A next-generation firewall (NGFW) is a device or program at the edge of a company's network that inspects every connection going in or out, and allows or blocks each one. "Next-generation" means that it recognises the application and the user behind each connection, not only the internet address. It is still the largest product in network security.
An older firewall decides by address and port. An address is the number that identifies a computer on the internet. A port is a numbered door on that computer for one kind of service. For example, websites use port 443. A rule might say: "Allow any office computer to reach any address on port 443." But almost everything on the internet now uses port 443, including file-sharing sites and games. So a rule about ports alone cannot tell them apart.
The next-generation firewall looks deeper. It identifies the application, such as the GST portal, a video site or a file-sharing service. It knows the user, because it asks single sign-on (SSO) who is logged in on each computer. It can also decrypt a connection, check its contents for harmful files and encrypt it again.
Take, for example, the head office of a logistics company in Nagpur. Its firewall has a rule: "The accounts team may use the GST portal and the bank's net banking site. Nobody may upload files to personal file-sharing sites." At 4 p.m., an employee in the accounts team tries to upload a 300 MB folder of invoices to a personal file-sharing account. The firewall recognises the application, blocks the upload and records it. Twenty minutes later, a laptop in the dispatch office tries to connect to an address abroad. That morning, a threat intelligence platform had listed the address as an attacker's server. The firewall blocks this connection too.
The firewall is also stateful. This means it remembers each connection. A reply from the internet gets in only if a computer inside asked for it first.
Every allowed and blocked connection becomes a log line, which the firewall sends to the SIEM. The firewall usually does two older jobs as well: the VPN and intrusion prevention (IPS). The VPN connects staff at home to the office. Intrusion prevention blocks known attacks.
Most firewalls in India are sold and installed by resellers and IT firms, a model called channel sales. Firewalls are now also sold as software that runs in the cloud. Many companies send their branch offices and remote staff through SASE instead, where similar checks run in a security company's cloud.