Executive Summary
Two measurements decide whether a firewall purchase holds up: the throughput it sustains with threat prevention and decryption switched on, and how quickly the vendor fixes the internet-facing services an attacker can reach.
A firewall decides which traffic may pass between networks. NIST describes firewalls as devices or programs that control the flow of network traffic between networks or hosts employing differing security postures, and makes recommendations for establishing firewall policies and for selecting, configuring, testing, deploying and managing firewall solutions. A next-generation firewall adds inspection above the address and port: it identifies the application and the user behind a connection, runs intrusion prevention, and can decrypt traffic to inspect it.
The products come in four shapes: hardware appliances, virtual firewalls, managed services inside each public cloud, and firewall as a service delivered from the vendor's cloud. An enterprise with branches, data centers and cloud workloads may need several of them, so ask how one policy and one console cover all of them. The second decision is maintenance. A firewall faces the internet by design, and CISA's Known Exploited Vulnerabilities catalog includes firewall software from every appliance vendor in this guide's vendor table.
Why the Patching Record Belongs in the Evaluation
A perimeter firewall faces the internet by design, so its own software is exposed to attack. CISA states that the repository holds the data files that make up the Known Exploited Vulnerabilities (KEV) catalog, originally sourced from https://www.cisa.gov/known-exploited-vulnerabilities-catalog. The entries below are one per appliance vendor in the vendor table, plus two appliance vendors discussed later in the guide.
CISA lists CVE-2024-3400 (date added 2024-04-12) as a command injection vulnerability in the Palo Alto Networks PAN-OS GlobalProtect feature that allows an unauthenticated attacker to execute commands with root privileges on the firewall. CISA lists CVE-2024-21762 (date added 2024-02-09) as a Fortinet FortiOS out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. CISA lists CVE-2024-24919 (date added 2024-05-30) as an information disclosure vulnerability in Check Point Quantum Security Gateways that potentially allows an attacker to access information on gateways connected to the internet with IPSec VPN, Remote Access VPN or Mobile Access enabled. CISA lists CVE-2025-20333 (date added 2025-09-25) as a buffer overflow vulnerability in the VPN web server of Cisco Secure Firewall ASA and Secure Firewall Threat Defense software that allows for remote code execution. CISA lists CVE-2025-9242 (date added 2025-11-12) as a WatchGuard Firebox out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code. CISA lists CVE-2022-3236 (date added 2022-09-23) as a code injection vulnerability in the User Portal and Webadmin of Sophos Firewall that allows for remote code execution. CISA lists CVE-2023-36846 (date added 2023-11-13) as a missing authentication for critical function vulnerability in Juniper Junos OS on SRX Series that allows an unauthenticated, network-based attacker to cause limited impact to file system integrity.
Several of these entries involve VPN and remote-access features, which are reachable from the internet by design. Disable the services you do not use, keep management interfaces off the internet, and ask each vendor how long its fixes for exploited vulnerabilities took to ship. Vendors also describe their own mitigations. Sophos states that Sophos Firewall reduces exposure with a hardened design, automated hotfixes, a built-in health check for misconfigurations, and proactive Sophos monitoring for signs of an attack. CISA states that the repository is updated whenever the KEV is updated.
Appliance, Virtual Firewall, Cloud Service or Firewall as a Service
The form factor follows the traffic. Hardware appliances sit at branches, campuses and data centers. Virtual firewalls run the same software in a hypervisor or a public cloud. Fortinet states that FortiGate-VM can be deployed as a virtual appliance in private and public cloud environments, either as a BYOL instance or provisioned on demand via public cloud marketplaces.
The major public clouds also sell their own firewall services, with nothing to install or patch. Amazon Web Services describes AWS Network Firewall as a stateful, managed network firewall and intrusion detection and prevention service for a virtual private cloud (VPC). Microsoft states that Azure Firewall is a managed cloud-based network security service that protects Azure Virtual Network resources and requires zero maintenance. Google Cloud describes Cloud NGFW as a distributed cloud firewall service that lets customers secure their Google Cloud workloads. Each is described for its provider's own networks, so a multicloud estate needs either one service per cloud or a vendor's virtual firewall in each.
Firewall as a service moves inspection into the vendor's cloud and sends branch and remote-user traffic to it. WatchGuard states that FireCloud connects remote workers through Zero Trust Network Access, Firewall as a Service (FWaaS), VPN and Secure Web Gateway protections. Where a vendor sells both appliances and a service, ask whether one policy and one console cover both.
| Form factor | What you get | What you take on |
|---|---|---|
| Hardware appliance | Dedicated inspection capacity at a site | Sizing, spares, hardware refresh and patching |
| Virtual firewall | The vendor's firewall software in a hypervisor or public cloud | Compute cost, licensing and your own patching |
| Cloud provider service | Managed scaling and maintenance inside one cloud | Coverage limited to that provider; metered charges |
| Firewall as a service | Inspection in the vendor's cloud for branches and remote users | Traffic routed through the vendor's network |
How do you evaluate Next-Generation Firewalls (NGFW)?
Cisco defines a next-generation firewall as a network security device that combines traditional stateful firewall functions with application awareness and control, integrated intrusion prevention, advanced threat detection and user identity awareness. Check Point states that NGFWs incorporate user and machine identity into the security policy, compared with a traditional IP and services port based firewall policy. The definitions agree. The products differ in how well each capability works on your applications and at your traffic volumes.
Application identification is the core of the category. Palo Alto Networks states that PAN-OS includes App-ID, a traffic classification technology that automatically discovers and controls new applications, including those that hop ports or pass through firewalls under encryption. Intrusion prevention runs on the same device. Cisco states that an NGFW includes integrated intrusion prevention, and that some organizations still run a dedicated IPS for specialized or high-throughput segments. Test identification on the applications you care about most, including internal ones the vendor has never seen.
Decryption is where capability, cost and privacy meet. NIST publishes SP 1800-37, Addressing Visibility Challenges with TLS 1.3 within the Enterprise. NIST lists the publication date as September 2025. NIST states that the approach TLS 1.3 uses to achieve forward secrecy may interfere with passive decryption techniques that enterprises rely on for visibility into their TLS 1.2 traffic. Ask each vendor how it inspects TLS 1.3 traffic and what it cannot see. The decryption policy is a legal and privacy decision as well as a technical one. Palo Alto Networks states that admins can choose which traffic to decrypt and which to exempt based on sensitivity or regulatory requirements. Palo Alto Networks states that PAN-OS provides decryption for TLS and SSL encrypted traffic, including TLS 1.3 and HTTP/2. Some products also look for threats in traffic they do not decrypt. Sophos states that two AI-powered detection engines built into Sophos Firewall analyze network traffic for active adversaries and previously unknown threats, including suspicious behavior hidden within encrypted traffic. HPE lists Juniper Advanced Threat Prevention (ATP), including Encrypted Traffic Insights to detect malware hidden in SSL-encrypted traffic.
Size against throughput with inspection on, not the headline firewall figure. Check Point lists its Force 9000 series at up to 25 Gbps of Layer 1-7 threat prevention and up to 400 Gbps of accelerated firewalling. The difference between the two figures is what inspection costs on that hardware. Palo Alto Networks advises running test scenarios with full threat prevention, decryption and logging enabled simultaneously, and notes that some NGFWs advertise high throughput only under ideal conditions. Fortinet states that an NGFW should sustain low latency even with all security services active, and that real-world testing with full threat prevention, logging and decryption ensures performance won't degrade under load. WatchGuard states that its Appliance Sizing Tool recommends the Firebox model that fits a network today and provides headroom to scale.
| Capability | What it does | Buyer translation |
|---|---|---|
| Application identification | Classifies traffic by application rather than port | Ask how new applications are added and how custom applications are defined. |
| User identity | Applies policy by user and group | Test with your directory and with remote-access users. |
| Intrusion prevention | Blocks exploit traffic using signatures and analysis | Amazon Web Services states that Network Firewall uses the open source intrusion prevention system Suricata for stateful inspection and supports Suricata compatible rules. |
| TLS inspection | Decrypts, inspects and re-encrypts traffic | Microsoft states that Azure Firewall Premium includes advanced threat protection features like malware and TLS inspection. |
| Inspection without decryption | Detects threats in encrypted traffic it does not decrypt | Cisco states that its Encrypted Visibility Engine (EVE) blocks threats in encrypted traffic without decrypting, using Talos data. |
| Threat intelligence | Updates signatures and reputation data from the vendor's research | Cisco states that Talos analyzes 900 billion security events every day and distills them into threat protection services for Cisco Firewall. |
| Central management | One policy and one log view across many firewalls | Check Point states that its Unified Security Management provides visibility, policy management, logging, reporting and control across hybrid clouds and on-premises from a single pane of glass. |
| Hardware acceleration | Moves inspection work onto dedicated chips | Fortinet states that its NGFWs are powered by proprietary purpose-built ASICs called Security Processing Units (SPUs). |
Vendors in Next-Generation Firewalls (NGFW)
Representative vendors include Amazon Web Services, Check Point, Cisco, Fortinet, Palo Alto Networks and WatchGuard. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The six approaches below follow two questions: where the firewall runs, and who operates it. Most vendors sell several form factors, and the approach describes the design each one is built around.
Capacity and fleet size separate the approaches. Check Point describes Maestro Hyperscale Firewall as a load balancing firewall cluster that can expand over time to up to 1,000 Gbps of Layer 1-7 advanced threat prevention. Fortinet states that CP9 works as a CPU co-processor, taking on security functions such as application identification, IPS and antivirus. Fortinet states that its centralized management supports 100,000 Fortinet devices, including FortiGates, FortiSwitches, FortiAPs, SD-WAN and FortiSASE. Cisco states that customers can manage their firewalls using its on-premises hardware, any virtual environment, public cloud infrastructure or its cloud-delivered solution. WatchGuard describes WatchGuard Cloud as built for MSPs, giving them one place to deploy, standardize, monitor and report across all their customers.
Other appliance vendors sit close to these approaches. Sophos states that Sophos Firewall shares threat and device-health context with Sophos Endpoint, Sophos Workspace Protection and other connected products, automatically isolating compromised devices. Sophos states that Sophos Firewall is MDR-ready, enabling Active Threat Response to automatically block analyst-identified threats without requiring manual firewall-rule changes. A request for Juniper's firewall page at juniper.net is answered by hpe.com. HPE describes the SRX4100 Firewall as a next-generation firewall (NGFW) that protects small and midsized enterprise campus, data center, and regional headquarters networks. Huawei describes HiSecEngine USG12000 as a terabit-level AI firewall for large data centers and campus networks. Huawei describes HiSecEngine USG6500F series AI firewalls as new-generation AI firewalls for small enterprises, industry branches, and chain business organizations. Sangfor states that Athena NGFW was previously known as Sangfor Network Secure. Sangfor states that Athena NGFW includes its Next-Generation Web Application Firewall (NGWAF) to protect web applications.
| Vendor | Approach | Where it fits |
|---|---|---|
| Amazon Web Services | Cloud provider firewall services | Managed firewall and intrusion prevention for VPC traffic, billed by hour and gigabyte |
| Check Point | Clustered prevention gateways | Gateways that scale by clustering, with unified management across cloud and on-premises |
| Cisco | Firewalls in a networking portfolio | Firewalls backed by Talos threat research, managed on-premises or from the cloud |
| Fortinet | Hardware-accelerated firewalls with built-in networking | Appliances with purpose-built security chips and central management for large fleets |
| Palo Alto Networks | Single-OS firewall platforms | Application identification and decryption built into one firewall operating system |
| WatchGuard | Suites for managed service providers | Firebox security suites managed from a cloud console built for MSPs |
One representative of each approach is named here; the field runs to about twenty vendors, including other appliance makers and firewall-as-a-service providers. Each was selected after the approaches were written, and a place in this table cannot be bought. Firewall vendors, named here or not, can describe their own products in the Spotlight below.
How much should you budget for Next-Generation Firewalls (NGFW)?
An appliance has two costs: the hardware, paid once, and the subscriptions for threat prevention, URL filtering, sandboxing and support, paid every term. Model the subscriptions over the full life of the hardware, since they recur and the hardware does not. Palo Alto Networks advises requesting a breakout of what each license tier includes, and notes that some vendors tie essential functions like decryption or threat prevention to premium licenses. Some vendors tier the operating system itself. HPE lists an SRX4100 Services Gateway configuration with Junos Software Base (Firewall, NAT, IPSec, Routing, MPLS). HPE lists an SRX4100 Services Gateway configuration with Junos Software Enhanced (Firewall, NAT, IPSec, Routing, MPLS and Application Security).
Suite names differ by vendor, so map each tier to the capabilities above before comparing prices. WatchGuard states that its Basic Security Suite offers intrusion prevention, antivirus, URL filtering, application control, spam blocking and reputation checks. WatchGuard states that its Total Security Suite builds on the Prime Security Suite with AI-powered malware detection, ThreatSync (XDR), endpoint security, advanced threat response, network visibility and centralized management through WatchGuard Cloud.
Cloud services are metered. Amazon Web Services states that AWS Network Firewall charges an hourly rate for each firewall endpoint per region and Availability Zone, plus traffic processed, billed by the gigabyte. In a pricing example set in the US East region, Amazon Web Services lists $0.395 for each hour a firewall endpoint is provisioned and $0.065 for 1 GB of data processed by the firewall. Amazon Web Services charges an additional hourly rate per region and Availability Zone for Advanced Inspection when the TLS inspection feature is used. Microsoft states that Azure Firewall has two cost components for each SKU: a fixed deployment charge billed per firewall per hour, and a variable data processing charge billed per gigabyte of traffic processed. The SKU also sets capacity. Microsoft states that Azure Firewall Standard provides Layer 3 to Layer 7 firewall capabilities with autoscaling to manage peak traffic up to 30 Gbps.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Appliance plus subscriptions | Hardware once, security services each term | Model size and services enabled | Renewal prices agreed after the hardware is installed |
| Security suite tiers | Bundled services at each tier | Tier chosen | Decryption or sandboxing only in the top tier |
| Virtual firewall licenses | Licensed capacity or credits, plus cloud compute | vCPUs and instances | Paying the vendor and the cloud provider for the same traffic |
| Cloud provider metering | Endpoint hours and gigabytes processed | Zones deployed and traffic volume | Endpoints left running in every zone; inspection add-ons |
| Firewall as a service | Users, sites or bandwidth | Headcount and branch count | Paying for remote users already covered by another service |
How long does implementation take for Next-Generation Firewalls (NGFW)?
A firewall replacement is mostly a policy migration. Clean up the rule base before moving it, and run the new firewall against real traffic before it enforces. For firewall policy, NIST lists SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. NIST lists the publication date as September 2009.
Export the rule base and traffic logs. Measure peak throughput per site, the share of encrypted traffic, and the number of VPN users. Size against vendor figures with threat prevention and decryption on.
Remove unused and overlapping rules. Rebuild the key rules by application and user. Test the shortlisted products on your own traffic with all inspection enabled.
Start with a low-risk site. Cut over in maintenance windows with a rollback plan, then move to the data center and cloud.
Subscribe to the vendor's security advisories and to KEV updates. Agree a patch window for exploited vulnerabilities, and test each upgrade on a lab or spare unit first.
What should you ask vendors about Next-Generation Firewalls (NGFW)?
Ask each vendor to answer in writing and to demonstrate on your own traffic.
-
Do most of the workloads you must protect run in one public cloud?Yes Start with that provider's firewall service, and compare a vendor's virtual firewall on features and cost.No Shortlist vendors whose appliances, virtual firewalls and cloud versions share one policy.
-
Will a managed service provider run the firewalls?Yes Weight cloud management built for service providers and bundled security suites.No Weight the management console your own team will use every day.
-
Must you inspect large volumes of encrypted traffic?Yes Size on vendor figures with threat prevention and decryption on, and test on your traffic.No Size on threat prevention throughput and keep headroom for decryption later.