet, the office network, servers, guest Wi-Fi and remote workers. For most SMEs, a solid baseline matters more than the longest feature list: segmentation, VPN with MFA, IPS, web and DNS filtering and regular updates.
Stateful packet filter vs NGFW: the difference
A classic stateful firewall tracks connections and decides by source, destination, port and protocol whether traffic is allowed. This is still the foundation of every firewall. Its limitation: most applications now use the same web ports 80 and 443, and an allowed port says nothing about whether the content is harmless.
| Aspect | Stateful packet filter | Next-generation firewall |
|---|---|---|
| Decides by | IP address, port, protocol, connection state | Also application, user, URL category and content |
| Threat detection | None beyond the rules | IPS signatures, malware and reputation checks |
| Encrypted traffic | Sees addresses and ports only | Metadata, optionally full inspection via TLS inspection |
| Rules | Based on IP addresses | Based on users, groups and applications |
| Running costs | Mostly hardware and maintenance | Plus subscriptions for signatures and filters |
The key NGFW features at a glance
Application control
The firewall identifies applications by characteristics of their traffic, regardless of the port. This allows rules such as: the company's collaboration tools are permitted, while private file-sharing services or unapproved remote maintenance tools are blocked.
Intrusion prevention (IPS)
An IPS checks traffic for patterns of known attacks, such as exploits against web servers, VPN gateways or outdated systems, and blocks them. It is particularly useful in front of services that are reachable from the internet and between network segments. It needs current signatures and occasional tuning to avoid false alarms.
URL and DNS filtering
Web and DNS filters block known phishing and malware sites as well as categories the company does not want to allow. DNS filtering also works for devices and applications without a browser. Neither replaces training, but both can stop many attacks early.
User identity and VPN
Connected to Active Directory or Microsoft Entra ID, the firewall applies rules to users and groups instead of IP addresses: accounting can reach the finance server, everyone else cannot. It also provides VPN for sites and remote workers. Remote access should always be protected with multi-factor authentication, and the VPN gateway itself must be kept up to date, because systems at the internet edge are a frequent target.
Sandboxing
Suspicious files are executed in an isolated environment, often in the vendor's cloud, before they reach the user. This helps against new malware that signatures do not yet recognise. Check where the files are analysed and whether that fits your data protection requirements.
TLS inspection: benefits, limits and the works council
Most web traffic today is encrypted. Without TLS inspection (often still called SSL inspection), the firewall essentially sees metadata such as the destination address and server name, so IPS and malware scanning cannot reach the content. With TLS inspection, the firewall decrypts the traffic, checks it and encrypts it again. For this, a root certificate of the firewall must be trusted on all company devices.
On the technical side, some applications refuse inspected connections and need exceptions, and inspection costs a lot of processing power. The organisational side weighs more heavily, because decrypted traffic can contain personal and private data of employees. Categories such as online banking and health services are therefore usually excluded, and access to logs is restricted.
Sizing: throughput with features enabled
Datasheets usually lead with pure firewall throughput, measured under ideal conditions without security features. With IPS, application control and malware protection enabled, the figures are considerably lower, and with TLS inspection often only a fraction remains. These realistic figures, often labelled threat protection or TLS inspection throughput, are what counts for sizing.
- Internet connection: the firewall should handle the full bandwidth with all planned features enabled.
- Traffic between segments: if the firewall also routes between VLANs, for example to servers or cameras, this traffic adds to the load.
- VPN: the number of simultaneous remote users and site tunnels and the encrypted throughput they need.
- Sessions and interfaces: concurrent connections and ports with sufficient speed, such as 2.5 or 10 Gbit/s.
- Reserve: a firewall usually runs for several years, so plan for more users, faster lines and new features.
High availability and licences
High availability means two identical firewalls working as a cluster, usually in active/passive mode. If one fails, the second takes over, ideally without dropping existing connections. This pays off when downtime is expensive, for example in retail, logistics or medical practices that rely on cloud software. It is only fully effective with a second internet line, because a cluster cannot compensate for a failed connection. For smaller companies, a hardware replacement service with short delivery times and a backed-up configuration can be the more affordable alternative.
NGFW features usually depend on subscriptions for signatures, filters and sandboxing. If the licence expires, the hardware usually keeps running, but signatures and filters stop updating. Plan licence costs over the entire service life and check how the vendor licenses the second device in a cluster.
Management and logging
A firewall needs care. Firmware updates, especially security updates for VPN and the management interface, should be installed promptly. The management interface should never be reachable from the internet, and admin access belongs in a separate management network with personal accounts and MFA. Rules should be documented, reviewed regularly and cleaned up, including temporary rules that were never removed.
Logs show blocked attacks, unusual connections and configuration changes. Store them centrally, for example on a syslog server or in a SIEM, and make sure someone actually looks at the alerts. Define retention periods and access rights together with data protection. If you lack the capacity internally, ongoing support from a service provider is an option.
What SMEs really need
Not every company needs every feature. For most SMEs, this checklist is a sensible basis:
- Essential: a stateful firewall with clear rules, separation of office, servers, guests and IoT via VLANs, VPN with MFA, regular updates.
- Strongly recommended: IPS, URL and DNS filtering, application control for risky categories, central logging.
- Depending on the situation: TLS inspection for selected categories after agreement with the works council and a legal review, sandboxing, high availability.
A firewall is an important layer of protection, but not the whole defence. In a zero trust approach, identities, devices and access rights are checked regardless of network location. If you would like to assess your current firewall or plan a new one, Q-entra supports you with cyber security and network infrastructure from the requirements analysis to operation.
