Next-generation firewall (NGFW) inspection is the set of checks a firewall applies to network traffic before allowing, blocking, or logging it. Depending on the product and configuration, those checks can use connection details, identify applications, detect threats, apply user-aware policies, or decrypt selected TLS traffic to inspect its contents. Because the checks sit in the traffic path, they can add latency and use processing capacity; the impact depends on the device, enabled features, traffic, rules, and network design.
What is a next-generation firewall (NGFW)?
An NGFW combines traditional stateful firewall functions with application awareness and integrated security controls. Cisco’s definition also includes intrusion prevention, advanced threat detection, and user identity awareness; individual products do not necessarily implement every capability in the same way. See Cisco’s NGFW overview and Palo Alto Networks’ NGFW guide.
As an Amazon Associate I earn from qualifying purchases.
How is an NGFW different from a traditional firewall?
A traditional stateful firewall typically evaluates connection state and network or transport details such as addresses, ports, and protocols. An NGFW can add application identification and security checks, allowing policy to distinguish traffic by more than its port number. For example, application-aware rules may identify an application that uses a familiar port rather than treating all traffic on that port alike. The exact detection and policy features vary by product.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What does firewall inspection check?
“Inspection” is not one universal switch. It can describe several stages, from checking connection metadata to analyzing payloads. A firewall may enforce network rules on an encrypted connection without being able to read its encrypted contents.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Stateful and network filtering
The firewall tracks connections and evaluates visible attributes such as source and destination addresses, ports, protocol, and connection state. These checks can guide allow, deny, and logging decisions without decrypting application content.
Application identification and policy
Application-aware inspection analyzes traffic to identify applications beyond their port and protocol. The firewall can then apply policies based on the application it identifies. Cisco describes this as identifying applications across network layers; how a particular product classifies traffic depends on its implementation.
Threat inspection
Intrusion prevention and related controls can compare traffic with signatures or other detection logic, then alert or block according to policy. In Azure Firewall Premium, Microsoft describes signature-based intrusion detection and prevention (IDPS); for deeper inspection of encrypted HTTPS content, its implementation requires TLS inspection. That is an example of one product’s design, not a rule that all NGFWs work identically. See Microsoft’s Azure Firewall Premium features implementation guide.
Recommended Free Tools
Rank #2
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
TLS inspection and decryption
HTTPS and other TLS-encrypted traffic hides its payload from network devices that do not decrypt it. Where a firewall supports and enables TLS inspection, it can terminate one encrypted connection, decrypt and inspect traffic, then establish or continue an encrypted connection toward the destination. This creates visibility into selected encrypted content, but requires appropriate certificate trust and configuration and uses computing resources. Microsoft describes this process for Azure Firewall Premium in its TLS inspection documentation.
Consequently, “the firewall inspects traffic” does not by itself mean it can read every encrypted session. Confirm which checks apply to each traffic type and whether TLS decryption is configured.
How can inspection affect network traffic?
Inspection controls sit inline: flows pass through checks before forwarding. Those checks can add response time, consume compute, or constrain throughput under some combinations of features and traffic. Microsoft’s Well-Architected guidance notes that inspection adds latency and that encryption and decryption consume compute cycles. Rule quantity, order, and complexity—and inspecting flows where the checks provide little value—can also waste capacity. The actual effect depends on the configuration and workload, so there is no universal NGFW performance penalty. See Microsoft’s security tradeoffs guidance.
Azure figures illustrate configuration-specific ceilings
Microsoft’s Azure Firewall performance page, last updated March 29, 2026, lists maximum results for particular Azure Firewall Premium use cases. These cloud-service figures are not independent comparisons or general benchmarks for NGFW products:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Azure Firewall Premium use case | Published maximum |
|---|---|
| TLS inspection enabled; IDPS disabled; HTTP/S traffic | 100 Gbps HTTP/S bandwidth |
| TLS inspection enabled; IDPS in Deny mode; TCP/UDP and HTTP/S traffic | 10 Gbps bandwidth |
| Single TCP connection with IDPS in Alert or Deny mode | 300 Mbps maximum for that single connection, not aggregate throughput |
The performance page says its maximums are for the listed use cases, with threat intelligence set to alert or deny and Premium performance boost enabled. They show why feature settings matter in that service; they do not predict another firewall’s capacity. Consult Microsoft’s Azure Firewall performance figures and testing guidance for the conditions and recommendations.
Benchmark the configuration you intend to run
For a capacity decision, test representative traffic and connection patterns on a test network that closely matches expected production conditions. Include the topology, rules, logging, and full set of protections you plan to enable. Measure throughput and latency under realistic load rather than relying only on a product headline or a result from a different feature configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do NGFW inspection and a web application firewall differ?
A network NGFW provides network and application-aware traffic control. A web application firewall (WAF) focuses on protecting web applications at the HTTP layer. They have distinct roles and may both be relevant in a web architecture; a network firewall is not automatically a substitute for a WAF. Microsoft’s Azure reference architecture distinguishes Azure Firewall from Azure Web Application Firewall and illustrates how routing and TLS termination affect what each layer can inspect and whether the application receives the original client IP address. Treat its examples as Azure architecture guidance rather than a universal topology prescription: Azure Firewall and Application Gateway for Virtual Networks.
What to decide before enabling deeper inspection
- Coverage: Identify which traffic directions, network segments, and applications must pass through the firewall.
- Inspection depth: Decide whether policy requires only address and port rules, application identification, threat detection, TLS decryption, or a combination.
- Encrypted-flow policy: Specify which TLS traffic should be inspected or exempted, and plan the certificate trust and configuration required by the chosen product.
- Capacity and response time: Estimate aggregate and per-connection demand with the intended features enabled, and define acceptable latency and throughput.
- Operations: Account for rule complexity, logging, monitoring, and the effort required to maintain inspection policies.
- Web architecture: Determine whether web workloads also need a WAF, and verify how routing and TLS termination affect inspection and preservation of the client address.
Microsoft’s TLS inspection guidance also describes performance monitoring for Azure Firewall; product-specific monitoring and configuration steps differ across vendors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
