The purpose of this article is to share the top 7 NGFW firewalls that will dominate the market in 2023. Firewalls have come a long way over the past ten years. They have evolved into what’s called “Next-Generation Firewalls” and even those have made significant advances in the last five years. Many firewalls have recently been racing to add or enhance their SD-WAN capabilities. They have been increasing their ability to protect cloud workloads like Salesforce.com and dropbox with SASE solutions. Firewall vendors are also adding contextual data and policies around user identity, applications, content and data.
This list of firewalls highlights some of the most used and significantly important features from the global firewall leaders. Some may not have been listed due to market-share or feature set, but that does not mean that they don’t serve their own unique value. The firewall vendors listed here are in no particular order.
Disclaimer: please note that if a feature is not listed that it does not mean the vendor does not have it. It just means that it’s not listed, which could be due to several reasons (e.g. most firewalls today have IDS/IPS). Additionally, vendors continually upgrade their products to include new features and information can become outdated quickly.
Fortinet FortiGate Firewalls (NGFW)
For several reasons including SD-WAN capabilities, Fortinet leads the pack for best firewalls in 2022. It is a layer-7 application firewall, which means that it inspects all layers of the OSI model, including the application layer. This is different from other firewalls that just inspect the network and transport layers (layers 3 and 4). Fortinet was recently named a leader in the 2022 Gartner(R) Magic Quadrant(TM) for SD-WAN for the third consecutive year.
Fortinet also leverages several enterprise routing features, including:
- Dynamic and Advanced static routing
- Enterprise routing stack (BGP, OSPF, RIP)
- Traffic shaping
- High availability modes: active-passive; active-active, VRRP and includes redundant heartbeat interfaces
FortiGate Top 5 SD-WAN Features:
- Multi-path control
- Application Awareness
- Dynamic application steering
- Secure SD-WAN
- Multiple link options including LTE/4G/5G connections
On top of its enterprise routing features, Fortinet (FortiGate) firewalls have matured cybersecurity capabilities against competitors like Cisco Meraki and are on par with mature industry leaders like Palo Alto and Check Point.
Fortinet has the following unique cybersecurity features that others may lack:
- SSL/TLS deep packet inspection
- Ability to scan files greater than 5 MB for malware
- Security with mobile IPSec VPN
- Native integrations with other Fortinet products like FortiAnalyzer and FortiEDR
Part of Fortinet’s “secret sauce” for SSL/TLS deep packet inspection is that the processing of traffic is offloaded to a different ASIC. The ASIC is a performance-built processor designed specifically to manage this type of workload. More details on native-specific features of FortiGate firewalls can be found here.
Contact a Firewall Specialist
If you prefer to talk to a firewall specialist who can help you find a firewall solution based on your goals and environment, please fill out the form below (U.S. based only).
Palo Alto Next-Generation Firewalls (NGFW)
Palo Alto next generation firewalls focus on prevention. They are also considered layer-7 application firewalls and have been named a Gartner(R) Magic Quadrant(TM) Leader for 10 years in a row. Palo Alto firewalls are unique in that they are based on three core elements:
- User
- Application
- Content
Its key capabilities include user-ID, and app-ID. That essentially means that you can monitor and filter user traffic. You can answer questions like:
- What applications or users are causing network congestion?
- Which users have been denied access to which destinations?
- What applications are used most by users?
Palo Alto top features include:
- Support for BGP, OSPF, RIPv2, Static Routing
- Traffic shaping
- High availability: active-active or active-passive
- SD-WAN (Prisma SD-WAN is an add-on subscription)
- GlobalProtect VPN (additional license required for advanced features)
- Deploy on premise or in the cloud
- URL Filtering (advanced URL filtering requires subscription)
- Application Control
- Threat prevention (e.g. gateway antivirus – requires subscription)
- DNS Security (requires subscription)
Contact a Firewall Specialist
If you prefer to talk to a firewall specialist who can help you find a firewall solution based on your goals and environment, please fill out the form below (U.S. based only).
CheckPoint
CheckPoint is an industry leader and pioneer in firewall technology. They have the claim to stateful inspection as well as one of the world’s first VPN solutions. CheckPoint’s global headquarters is in Tel-Aviv, Israel and was founded by Gil Schwed, who had worked in Unit 8200 (Israeli Intelligence) before starting CheckPoint. CheckPoint has gained prominence as one of the world’s foremost firewall solutions.
Today, their firewall is known as the Quantum Security Gateway solution. Its architecture is based on three core elements:
- Smart Console: This is the management GUI
- Security Management Server: Runs software blades (i.e. modules)
- Security Gateway: This is the actual firewall that runs inspection and enforces policies
CheckPoint firewalls have a lot of features you can add or bundle as software packages. Some features come in ‘software blades’ which are modules you add on. These are sold separately or included in software bundles. There are a lot of additional software blades you can run
CheckPoint Top Features:
- Advanced Routing (includes BGP, OSPF, RIP)
- IPS
- VPN and VPN Client
- Alerting and Reporting gives you the ability to tune configuration settings to enhance security posture
- Deploy on-premise or in the cloud
- URL Filtering
- Anti-spam (based on analyzing known and emerging distribution patterns, IP reputation, and user-defined).
- Identity Awareness (requires additional software blade) provides user identification and user-based policies
- ISP Redundancy (load sharing or primary/backup; note this is not SD-WAN)
- Application Control (software blade that identifies, allows, or blocks applications based on a library list of ~4,500)
- Data Loss Prevention (software blade)
- High availability – Software-based cluster that provides High availability (load sharing or primary/backup – requires additional software blade and appliance)
Cisco FirePower
Cisco FirePower firewalls are an evolution from their Sourcefire acquisition in 2013 and the current upgrade path for customers using Cisco ASA firewalls (Meraki is another option as well). FirePower firewalls are considered enterprise grade firewalls and support all the enterprise routing features you would expect: BGP, OSPF, etc. You can design your FirePower solution with HA in Active-Standby. Active-Active is not supported. All management is done through the FireSight Management Console (FMC). Individual site-level configurations cannot be implemented and feed back to HQ so you must manage it with FMC. SD-WAN is also not supported and you need an additional third-party solution like Cisco SD-WAN.
Cisco FirePower Top Features:
- Supports routing protocols BGP, OSPF, RIPv2
- Supports Active-passive High-Availability mode
- AnyConnect VPN (requires additional licensing)
- Content Restriction
- Integration with Cisco ISE (Cisco ISE sold separately)
- Deep Packet Inspection
- On Premise Sandbox (requires additional appliance)
- Malware Defense (requires additional license)
- IPS
- Sensitive Data Protection (DLP, up to five sensitive data types plus custom patterns)
Sophos XG / UTM
Sophos is a firewall and security product company headquartered in Abingdon, England. They are owned by Private Equity firm Thoma Bravo. Sophos firewalls have a lot of enterprise-grade features you would expect to see out of the box from a firewall. They have a great web-based management interface and provide a lot of good public-facing documentation around their products.
Top Sophos Features:
- Enterprise routing features (BGP, OSPF, RIP, IPv6 support, Static and Dynamic Routing)
- Content and application filtering, visibility and control
- Deep packet inspection
- Cloud sandbox
- Gateway antivirus
- Web protection
- User based policies
- IPS
- SD-WAN included natively
- Policy-based data loss prevention (DLP)
- Web application firewall
- High availability in active-active and active-passive modes
- Integrates with Sophos Intercept-X (antivirus)
WatchGuard
WatchGuard was founded in 1996 and is headquartered in Seattle, Washington and is currently owned by a Private Equity firm. They have had several acquisitions over the past ten years, which has led to their expansions into products like Wi-Fi, MFA and endpoint security. They are a good firewall for small businesses under 50 users as well as can meet some mid-market and enterprise needs.
Top WatchGuard Features
- Enterprise routing features (BGP, OSPF, RIP, IPv6 support, Static and Dynamic Routing)
- SSL/TLS Deep packet inspection
- VPN
- SD-WAN
- IPS
- Application control
- Web content filtering
- Anti-spam
- Gateway antivirus
- DNSWatch
- Threat Detection and Response
- APT Blocker
- Network Discovery
- WatchGuard Cloud Visibility and Data Retention
- High availability modes include active-active and active-passive
WatchGuard firewalls have a strong reputation in the firewall space for being a functionally good firewall. However, they lack sophisticated SD-WAN features that other firewalls have such as dynamic path selection and application steering.
Contact a Firewall Specialist
If you prefer to talk to a firewall specialist who can help you find a firewall solution based on your goals and environment, please fill out the form below (U.S. based only).
SonicWall
SonicWall was founded in 1991 and is headquartered in Milipitas, California. They have enjoyed a lot of success in the firewall industry. It was purchased by Dell in 2013, and then sold in 2016 to the same company that bought WatchGuard, Francisco Partners. SonicWall is known mostly in the SMB and Mid-market space with some deployments in the enterprise.
SonicWall firewalls are managed through Network Security Manager (NSM).
Top SonicWall Features
- Enterprise routing stack (BGP, OSPF, RIP)
- Static and dynamic routing
- High availability: active-active and active-passive
- SD-WAN
- Gateway antivirus
- Content Filtering
- Anti-spam
- IPS
- VPN
Top 7 NGFW Firewalls in Review
The focus of this article was to provide a list of top features for each firewall and some context into how its delivered (e.g., module vs natively included). Attempts were made to list out features that were sold as a subscription or a separate license.
Each firewall has its strengths and certainly there are issues with each one as well. Common firewall issues include bugs, support queues, and documentation. These are universal issues for all vendors. Users have different preferences and administration, and user-interface are one of those things that you just need to experience in order to come to an opinion for yourself. Just because one person has a bad experience with an interface does not mean you will have that same experience or frustration. A lot of having a good experience with a firewall solution comes down to training.
Additionally, just because a firewall vendor has had a security incident or a vulnerability, does not mean their product is worthless. The fact of the matter is that all firewall vendors and solutions will have a vulnerability or security incident. What matters the most is how they deal with it and how they treat their customers right.
Contact a Firewall Specialist
If you prefer to talk to a firewall specialist who can help you find a firewall solution based on your goals and environment, please fill out the form below (U.S. based only).