Firewall Type Comparison — At a Glance
| Firewall Type | OSI Layer | Filtering Basis | Key Capabilities | Primary Use Case | Key Limitation |
|---|---|---|---|---|---|
| Traditional Network Firewall | Layer 3–4 | IP address, port number, protocol | NAT, VPN, routing, packet filtering by port/IP | Network boundary; ingress/egress control | Cannot identify application — any traffic on an allowed port passes through |
| UTM (Unified Threat Management) | Primarily Layer 4 (some Layer 7) | Port/protocol + limited application detection | Firewall, IDS/IPS, URL filter, malware scan, spam filter, VPN, bandwidth shaping — all in one | SMB environments needing multi-function security in one box | Performance degrades with multiple features enabled; typically Layer 4 not Layer 7 |
| NGFW (Next-Generation Firewall) | Layer 7 (all layers) | Application identity, user identity, content | DPI, app control (regardless of port), integrated IPS, URL categorization, full packet decode | Enterprise network boundary; application-aware policy enforcement | Higher processing demand than traditional; requires more resources per-packet |
| WAF (Web Application Firewall) | Layer 7 — HTTP/HTTPS only | HTTP input validation (URL, parameters, headers, body) | SQL injection/XSS/path traversal blocking; input sanitization; application behavior validation | Protecting web-facing applications; PCI DSS compliance for e-commerce | Only protects HTTP/HTTPS — not a general-purpose network firewall; must be paired with NGFW |
OSI Layer Decision Map — Which Firewall Sees What
| OSI Layer | Data at This Layer | Traditional Firewall | UTM | NGFW | WAF |
|---|---|---|---|---|---|
| Layer 3 — Network | Source/destination IP address | ✓ Yes | ✓ Yes | ✓ Yes | Partial (sees IP in HTTP headers) |
| Layer 4 — Transport | TCP/UDP port number, protocol | ✓ Yes | ✓ Yes | ✓ Yes | Port (HTTP=80, HTTPS=443) |
| Layer 7 — Application | Application identity, user data, protocol content | ✗ No | Limited | ✓ Full decode | ✓ HTTP/HTTPS only |
| HTTP Input | URL, query parameters, POST body, cookies, headers | ✗ No | ✗ No | Partial (app ID) | ✓ Full validation |
UTM Feature Inventory
| UTM Feature | What It Does | OSI Layer |
|---|---|---|
| Firewall | Port and protocol-based traffic filtering; allow/deny by IP and port | Layer 3–4 |
| URL Filtering / Content Inspection | Block access to websites by category or URL; enforce acceptable use policy | Layer 7 |
| Malware Inspection | Scan file transfers and downloads against malware signatures | Layer 7 |
| Spam Filter | Block unwanted email at the network perimeter before delivery to mail servers | Layer 7 |
| IDS/IPS | Detect and block known attack signatures in traffic | Layer 4–7 |
| VPN Endpoint | Terminate site-to-site and remote-access VPN tunnels | Layer 3–4 |
| Bandwidth Shaping / QoS | Prioritize critical business traffic over recreational traffic | Layer 4–7 |
| Routing / Switching | Act as the gateway router; some models include switch ports | Layer 2–3 |
| CSU/DSU | WAN interface hardware for connecting to carrier circuits (T1, DS3) | Layer 1 |
Performance caveat: Enabling more UTM features simultaneously increases processing load. A UTM running all features at once will have significantly lower throughput than the same device running only firewall functions. Size the UTM to handle peak load with all required features enabled.
Traditional Firewall vs. NGFW — Application Identification
Scenario: Organization uses port 443 (HTTPS). Three different applications all use port 443.
| Application | Port Used | What Traditional Firewall Sees | What NGFW Sees | NGFW Policy Applied |
|---|---|---|---|---|
| YouTube (viewing) | 443 | HTTPS — allowed (port 443 open) | YouTube video streaming — identified by DPI | Allow viewing; block uploading |
| Twitter (posting) | 443 | HTTPS — allowed (same rule) | Twitter API — identified by DPI | Allow reading; block posting |
| Microsoft SQL Server (via SSL) | 443 (non-standard) | HTTPS — allowed (same rule) | SQL Server TDS protocol — identified by DPI | Allow from authorized DB server IPs only |
| Peer-to-peer (tunneled through HTTPS) | 443 | HTTPS — allowed (same rule) | BitTorrent over HTTPS — identified by DPI | Block — P2P policy |
The traditional firewall sees four identical entries: "TCP 443 inbound — allow." The NGFW sees four different applications and applies four different policies.
WAF Deployment Architecture
Internet traffic
↓
[NGFW / Perimeter Firewall]
Function: Network-level filtering
Blocks: Bad source IPs, non-HTTP protocols, unauthorized ports
Sees: IP addresses, ports, application type (HTTPS)
↓
[WAF — deployed as Reverse Proxy]
Function: HTTP/HTTPS input validation
Blocks: SQL injection, XSS, path traversal, HTTP anomalies
Sees: Full HTTP request — URL, parameters, headers, POST body, cookies
↓
[Web Application Server]
Receives only clean, validated HTTP requests
Never sees blocked attack traffic — WAF absorbed it upstream
↓
[Database Server]
No SQL injection reaches here — WAF blocked it at the HTTP layer
Firewall Selection Guide — Matching Requirements to Type
| Requirement | Best Firewall Type | Why |
|---|---|---|
| Block access to social media for all employees | NGFW (or UTM) | Requires application identification — social media uses HTTPS; a traditional firewall cannot distinguish it from other HTTPS traffic |
| Protect a payment processing web application from SQL injection | WAF | SQL injection is HTTP input-level — requires HTTP payload inspection, not network-level filtering |
| PCI DSS compliance for e-commerce site | WAF (mandatory) | PCI DSS explicitly requires WAF for cardholder data environment web applications |
| Small business needs firewall + IPS + VPN + spam filter in one box | UTM | UTM bundles all of these in a single device; cost-effective for SMB scale |
| Allow SQL Server traffic only from authorized internal servers, any port | NGFW | Requires application identification (SQL Server protocol) regardless of port — only NGFW DPI can do this |
| Block all outbound traffic to "gambling" category websites | NGFW (or UTM) | URL categorization is a feature of NGFW and UTM, not traditional firewalls |
| Simple port-based filtering at network edge with NAT and site-to-site VPN | Traditional firewall | Layer 4 rules, NAT, and VPN are traditional firewall capabilities; no need for NGFW overhead if application identification is not required |
NGFW Alternative Names — Same Technology, Different Labels
| Term | What It Emphasizes | Meaning |
|---|---|---|
| Next-Generation Firewall (NGFW) | Evolution beyond traditional firewalls | Layer 7 application-aware firewall with DPI, IPS integration, and URL categorization |
| Application Layer Gateway | Which OSI layer it operates at | Firewall that understands and makes decisions based on Layer 7 application protocols |
| Stateful Multilayer Inspection | How it inspects traffic (state + multiple layers) | Combines stateful connection tracking with inspection across Layers 3–7 |
| Deep Packet Inspection (DPI) | The inspection technique used | Full payload decode of every packet — identifies application, content, and behavior |
On the exam, any question describing a firewall that operates at Layer 7, identifies specific applications, or performs deep packet inspection is asking about an NGFW — regardless of which term is used.