Skip to content
Study CCNP

5.4.c Next-generation firewall

2 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

This is a describe objective. The exam wants you to explain what a Next-Generation Firewall (NGFW) adds over a stateful firewall and where it belongs in a design. The short answer: context. An NGFW uses application, user, and threat information, not only addresses and ports.

NGFW versus stateful firewall

CapabilityACLStateful firewallNGFW
Source and destination IPYesYesYes
Ports and protocolsYesYesYes
Connection stateNoYesYes
Application identityNoNoYes
User identityNoNoYes
IPS and threat inspectionNoNoYes
URL, file, and malware controlsNoNoYes

A stateful firewall tracks connections. Return traffic for an allowed session passes automatically. An ACL does not.

An NGFW adds Application Visibility and Control (AVC). AVC identifies the application inside the flow. Two applications on TCP 443 look the same to an ACL. AVC tells them apart.

Zones

NGFW policy works between zones. A zone is a trust level: inside, outside, guest, DMZ. Interfaces join zones. Traffic inside one zone is usually allowed. Traffic between zones needs a policy rule.

Packet crosses a zone boundary (users -> internet)
   |
   v
Zone pair match -> rule match (source, destination, zone)
   |
   v
Application and user context (AVC)
   |
   v
IPS, URL, file inspection if enabled
   |
   v
Allow and log, or deny and log

Traffic between zones with no policy is denied by default.

Example policy in plain language

  • Allow engineering users to reach code repositories over HTTPS.
  • Inspect downloads for malware.
  • Block known command-and-control destinations.
  • Log the user, application, and rule for each decision.
  • Deny everything else between the zones.

Compare this with permit tcp 10.10.10.0 0.0.0.255 any eq 443. The ACL allows HTTPS to anywhere. The NGFW policy allows only the application and users the business approved.

Where NGFWs fit

  • Internet edge.
  • Data center edge.
  • Between internal zones of different trust.
  • Remote access VPN termination.

Put the firewall where traffic crosses a trust boundary. Inspection helps only when the traffic passes through the device.

Exam traps

  • NGFWs are stateful. ACLs are not.
  • Many applications share TCP 443. Port matching alone is weak policy.
  • Threat inspection works only on traffic that crosses the device.
  • Identity-aware rules match users and groups, not only IP addresses.

Pass check

You are ready for this objective when you can do these things:

  • Name three things an NGFW adds over a stateful firewall.
  • Explain what AVC does in one sentence.
  • Explain what a zone is and what happens between zones with no policy.
  • Choose the correct placement for an NGFW in a campus design.

Related objectives