Firewall security: the decisions behind an enterprise firewall

What a firewall and a next-generation firewall (NGFW) do

NIST SP 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy, was published in September 2009.¹¹

It describes these firewall types, among others.

• Packet filtering and stateful inspection. A stateful firewall tracks each connection in a state table, so it can tell whether a packet belongs to a session it already allowed.¹²
• Application firewalls. Stateful protocol analysis, which some vendors call deep packet inspection, adds an engine that compares application-layer protocol behavior with profiles of benign activity.¹³
• Unified threat management (UTM). One system combines the firewall with malware detection and other functions. NIST notes the tradeoff: that system needs enough CPU and memory to handle every task assigned to it.¹⁴

NIST SP 800-215 (November 2022) defines the next-generation firewall by application awareness. An NGFW reads traffic at layer 7 as well as layers 3 and 4. Its listed capabilities are deep packet inspection, TLS decryption with inspection of the payload, and intrusion prevention.^15,16

A web application firewall (WAF) sits in front of web servers and detects attacks carried in HTTP, and NIST notes it is often considered very different from a traditional firewall. NIST SP 800-215 describes web application and API protection (WAAP) as an enhancement over WAF that adds API security, bot defense and DDoS protection.^17,18,19

Where enterprise firewalls sit: perimeter, data center, cloud and SASE

NIST noted in 2009 that attacks sent from one internal host to another often do not pass through network firewalls, and that designers were already placing firewall functions away from the perimeter.²⁰

Structural features NIST lists for SASE offerings include a private backbone of points of presence around the world, meant to keep latency down, and a security agent on the user's device that makes networking decisions and directs application traffic.^27,29

Our pages on firewall security

• Next-Generation Firewalls (NGFW)Buyer Guide
• Web Application Firewall (WAF)Buyer Guide
• Zero Trust Network Access (ZTNA)Buyer Guide
• Fortinet vs Palo Alto NetworksComparison
• Zscaler vs Palo Alto NetworksComparison
• AWS WAF vs CloudflareComparison
• RFP questions: Web Application Firewall (WAF)RFP questions
• Vulnerability managementPage
• Secure and complyJob

Firewall vulnerabilities: why edge devices are the target

Joint guidance published in February 2025 by Canada's cyber security agency, with contributions from CISA and agencies in Australia, New Zealand and the UK, says targeting edge devices has become a tactic of choice for many threat actors, including state-sponsored ones. It covers firewalls, VPN gateways and routers. These devices usually have public IP addresses reachable from anywhere. CISA adds that edge devices have extensive reach into the network and integrate with identity management systems.^{4,5,30,31,32,33}

The catalog held 1,769 entries in that release. The joint guidance cites a 2024 CISA report that Volt Typhoon exploited CVE-2022-42475 in an unpatched FortiGate 300D perimeter firewall and used it to compromise a domain admin account stored on the device.^41,42

Firewall throughput with threat prevention turned on

Both datasheets below list a headline firewall figure and a lower figure with inspection enabled. The figures below are vendor-stated. Each vendor tests with its own traffic mix and feature set, so they do not compare across vendors.^{43,44,45,46,47}

On Palo Alto's figures, turning on threat prevention leaves 53% of firewall throughput on the PA-1410 and 65% on the PA-1420. NIST SP 800-41 lists performance among the considerations in selecting a firewall, along with integration into existing network and security infrastructure.^43,49

Firewall rule review, policy hygiene and PCI DSS

NIST SP 800-41 says the firewall policy belongs in the system security plan and should be updated as new classes of attack appear or application needs change. Rulesets should go through formal change management, with ruleset reviews or tests performed periodically. The 2025 joint guidance on edge devices asks for two or more people to review a change before it is made, and for security rules to be reviewed routinely, more often on a more dynamic network.^10,50,51,52

PCI DSS sets a fixed interval. Requirement 1.2.7 in version 4.0 calls for configurations of network security controls (NSCs) to be reviewed at least once every six months. The PCI Security Standards Council lists a missed six-month review as an example of a missed periodic requirement.^53,54

Firewall hardening, patching and end-of-support replacement

The February 2025 joint guidance lists these mitigations for firewalls and other edge devices.

• Patch as quickly as possible after testing on a standby or test device, on an automated or monitored schedule.⁹
• Keep network management interfaces off the direct internet.⁵⁵
• Require phishing-resistant MFA for all administrative access.⁵⁶
• Send logs off the device to a central store, at the most detailed level available.⁵⁷
• Keep an inventory of edge devices with their support timelines.¹⁰

Binding Operational Directive 26-02, issued February 5, 2026, gives federal civilian agencies 18 months to decommission end-of-support edge devices and replace them with vendor-supported ones that receive security updates. CISA states that it is aware of widespread exploitation campaigns by advanced threat actors targeting such devices.^58,59,60

What firewall security costs to buy and run

The PA-1400 datasheet shows what Palo Alto Networks prices apart from the hardware. Security subscriptions are enabled on top of the appliance, and virtual systems above the base quantity need a separately purchased license.^61,62

AWS publishes its firewall rates. In AWS's own example for US East (N. Virginia), AWS Network Firewall costs $0.395 for each hour an endpoint is provisioned and $0.065 per GB processed.^63,64

A second AWS example puts two endpoints in separate Availability Zones for high availability. Endpoint hours come to $568.80 a month, and processing 5,000 GB adds $325. TLS inspection carries an additional hourly charge per Availability Zone, which AWS lists at $0.489 an hour in Europe (Ireland).^65,66,67,68