Lesson 1.1c: Next-Generation Firewalls (NGFW) and IPS

Next-Generation Firewalls (NGFW) and Intrusion Prevention Systems (IPS) are essential components of modern network security architecture. The combination of these technologies provides flexible access control and protects systems against increasingly sophisticated cyber threats.

1. Overview of Next-Generation Firewall (NGFW)

1.1. NGFW Concept

A Next-Generation Firewall (NGFW) is an advanced network security device that combines the capabilities of a traditional firewall with deep packet inspection and advanced traffic control.

While traditional firewalls primarily filter traffic based on fundamental parameters at Layer 3 and Layer 4 (Network and Transport Layers) such as:

• Source and Destination IP addresses
• Protocol
• Port number
• Connection state

NGFW expands these capabilities by incorporating application awareness, user identity, content inspection, and threat detection.

In short: NGFW not only determines communication permissions based on IPs and Ports but also granularly controls which users are utilizing which applications, whether the transmitted content is safe, and if the traffic contains any signs of attack.

1.2. Role of NGFW in Network Architecture

NGFWs are typically deployed at strategic control points within the network infrastructure, including:

• The boundary between the internal network (LAN) and the Internet
• The connection between a Branch office and a Wide Area Network (WAN)
• The perimeter between the Data Center and the internal network
• The separation point between the User VLAN and the Server VLAN

The primary roles of an NGFW include:

• Strictly controlling inbound and outbound network traffic.
• Applying and enforcing security policies between security zones.
• Protecting users and server systems against malicious data flows.
• Logging, continuous monitoring, and providing data for incident investigation.
• Centralizing multiple advanced security functions onto a single platform.

2. Comparing Traditional Firewalls and NGFWs

To understand the superiority of NGFW, it’s crucial to grasp the operating principles of traditional firewalls.

2.1. Traditional Firewall

Traditional firewalls operate primarily based on two mechanisms:

• Packet Filtering: Inspects each packet independently based on header information (IP, Port, Protocol).
  • Example: Permit TCP from 192.168.1.0/24 to anywhere on port 443; Deny Telnet (port 23).
• Stateful Inspection: The firewall tracks the state of network connections. When an internal device initiates a valid outbound connection, the firewall automatically permits the return traffic from the external server without requiring a reverse rule configuration. The firewall understands the context of the connection rather than just inspecting isolated packets.

2.2. The NGFW Difference

NGFW does not replace but extends the features of a traditional firewall by inspecting deeper into the packet’s payload.

Simulation: So sánh Stateful Firewall và NGFW

3. Core Features of NGFW

3.1. Application Visibility and Control (AVC)

Instead of relying solely on port numbers, an NGFW can accurately identify the running application. This is particularly crucial as many modern applications communicate over standard ports like TCP 80 or 443.

• Example: An NGFW can distinguish regular HTTPS web browsing from traffic belonging to Facebook, YouTube, Microsoft Teams, or VPN applications.
• Policy Application: An organization can allow Microsoft 365, permit YouTube for the Training department, and completely block unauthorized VPNs or online gaming.

3.2. User and Identity Awareness

NGFW integrates robustly with identity management systems (such as Active Directory, LDAP, RADIUS, SAML/SSO). Instead of applying policies based on IP addresses (which can change due to DHCP), security policies are tied directly to user identities or groups.

• Example: The HR group is allowed to access the payroll server; the Guest group can only access the Internet; the IT administrators have SSH access to internal servers.

3.3. URL Filtering

The ability to control web access based on URLs or predefined categories.

• Benefits: Prevents access to malware sites, phishing pages, or websites that violate organizational policies (e.g., gambling, inappropriate content).

3.4. Intrusion Prevention Integration

NGFWs feature a built-in IPS engine. It goes beyond access rights (allow or deny) by analyzing traffic content to detect exploits.

• Detection Capabilities: SQL Injection, Command Injection, Port scans, and Command-and-Control (C2) botnet traffic.

3.5. Malware and File Inspection

An NGFW can inspect files (such as .exe, .pdf, .docx, .zip) transmitted across the network. The system calculates a hash and checks it against a threat database, or analyzes the file’s behavior via a Sandbox to detect and block malware/ransomware before it reaches end-user devices.

3.6. SSL/TLS Inspection

A vast majority of today’s internet traffic is encrypted (HTTPS). To inspect the underlying content, the NGFW acts as a Proxy (a controlled Man-in-the-Middle). The device decrypts the traffic, performs security checks, then re-encrypts and forwards it to the destination.

3.7. Threat Intelligence

NGFWs continuously receive updates on the latest threats from security organizations (e.g., Cisco Talos). This helps the system react swiftly to malicious IP addresses, botnet domains, or newly discovered attack campaigns.

3.8. Logging and Reporting

NGFW continuously logs detailed information regarding every traffic flow and security event traversing the device. Log details usually include: IP address, user, application, URL, action taken (allow/block), and threat alerts.

• Benefits: Provides comprehensive visibility for administrators, highly supporting network security monitoring, troubleshooting, security incident investigation, and compliance requirements.

4. Intrusion Prevention System (IPS)

4.1. IPS Concept

An IPS (Intrusion Prevention System) is a dedicated system for detecting and preventing cyberattacks or malicious traffic flows. Unlike older architectures, an IPS is typically deployed Inline (directly in the traffic path), meaning all network traffic must pass through the IPS device.

In short: An IPS doesn’t just monitor and alert on attacks; it actively intervenes and stops attacks in real-time.

4.2. Comparing IDS and IPS

Sơ đồ: Kiến trúc IDS (Out-of-band) và IPS (Inline)

4.3. IPS Detection Mechanisms

IPS employs multiple methods to identify malicious traffic:

• Signature-Based Detection: Compares network traffic against a database containing “signatures” of known attacks (similar to antivirus software). This mechanism is highly accurate with few false alarms but cannot detect new (Zero-day) attacks.
• Anomaly-Based Detection: Establishes a baseline of normal network behavior. Any significant deviation from this baseline (e.g., a server suddenly receiving 50,000 connections/minute instead of 500) is flagged as an anomaly. It can detect novel attacks but has a higher rate of false positives.
• Policy-Based Detection: Manually configured rules to block behaviors violating internal policies (e.g., blocking insecure protocols like Telnet, or blocking traffic to a specific country).

4.4. IPS Response Actions

Upon detecting an incident, the IPS can execute the following actions:

• Drop packet: Discard the malicious packet.
• Block connection: Terminate the entire connection flow.
• Reset TCP session: Send an RST flag to terminate the TCP connection between endpoints.
• Block source IP: Temporarily add the attacking IP address to a blacklist.
• Generate alert & Log event: Create an alert and record the event to send to a centralized management system (SIEM).

5. The Synergy Between NGFW and IPS

In modern network architectures, the IPS is often integrated as a functional module within an NGFW device (e.g., Cisco Firepower Threat Defense).

• NGFW acts as the “gatekeeper,” enforcing macro-level policies: Who gets access? Which applications are allowed? From which zone to which zone?
• IPS functions as the “analytical expert,” delving into the connections permitted by the NGFW to answer: Does this data flow contain an exploit? Does it contain malware?

Example of a complete Policy: Allow the HR group (User) to access Web applications (App) on the Internet (Zone), but apply IPS inspection (IPS Profile) to prevent malware and send Logs to the server.

6. Real-World Deployment Scenarios (Case Studies)

To better understand the flexibility of NGFWs, here are some common real-world scenarios:

Simulation: NGFW Decision Pipeline

6.1. Deep Application Control

Instead of struggling when multiple applications share a single port (like TCP/443), NGFW enables multidimensional policy enforcement:

• Allow regular HTTPS web browsing.
• Permit access to the Microsoft 365 ecosystem for work.
• Block traffic related to online gaming or firewall-evading VPN tools.

6.2. Identity-Based Access Control

With Active Directory integration, organizations can establish policies independent of static IP addresses:

• IT Admins Group: Permitted to use administrative protocols (SSH, RDP) to access the Server zone.
• HR Users Group: Permitted to access specific internal applications.
• Guest Users Group: Only allowed Internet access, completely blocked from the internal LAN.

6.3. Preventing Public Service Exploits

When a Web server is exposed to the Internet, the NGFW combined with IPS forms the core defense:

• An attacker attempts to send a query containing an exploit (e.g., SQL Injection).
• The IPS analyzes the payload and identifies a match with an attack signature.
• The device immediately drops the packet, resets the connection, and generates a security alert to the SIEM system.

7. Key Distinctions

In practical deployment and within the CCNA standard, several core boundaries must be noted:

• The difference between NGFW and a Layer 7 Firewall: An NGFW is not simply a Layer 7 inspection firewall. It is a comprehensive solution encompassing stateful inspection, application awareness, user awareness, threat prevention, and URL filtering working tightly together.
• Confusion between IDS and IPS: Despite sharing the same technological foundation, their operational roles are opposites. IDS operates passively, focusing on Detect and Alert. Conversely, IPS operates actively (Inline), responsible for Detect and Prevent.
• Limitations of Signature-based Detection: While providing high accuracy against known threats, signature-based methods are completely ineffective against novel, previously unseen attacks (Zero-day exploits).
• Optimizing IPS Rules: Enabling too many rule sets or applying overly strict IPS policies can lead to False Positives (accidentally blocking valid traffic), increase network latency, and degrade the overall performance of the device.

8. CCNA Core Content Summary

NGFW is a next-generation security policy enforcement device that determines access rights through granular control based on application, user, content, and backing from Threat Intelligence. IPS is a system that delves into network traffic to detect and proactively prevent exploits and malware in real-time.