Traditional network firewalls examine and control traffic based on ports, but next-gen models add application-layer filtering. “It’s the ability to see the applications traversing your network,” says Dave Stewart, Sourcefire’s director of product marketing. He said the two appliances — the 10 Gbps 3D8140 Next-Generation Firewall Edition and the 20 Gbps 3D8250 Next-Generation Firewall Edition — can recognize more than 1,000 applications, down to granular controls. “And we’ll constantly be adding more,” he added.
“We don’t just identify Facebook, we identify Facebook chat, video and postings, and we can set user groups for Web filtering by URL,” Stewart said, adding that the appliances provide a way to monitor and block what’s occurring across the network, such as learning who’s watching Netflix when they shouldn’t be. The two new Sourcefire appliances also include intrusion detection and protection capabilities, the company’s more traditional product focus.
Sourcefire anticipates that its customers will be working to gradually adapt the context-based application-layer controls to their networks even as they continue to use port-based firewalling, basically operating in dual-mode.
Operating in application-aware and port-based firewalling modes simultaneously has been the customary experience with other firewall vendors’ “application-aware” firewalls, including those from Palo Alto Networks, Check Point and SonicWall.
One limitation in the new Sourcefire firewalls concerns their use in virtualized environments. The appliances cannot yet go deep into the hypervisor layer to inspect traffic which might, for example, be traveling between virtual machines on the same physical machine. But that kind of capability for the VMware environment is expected to be introduced around mid-2012.
Both NGFW appliances, expected to ship Dec. 23, start at US$140,000.