Next-Gen Firewall

What is a Next-Gen Firewall?

A Next-Generation Firewall (NGFW) is a firewall that, in addition to classic filtering on IP address, port and protocol, identifies traffic at application level, ties it to users and checks it for attacks in a single pass with a built-in intrusion prevention system. Where a traditional firewall only sees that port 443 or 502 is open, an NGFW sees which application, which user and which protocol command is behind it. In industrial environments an NGFW sits mainly on the boundary between office IT and OT, where it combines network segmentation, protocol filtering, IDS/IPS and application control.

🧠 Where does the term next-generation firewall come from?

The term became mainstream through an October 2009 note by analyst firm Gartner, Defining the Next-Generation Firewall, by John Pescatore and Greg Young. Their argument: firewalls that only filter on port and protocol are no longer effective, because applications hop across arbitrary ports or hide inside HTTPS. Organisations should choose a firewall with application awareness and an integrated IPS at their next refresh. Vendors such as Palo Alto Networks, founded in 2005, built their product around that idea and made the term popular.

Firewalls have developed in generations:

In practice the line between UTM (a term coined by IDC) and NGFW has blurred: almost every modern firewall from Fortinet, Palo Alto Networks, Check Point or Cisco fits both categories.

🔧 How does an NGFW work?

An NGFW stacks several controls on a single connection:

1. Stateful inspection - the firewall tracks connections in a session table, so only replies to permitted requests come back.
2. Application identification via DPI - Deep Packet Inspection recognises the application by its content, not by its port number. Industrial protocols such as Modbus, S7, DNP3 and OPC UA are identified the same way.
3. Protocol Filtering and Application Control - rules per function: with Modbus TCP, for example, allow read requests (function codes 1 to 4) and block write requests (5, 6, 15 and 16).
4. User identity - the firewall maps IP addresses to accounts via Active Directory/LDAP logons, RADIUS accounting, an agent or a login portal. That is how user-based access control works, the identity-driven form of access control; 802.1X can serve as a source, but it mainly authenticates the network port itself.
5. Intrusion prevention - a built-in IPS compares traffic against signatures of known exploits, supplemented by threat intelligence feeds on malicious IP addresses and domains.
6. TLS inspection - the firewall can decrypt encrypted web traffic, inspect it and re-encrypt it, provided the clients trust the firewall’s certificate.
7. Logging and reporting - events go to a SIEM for security monitoring and anomaly detection, and provide an audit trail.

🏭 Where do you place an NGFW in an OT network?

An NGFW belongs mainly on the major transitions in the Purdue Model, not in every machine cabinet:

At cell level, close to the controllers, an industrial firewall is often the better choice: DIN-rail mounting, 24 V DC and a wide temperature range. Many vendors now offer “rugged” NGFWs that combine both worlds. The engineering network also deserves its own zone, because engineering workstations can download logic to PLCs.

📏 How do you size an NGFW?

Datasheets usually quote several throughput figures. The highest, firewall throughput, applies to simple stateful filtering with large packets. As soon as application control, IPS and anti-malware are switched on, throughput drops sharply. An example from the datasheet of a ruggedised OT firewall, the FortiGate Rugged 70G:

So size on the threat protection figure and keep headroom for TLS inspection, which is very processor-intensive. OT traffic is usually modest in volume, but consists of many small packets with tight timing requirements; latency and jitter then matter more than bandwidth, especially for real-time communication.

⚙️ How do you approach an NGFW rollout in OT?

1. Inventory first - without an asset inventory you cannot know which communication is legitimate.
2. Start in monitor mode - let the NGFW log for a few weeks and learn which applications and function codes are really needed.
3. Build an allowlist per application - permit named applications and functions and block the rest; avoid “any” rules.
4. Set IPS signatures to detect first - a false positive on a control connection can stop production.
5. Tie identity to access - especially for external vendors via remote access.
6. Formalise changes - record rules through firewall rule management and change management.
7. Plan updates and redundancy - signature updates can run daily, firmware updates in maintenance windows, preferably on a high-availability pair.

🔐 What do standards and legislation require?

• IEC 62443-3-3 - system requirement SR 5.1 calls for network segmentation and SR 5.2 for zone boundary protection; from Security Level 3 a boundary must fail closed.
• NIST SP 800-82 Rev. 3 (September 2023) - the US guide to OT security recommends firewalls between IT and OT, with a DMZ and rules as strict as possible.
• Cybersecurity Act - the Dutch implementation of NIS2 (Cyberbeveiligingswet) entered into force on 15 August 2026; its duty of care includes appropriate network security, and a well-managed NGFW is a common way to deliver it.
• Cyber Resilience Act - firewalls and intrusion detection and prevention systems are listed in Annex III as important products of class II, so manufacturers cannot rely on self-assessment alone. Reporting of actively exploited vulnerabilities applies from 11 September 2026, full application from 11 December 2027.

⚠️ What are the limitations of an NGFW in OT?

• Not every NGFW is OT-aware - the depth of industrial protocol decoders varies widely between vendors.
• Encrypted OT traffic - binary OPC UA (opc.tcp) with SignAndEncrypt uses its own security layer, not TLS; an NGFW cannot open such traffic and only sees that it is OPC UA.
• Processing load and latency - inspection costs time and capacity, especially with TLS inspection enabled.
• Dependent on updates - signatures and application databases must stay current, which is awkward in isolated networks.
• The firewall itself is a target - vulnerabilities in firewall software are regularly exploited in the wild, so patching and hardening of the firewall itself are required.
• No substitute for defence in depth - combine it with EDR, NDR and a data diode where one-way traffic is enough.

❓ Frequently asked questions

What is the difference between an NGFW and a regular firewall?

A regular stateful firewall judges traffic by IP address, port and connection state. A next-generation firewall also identifies the application, the user and the content, and blocks known attacks with a built-in IPS. As a result an NGFW can, for example, allow Modbus read requests and refuse write requests on the same port.

Is an NGFW the same as an industrial firewall?

No, NGFW describes the functionality, while industrial firewall describes the build and the field of use. Industrial firewalls are ruggedised, mount on a DIN rail and are made for OT protocols close to the machine. Many modern industrial firewalls are NGFWs at the same time, and many NGFWs now understand OT protocols.

Can an NGFW inspect encrypted traffic?

An NGFW can decrypt TLS traffic when the clients trust the firewall’s certificate, but this takes a lot of processing power. Industrial protocols with their own security layer, such as OPC UA with SignAndEncrypt, cannot be decrypted by an NGFW. For that traffic the NGFW is limited to recognising the protocol and filtering on source, destination and user.

Where do you place an NGFW in the Purdue model?

An NGFW usually sits between the enterprise network and the industrial DMZ at level 3.5, and between that DMZ and the supervisory network. That way no session runs directly from IT to PLCs. Closer to the control layer, compact industrial firewalls per zone or cell are often used instead.

How much throughput does an NGFW need in a plant?

Size an NGFW on its threat protection throughput with all security services enabled, not on the highest firewall figure in the datasheet. That figure can be five times lower or more. OT traffic is rarely large in volume, but latency and predictability weigh heavily.

Is an NGFW mandatory under the Dutch Cybersecurity Act?

The Dutch Cybersecurity Act does not prescribe a specific product, but it does require appropriate measures for network security and risk management. A well-configured NGFW on the IT/OT boundary is a common way to meet that requirement. Supervisors mainly look at segmentation, rule management, logging and whether the measures match the risk.

📌 In summary

A next-generation firewall sees not only ports but also applications, users and protocol commands, which makes it a strong control on the boundary between IT and OT.

Since Gartner defined the term in 2009, the NGFW has become the standard for enterprise networks. In OT it adds most value at the transitions to the industrial DMZ and for remote access, provided it understands OT protocols, is sized on the right throughput and is first tuned in monitor mode. It does not replace segmentation, industrial firewalls or sound patching, but it is an important security layer in a layered cybersecurity architecture.