Next-generation firewall (NGFW)
Also known as: NGFW, next-gen firewall, next-generation firewall, UTM firewall
A next-generation firewall (NGFW) is an advanced firewall that does more than block ports: it inspects the actual content of traffic to detect and stop intrusions, malware, and access to malicious sites.
Sitting at the network edge, it's a core security layer for businesses, often bundling threat prevention, filtering, and VPN into one device.
Next-generation firewall (NGFW), explained at three levels
At home
Think of an old-style firewall as a security guard who checks only the address on each envelope and the door it is headed for. A next-generation firewall also opens the envelope and reads what is inside. On a network, that means it looks at the actual data flowing through, not just where it comes from and where it is going, so it can spot malware or an attack hidden inside traffic that looks normal.
At work
A next-generation firewall is the device that sits between a business network and the internet and decides what traffic gets through. Unlike a basic firewall, which allows or blocks traffic by address and port number, it identifies the application, the user, and the content involved. That lets one box block intrusions, malicious websites, and malware downloads, and it often provides the VPN that remote staff use to connect.
At home
An NGFW runs several engines on the same traffic. Application identification recognizes Netflix, Zoom, or Dropbox by the pattern of their traffic rather than by port number, since most apps now share port 443. An intrusion prevention system compares traffic against thousands of signatures of known attacks. URL filtering checks each site against a reputation database, and file inspection scans downloads for malware. Each engine is updated through a subscription, which is why these boxes stop improving when the licence lapses.
At work
Inside an NGFW, rules are written in terms of applications and identities instead of only IP addresses and ports. A rule can say that the accounting group may use QuickBooks Online but nobody may use personal file-sharing apps. The firewall learns who is behind each address by linking to the directory, such as Microsoft Entra ID or Active Directory. Threat engines for intrusion prevention, web filtering, and malware scanning then run on allowed traffic, fed by the vendor's threat-intelligence subscription, and every decision is logged.
At home
Most web traffic is now encrypted with TLS, so an NGFW can't see inside it without decrypting it. To do that, it acts as a middleman: it opens the encrypted connection, inspects the content, then re-encrypts it with its own certificate, which every device must be set to trust. That costs processing power and exposes private traffic such as online banking. While full inspection catches more threats, in my view a small office should decrypt selectively and exclude banking and health sites.
At work
NGFW limits are mostly about throughput and visibility. Vendors such as Fortinet, Palo Alto Networks, and Sophos quote a headline firewall speed, but throughput with intrusion prevention and TLS inspection switched on can be a small fraction of it, so sizing must use the threat-protection figure. Certificate-pinned apps break under decryption and need exclusions. Logs should go to a SIEM for correlation. For staff working outside the office, the same policy is increasingly delivered from the cloud through SASE.
Real-world examples
At home
Sophie's old router had only a basic firewall. After a malware scare, her MSP installed an NGFW that inspects traffic, blocks known attack attempts, filters dangerous sites, and provides secure remote access: a substantial security upgrade at the network's edge.
At work
Jerome's clinic needed stronger perimeter security for compliance. His MSP deployed an NGFW with intrusion prevention, malware inspection, and content filtering, tuned to the clinic's needs and backed by active threat subscriptions: blocking several intrusion attempts and malicious sites in its first months.
How it compares
| feature | Traditional firewall | NGFW |
|---|---|---|
| Inspection depth | Ports & addresses | Deep content inspection |
| Intrusion prevention | No | Yes |
| Application awareness | No | Yes |
| Malware/threat detection | No | Yes (with subscriptions) |
| Encrypted traffic inspection | No | Yes (TLS inspection) |
For analysts
An NGFW is a core perimeter defence, but it's only effective when properly configured with active threat subscriptions, and it's one layer, not a whole strategy. Pair it with endpoint protection, email security, and backups for real defence-in-depth.
History & origin
Traditional firewalls controlled traffic based on ports and addresses: effective when threats were simpler. As attacks moved to hide within allowed traffic (like web traffic), firewalls needed to inspect content and understand applications. Next-generation firewalls emerged around 2010, adding deep packet inspection, intrusion prevention, and application awareness. They became the standard perimeter security device, with subscription threat-intelligence feeds keeping defences current.