# What Are Firewall and NGFW? Corporate Network Security and Firewall Hardening **URL:** https://securesys.com.tr/en/learning/network-security/what-are-firewall-and-ngfw ![What Are Firewall and NGFW? Corporate Network Security and Firewall Hardening](/images/bilgi-merkezi/covers/cover-network-02.webp) The firewall is one of the most fundamental components of corporate network security. However, in many organizations the firewall is still managed only through the question: **"which IP should be able to reach which port?"** through that question. Yet in modern networks this approach is not sufficient on its own. Today's network environments; cloud, remote access, SaaS, mobile device, third-party connection, IoT, data center, branch office host a large number of access models such as these at the same time. For this reason firewall technologies too have evolved from the classical packet filtering structure into a more advanced security layer. A modern firewall does not only check IP and port. At the same time; application, user identity, URL category, threat signature, TLS traffic, malware indicator it can decide over far more context such as this. These advanced structures are most often called: #### NGFW - Next-Generation Firewall as they are known. In corporate network security the fundamental task of the firewall is: **to control the traffic between trusted and untrusted network zones according to security policies, to reduce the attack surface and to block unnecessary network access.** However, a good firewall is not created merely by choosing a strong product. What really makes the difference is; **the right architecture, the right policy, the right segmentation, regular rule review and secure configuration management.** ### What Is a Firewall? A firewall is the network security system that permits, blocks or analyzes the traffic between different network segments according to certain security rules. A simple example: User Network → Database Network → DENY Application Server → Database Network → ALLOW Thanks to this structure all users can be prevented from reaching the database directly. ### Why Is a Firewall Necessary? All devices inside the network being able to reach one another without limit creates serious security risk. A firewall; internet access, server access, the traffic between network segments, remote connections, third-party access can be used to control these. ### What Does a Firewall Protect? A firewall can help protect the following areas: Internal Network Data Center DMZ Cloud Network Branch Office Remote Users Critical Servers ### Is a Firewall Enough on Its Own? No. A firewall is an important security layer but on its own it cannot block every attack. Modern network security; Firewall NAC NDR EDR SIEM SOC Zero Trust requires multi-layered controls such as these. ### What Is a Packet Filtering Firewall? A packet filtering firewall checks network packets according to certain header information. For example: Source IP Destination IP Protocol Port ### An Example Packet Filtering Rule Source: 10.10.10.0/24 Destination: 10.20.20.15 Port: 443 Action: Allow ### What Is the Limit of Packet Filtering? It cannot understand application behaviour. It decides on a port basis only. ### What Is a Stateless Firewall? It is the firewall structure that evaluates every packet independently of the other packets. ### What Is a Stateful Firewall? It is the firewall architecture that tracks the state of the connection. ### What Is Stateful Inspection? It is the firewall tracking the start, continuation and closing state of a connection. ### Why Is a Stateful Firewall More Powerful? It can evaluate the connection context rather than individual packets. ### What Is a State Table? It is the table in which active connections are held on the firewall. ### What Is State Exhaustion? It is the excessive overloading of the firewall's connection table capacity. ### Can State Exhaustion Create a DoS Risk? Yes. A very high number of connections can consume firewall resources. ### Why Is Firewall Performance Important? If firewall throughput and connection capacity are insufficient the security control can create a network bottleneck. ### What Is NGFW? NGFW: #### Next-Generation Firewall is the firewall technology that offers advanced application and threat detection capabilities in addition to traditional firewall features. ### What Features Can an NGFW Offer? For example: Application Control Intrusion Prevention URL Filtering TLS Inspection User Identity Malware Detection Threat Intelligence ### What Is the Difference Between a Traditional Firewall and an NGFW? A traditional firewall mostly works over: IP Port Protocol these. An NGFW, in addition to these, can provide: Application User Content Threat this context. ### What Is Application Control? It is the analysis and control of network traffic according to the application being used. ### Why Is Application Control Necessary? Many modern applications use the same port. For example, over TCP/443: Web SaaS File Sharing Remote Access different applications such as these can run. ### Does Port 443 Being Open Mean That It Is Secure? No. Port 443 only shows that there may be TLS/HTTPS traffic. The content must be analyzed separately. ### What Is Application Identification? It is the firewall trying to determine which application the traffic belongs to. ### What Is an Unknown Application? It is application traffic the firewall cannot identify. ### Should Unknown Traffic Be Monitored? Yes. Unknown or custom protocols must be examined from a security point of view. ### What Is a Security Zone? It is the separation of network segments into logical groups according to their security level. ### Example Security Zones Internet DMZ User Server Database Management Guest ### What Is a Zone-Based Firewall Policy? It is the definition of firewall rules according to the traffic between zones. ### Why Is Zone Separation Important? It makes policy management more understandable and provides segmentation. ### What Is a Trust Zone? It is the network segment accepted as more trusted. ### What Is an Untrust Zone? It is the untrusted network region, generally the internet. ### Should the Internal Network Be Completely Trusted? No. The modern Zero Trust approach does not automatically accept the internal network as trusted. ### What Is a DMZ? DMZ: #### Demilitarized Zone is the security zone in which internet-facing services are separated from the internal network. ### What Is the Purpose of Using a DMZ? To limit direct access to the internal network even if an internet-facing system is compromised. ### How Should Traffic From the DMZ to the Internal Network Be? It must be limited to the minimum necessary connections. ### What Is North-South Traffic? It is the traffic between the corporate network and the internet or external systems. ### Which Traffic Does a Firewall Traditionally Focus On? Mostly North-South traffic. ### What Is East-West Traffic? It is the traffic between systems on the internal network. ### Why Is an East-West Firewall Important? It can reduce the lateral movement risk. ### What Is an Internal Segmentation Firewall? It is the firewall approach that controls the traffic between internal network segments. ### Is an Internal Firewall Necessary? In critical environments it can be a strong segmentation control. ### The Relationship Between Firewall and Network Segmentation A VLAN can separate the network logically. A firewall, on the other hand, can control the access between VLANs or zones with security policy. ### What Is a Firewall Rule? It is the policy record that determines whether a traffic flow is permitted or blocked. ### Which Fields Can a Firewall Rule Contain? Source Destination Service Application User Action Log ### What Is Source? It is the system or network that initiates the connection. ### What Is Destination? It is the system or network the connection wants to reach. ### What Is Service? It is the port and protocol information. ### What Is Action? Allow Deny Reject it can be a decision such as these. ### What Is the Difference Between Allow and Deny? Allow permits the traffic. Deny blocks the traffic. ### What Is the Difference Between Reject and Drop? Reject can inform the other side that the connection has been refused. Drop, on the other hand, can silently ignore the packet. ### What Is Default Deny? It is the automatic blocking of traffic that has not been explicitly permitted. ### Why Is Default Allow Risky? It can cause new or forgotten services to remain reachable. ### How Is Least Privilege Applied in Firewall Policy? Only the necessary sources, destinations, applications and ports should be permitted. ### An Example of a Bad Firewall Rule Source: Any Destination: Database Network Service: Any Action: Allow ### An Example of a More Secure Rule Source: Application Server Destination: Database Server Service: TCP/5432 Action: Allow ### What Is an Any-Any Rule? It is a firewall rule in which the source, destination or service restriction is very broad. ### Why Is an Any-Any Rule Risky? It provides more network access than is needed. ### Is Any-Any Always Forbidden? There may be some special needs. However, a risk assessment and review must certainly be carried out. ### What Is a Firewall Rule Review? It is the periodic examination of the active firewall rules. ### Why Is a Firewall Rule Review Necessary? The network changes. Systems are shut down. Applications change. However, old rules can remain open. ### What Is a Stale Rule? It is a firewall rule for which there is no longer a business need. ### Why Is a Stale Rule Risky? It can leave an unnecessary attack path. ### What Is a Shadow Rule? It is a firewall rule that is in practice not used because of another rule. ### What Is a Duplicate Rule? It is a repeated rule that controls the same or very similar traffic. ### What Is an Unused Rule? It is a rule that has not received a traffic hit for a long time. ### Should an Unused Rule Be Deleted Immediately? No. The owner and the business need must first be verified. ### What Is a Rule Owner? The person or team responsible for the business requirement of the firewall rule. ### What Is Firewall Rule Expiration? It is the automatic ending of a temporary rule on a certain date. ### What Is a Temporary Firewall Rule? It is a rule opened for a temporary project, maintenance or third-party access. ### Why Is a Temporary Rule Risky? It can be forgotten and left open even after its period has ended. ### What Is Firewall Rule Recertification? It is the periodic re-approval of the existing firewall rules. ### What Should the Rule Review Frequency Be? It must be determined according to the risk level. On critical firewalls it can be done more frequently. ### Why Is Firewall Logging Important? It makes it possible to see which connection was made from whom to where. ### Should Allow Logs Be Kept? On a risk basis, yes. ### Should Deny Logs Be Kept? Critical deny events are valuable for security investigation. ### Should Every Firewall Log Be Sent to the SIEM? No. The log volume can be very large. Central logging must be carried out on a risk basis. ### How Are Firewall Logs Used in the SIEM? For example: Port Scan Repeated Deny Suspicious Outbound Malicious IP use cases such as these can be created. ### What Is IPS? IPS: #### Intrusion Prevention System helps to detect and block known or suspicious attack patterns in network traffic. ### What Does the IPS Inside an NGFW Do? It can analyze the traffic in terms of security signatures and threat patterns. ### What Is Signature-Based Detection? It is the detection of known attack patterns with predefined signatures. ### Should IPS Signatures Be Up to Date? Yes. An old signature database can reduce the detection capability. ### What Is an IPS False Positive? It is normal traffic being perceived as an attack. ### Does IPS Work Inline? Yes, in most scenarios it can work on the traffic path. ### Can IPS Block Incorrectly? Yes. For this reason tuning is needed. ### What Is IPS Policy Tuning? It is the optimization of the relevant signatures according to the environment. ### What Is URL Filtering? It is the control of web traffic on a domain or category basis. ### What Is a URL Category? It is the separation of websites into categories such as, for example; Malware Phishing Gambling Social Media categories such as these. ### Are DNS Filtering and URL Filtering the Same? No. DNS filtering works at the domain resolution layer. URL filtering can provide more detailed control at the web request level. ### How Is Threat Intelligence Used on the Firewall? Known malicious IPs, domains or URLs can be blocked with firewall policy. ### What Is IOC Blocking? It is the blocking of indicators such as IPs and domains defined as Indicators of Compromise. ### Is IOC Blocking Enough on Its Own? No. Attacker infrastructure can change rapidly. Behavioural detection is needed as well. ### What Is Geo-IP Filtering? It is traffic control according to the geographical location of the IP address. ### Does Geo-IP Filtering Provide Security? It can be an additional control but on its own it is not a strong security mechanism. ### What Is SSL/TLS Inspection? It is the mechanism that allows encrypted network traffic to be passed through security analysis. ### Why Is TLS Inspection Necessary? Malware or phishing traffic can use HTTPS too. ### How Does TLS Inspection Work? The firewall terminates the encrypted session in a controlled way, analyzes the traffic and can re-encrypt it. ### What Are the Risks of TLS Inspection? Privacy Certificate Management Performance Compatibility ### Should All TLS Traffic Be Inspected? No. Bypass lists can be created according to privacy and regulatory requirements. ### What Is TLS Bypass? It is leaving certain traffic outside inspection. ### What Is Certificate Pinning? It is the application trusting only a certain certificate or public key. ### Does Certificate Pinning Affect TLS Inspection? Yes. Some applications may not work during inspection. ### What Is Firewall NAT? NAT: #### Network Address Translation is the translation of IP addresses during network transitions. ### What Is Source NAT? It is the changing of the source IP address. ### What Is Destination NAT? It is the changing of the destination IP address. ### What Is Port Forwarding? It is the forwarding of a certain external port to an internal system. ### What Is the Security Risk of Port Forwarding? It can open an internal service to internet exposure. ### How Is Port Forwarding Done Securely? Minimum port Source restriction Strong authentication Logging controls such as these must be used. ### What Is Firewall VPN? Remote access or site-to-site VPN termination can be performed on the firewall. ### What Is Remote Access VPN? It is the user connecting to the corporate network from outside. ### Should a VPN User Receive Full Network Access? No. Role-based access must be applied. ### Should MFA Be Used on the VPN? Yes. ### What Is Split Tunneling? It is some of the VPN user's traffic going directly to the internet instead of through the corporate tunnel. ### Is Split Tunneling Risky? Depending on the architecture it can create risk. ### What Is Full Tunnel? It is all user traffic being routed to the organization over the VPN. ### Does ZTNA Take the Place of the Firewall? No. They have different areas of use. ### Can a Firewall and ZTNA Be Used Together? Yes. ### What Is a User-Based Firewall Policy? It is the association of the firewall rule with user identity instead of IP. ### Why Is Identity Awareness Important? An IP on its own may not represent the real user. ### Can LDAP/AD Integration Be Used on the Firewall? Yes. It can be used for user identity mapping. ### How Should Firewall Administrator Access Be Protected? MFA PAM Dedicated Admin Account Management Network controls such as these must be used. ### Should Firewall Management Be Open to the Internet? As far as possible, no. ### What Is the Management Interface? It is the interface through which the firewall's management panel is reached. ### What Is the Management Plane? It is the control plane on which the firewall's configuration and administration traffic is processed. ### What Is the Data Plane? It is the plane through which user traffic passes. ### What Is the Control Plane? It is the logical plane on which routing and network control operations are carried out. ### Should the Management Plane Be Separated? In critical environments the use of a separate management network is a strong control. ### Should the Firewall Admin Account Be Shared? As far as possible, no. ### Why Is a Named Admin Account Important? It provides accountability. ### What Is Firewall AAA? It is the central management of the Authentication, Authorization and Accounting processes. ### Can TACACS+ Be Used in Firewall Management? Yes. ### Can RADIUS Be Used? Yes. ### Should Firewall Admin Privileges Be Role-Based? Yes. ### What Is a Read-Only Firewall Admin? It is a user with a role that can see the configuration but cannot make changes. ### Why Is Change Approval Important? An incorrect firewall rule can create broad access or an outage. ### What Is Firewall Change Management? It is the making of firewall configuration changes through a controlled process. ### How Should the Change Process Be? Request ↓ Risk Review ↓ Approval ↓ Implementation ↓ Validation ↓ Documentation ### Why Is a Firewall Backup Necessary? It provides rapid recovery in the case of configuration corruption or device failure. ### Is the Firewall Configuration Backup Sensitive? Yes. It can contain information such as credentials, VPN secrets and network topology. ### Should the Configuration Backup Be Encrypted? It must be protected securely. ### What Is Firewall Configuration Versioning? It is the keeping of the configuration history after every change. ### What Is a Config Diff? It is seeing the difference between two firewall configurations. ### Is a Config Diff Useful for Security? Yes. It helps to detect unauthorized changes. ### What Is Firewall Configuration Drift? It is the firewall deviating over time from the approved baseline. ### How Does Drift Occur? Emergency change Manual change Temporary rule Firmware upgrade ### What Is Firewall Hardening? It is the strengthening of the firewall according to a secure configuration standard. ### What Does Firewall Hardening Contain? Unused Services Secure Management Strong Authentication Logging Patch Admin Restriction ### What Should Be Done With the Default Admin Account? If possible it must be changed securely or brought under control. ### Should Default Passwords Be Used? No. ### Should Telnet Be Used? No. Encrypted management methods such as SSH or HTTPS must be used. ### Should HTTP Management Be Used? If possible HTTPS must be used. ### Why Is SNMP Security Important? A weak SNMP configuration can create network information disclosure. ### Can SNMPv3 Be Preferred? Yes. It is more secure because of its authentication and encryption support. ### Should the Firewall Use NTP? Yes. Time synchronization is important for the accuracy of log timestamps. ### Does NTP Affect Security Incident Investigation? Yes. An incorrect time makes log correlation difficult. ### Should the Firewall DNS Settings Be Secure? Yes. Threat intelligence and cloud security services may need DNS. ### Why Is a Firmware Update Important? It can close known vulnerabilities on the firewall. ### What Is Firewall Patch Management? It is the controlled management of the firmware and security update lifecycle. ### What Is an EOL Firewall? It is a firewall whose vendor support has ended. ### Is Using an EOL Firewall Risky? Yes. Patches may not be available for new vulnerabilities. ### What Should Be Done Before a Firmware Update? Backup Compatibility Check Change Plan Rollback Plan ### What Should Be Tested After a Firewall Firmware Update? Internet access VPN Critical rules HA Logging IPS ### What Is Firewall HA? HA: #### High Availability is the architecture that allows the other device to take over the traffic when one firewall fails. ### What Is Active-Passive Firewall HA? One firewall works actively while the other device waits on standby. ### What Is an Active-Active Firewall? More than one firewall processes traffic at the same time. ### Does HA Firewall Provide Security? It provides availability. The correctness of the security policy is still necessary. ### What Is HA Split-Brain? It is the situation in which two nodes accept themselves as active at the same time. ### What Is HA Sync? It is the synchronization of configuration and session information between the firewalls. ### Why Is Session Synchronization Important? It can allow active sessions to continue during a failover. ### What Is Firewall Capacity Planning? It is the planning of the firewall's throughput and connection capacity according to future need. ### What Is Firewall Throughput? It is the amount of network traffic it can process in a given period. ### Do Security Services Affect Throughput? Yes. IPS, TLS inspection and malware scanning can reduce performance. ### Does Datasheet Throughput Reflect Real Traffic? Not always. The real workload and the enabled security features must be taken into account. ### What Is a Concurrent Session? It is the number of connections the firewall tracks at the same time. ### What Is New Sessions Per Second? It is the number of new connections the firewall can establish per second. ### What Happens If Firewall CPU Is High? Latency or packet drop can occur. ### What Happens If Firewall Memory Is High? A stability problem can occur. ### What Is Firewall Health Monitoring? It is the monitoring of metrics such as CPU, memory, session count and interface status. ### Should the Firewall Be Integrated Into the SIEM? Yes. Critical security events can be sent to the SIEM for central monitoring. ### Examples of Firewall SOC Use Cases Port scan Repeated deny Malicious IP connection VPN brute force Unusual outbound traffic ### What Should Be Done If the Firewall Log Volume Is Too High? Filtering, normalization and risk-based logging can be applied. ### What Is a Threat Log? It is the event log produced by the IPS, anti-malware or security engine. ### What Is a Traffic Log? It is the log that records network session information. ### What Is a Configuration Log? It records the configuration changes made on the firewall. ### What Is an Admin Log? It records administrator login and activity information. ### Which Logs Are Critical in Firewall Security Monitoring? Admin login Policy change Threat detection VPN login System error ### Is There a Risk of Firewall Log Manipulation? Yes. The local logs on a compromised firewall can be altered. ### Why Is Central Logging Important? Storing the logs on a separate system increases forensic reliability. ### Why Is Firewall SIEM Integration Not Enough on Its Own? Collecting logs does not mean detection. Use cases and correlation are needed. ### Can Firewall Rule Analysis Be Done Automatically? Yes. Security policy management tools can be used. ### What Is Firewall Policy Optimization? It is the reduction of redundant, unused and risky rules. ### What Is Firewall Rule Cleanup? It is the controlled removal of unnecessary rules. ### What Should Be Done Before Cleanup? Traffic hit Owner Business need must be examined. ### What Is a Firewall Risk Score? It is the scoring of rules according to their risk level. ### An Example of a Risky Firewall Rule Internet → Server Network → Any Service → Allow ### A More Secure Approach Internet → Reverse Proxy → TCP/443 → Allow ### What Is Egress Filtering? It is the control of the traffic going out to the internet from internal systems. ### Why Should Outbound Traffic Be Controlled? Malware can make a C2 connection or perform data exfiltration. ### **Is the "Everything Open From Inside to Outside" Approach Risky?** Yes. ### Can Outbound Whitelisting Be Done? It can be evaluated on critical segments. ### Can DNS Security Be Inside the Firewall? Yes. Some NGFW platforms can provide DNS filtering. ### Can C2 Communication Be Detected on the Firewall? If there is a known malicious destination or a behavioural signal, yes. ### Can Beaconing Be Seen in Firewall Logs? It can be detected by analyzing periodic outbound connection patterns. ### What Is Network Threat Prevention? It is the use of firewall, IPS, DNS security and threat intelligence controls together in order to prevent attacks. ### What Is the Difference Between a Firewall and NDR? A firewall is focused on access control and prevention. NDR analyzes network behaviour in terms of visibility and detection. ### Why Are Firewall and NDR Used Together? The firewall blocks. NDR analyzes suspicious behaviour that is invisible or inside permitted traffic. ### What Is the Difference Between a Firewall and NAC? A firewall controls traffic. NAC controls which device will connect to the network. ### What Is the Difference Between a Firewall and a WAF? A network firewall controls network traffic. A WAF analyzes web application layer traffic. ### Does a WAF Take the Place of a Firewall? No. ### What Is a Firewall Security Assessment? It is the evaluation of the firewall configuration and policy structure from a security point of view. ### What Does a Firewall Assessment Contain? Rule base Admin security Firmware Logging VPN Hardening ### What Is a Firewall Penetration Test? It is the controlled testing of the network exposure behind the firewall and of the filtering effectiveness. ### What Is a Firewall Configuration Audit? It is the evaluation of the configuration's compliance with the security baseline and policy. ### Can the CIS Benchmark Be Used for Firewalls? Depending on the vendor and platform it can be used as a security hardening reference. ### Should the Vendor Hardening Guide Be Used? Yes. ### What Is a Firewall Security Baseline? It is the minimum security standard the organization wants applied on all its firewall devices. ### Baseline Examples MFA enabled Unused admin service disabled Central logging enabled NTP configured Firmware supported ### What Is a Cloud Firewall? They are the firewall technologies that control network traffic in the cloud environment. ### What Is Cloud NGFW? It is the application of NGFW capability in the cloud environment. ### Is a Security Group a Firewall? It provides similar access control but it is not the same as a classic NGFW. ### Can Cloud Firewall Policy Be Managed Centrally? Yes. ### What Is Hybrid Network Firewall Management? It is the management of on-premises and cloud firewall policies together. ### What Is Firewall as a Service - FWaaS? It is the delivery of firewall security capabilities with a cloud service model. ### What Is the Relationship Between SASE and the Firewall? In the SASE architecture firewall capabilities can be provided over the cloud. ### What Is SASE? #### Secure Access Service Edge is the approach that aims to combine network and security services in a cloud-centric architecture. ### What Is SSE? Security Service Edge is the model that focuses on the security side of SASE. ### Is the Firewall Part of Zero Trust? Yes. However, Zero Trust is not only the firewall. ### Does Using Identity in Firewall Policy Provide Zero Trust? On its own, no. Device posture, continuous verification and least privilege are needed as well. ### Firewall Security KPIs For example: Rule Review Completion Any-Any Rule Count Critical Firmware Gap Admin MFA Coverage Unused Rule Count ### Firewall Security KRIs For example: Internet-Exposed Management EOL Firewall Unrestricted VPN Unsupported Firmware ### What Should a Firewall Dashboard Show? Device Health Threat Events Rule Risk VPN Activity Firmware Status ### Firewall Hardening Checklist - Has the default password been changed? - Is MFA active? - Is there a shared admin account? - Is the management interface open to the internet? - Are HTTPS/SSH being used? - Is Telnet disabled? - Is SNMP secure? - Is NTP correct? - Is central logging active? - Is the firmware up to date? - Are unused services disabled? - Are backups being taken? - Is HA being tested? ### Firewall Rule Review Checklist - Are there any Any-Any rules? - Has the period of a temporary rule expired? - Are there any unused rules? - Are there any duplicate rules? - Are there any shadow rules? - Is the rule owner known? - Is the business need still valid? - Is logging active? - Is the source too broad? - Is the destination too broad? - Is the service too broad? ### Corporate Firewall Security Checklist - Are the security zones correctly defined? - Is there a DMZ separation? - Have the server and user networks been separated? - Is the database segment being protected? - Has the management network been separated? - Is North-South traffic being controlled? - Is East-West traffic being controlled? - Is there outbound filtering? - Is IPS active? - Is Application Control active? - Is Threat Intelligence being used? - Is TLS inspection being applied in the appropriate areas? - Is the VPN protected with MFA? - Do the firewall logs go to the SIEM? - Is the config backup secure? - Is the rule review regular? - Are there any EOL firewalls? - Has HA failover been tested? ### The Most Frequently Made Mistakes on the Firewall The mistakes frequently encountered in organizations: - Thinking that the network is secure if there is a firewall - Using Any-Any rules - Not defining a rule owner - Leaving temporary rules in place permanently - Not carrying out rule reviews - Opening the firewall management interface to the internet - Using a shared admin account - Not using MFA - Not updating the firmware - Using an EOL firewall - Not performing logging - Not controlling outbound traffic - Giving VPN users full network access - Using TLS inspection without a plan - Not taking config backups - Not testing HA failover ### Firewall Maturity Model #### Level 1 - Basic Firewall There are IP and port based rules. #### Level 2 - Structured Policy Zone-based policy and rule review are applied. #### Level 3 - NGFW Application Control, IPS and threat intelligence are actively used. #### Level 4 - Integrated Security The firewall is integrated with SIEM, SOC, NAC and NDR. #### Level 5 - Identity-Aware & Zero Trust Dynamic policy is applied through identity, device posture and micro-segmentation. ### Frequently Asked Questions #### What is a firewall? A firewall is the security system that permits or blocks network traffic according to security rules. #### What is NGFW? Next-Generation Firewall is the firewall technology that adds advanced features such as application control, IPS and threat intelligence to classic firewall capabilities. #### What is the difference between a firewall and an NGFW? While a classic firewall performs IP and port based control, an NGFW can also analyze application and threat context. #### What is a stateful firewall? It is the firewall architecture that tracks the state of the connection. #### What is an Any-Any firewall rule? It is a firewall rule in which the source, destination or service restriction is very broad and which can create unnecessary access. #### What is a firewall rule review? It is the periodic examination of firewall rules in terms of necessity, risk and use. #### What is firewall hardening? It is the strengthening of the firewall device with secure management, authentication, logging, patch and configuration settings. #### What is SSL/TLS inspection? It is the controlled examination of encrypted network traffic for security analysis. #### What is IPS? Intrusion Prevention System helps to detect and block network attacks. #### Should the firewall management interface be open to the internet? As far as possible, no. A secure management network or controlled access must be used. #### Should firewall logs be sent to the SIEM? Transferring critical security events to the central SIEM is a strong security approach. #### What is firewall HA? It is the high availability architecture that allows a second device to continue the service when one firewall fails. ### Conclusion: A Strong Firewall Product Alone Does Not Mean Strong Network Security In corporate network security the firewall is still a critical component. However, real security depends; far less on the brand or model of the product, than on how it is configured, which policies are applied, how it is monitored and how it is managed. Hundreds of security features may be active on a firewall. However, if the rule base is: Any-Any, uncontrolled, unreviewed, without an owner in this state, the real security level can be low. For this reason firewall security can be thought of with this equation: **Firewall Security = Architecture + Policy + Hardening + Monitoring + Governance** The fundamental aim of the modern firewall approach is not merely: **"Pass or block the traffic"** that alone. The more advanced goal: **"Permit only the necessary communication between the right user, the right device, the right application and the right destination."** should be this. At the same time the firewall; North-South Traffic, East-West Traffic, VPN, Cloud, Remote Access, Third-Party Access must cover different network areas such as these. The most critical point is this: Opening a firewall rule is easy. Closing a firewall rule is difficult. For this reason rule lifecycle management: **Request → Approve → Implement → Monitor → Review → Expire** must be handled in this way. Strong firewall operation is not merely performing configuration; **it is continuously questioning trust relationships and reducing unnecessary access.**