Firewall Types
Understanding different firewall technologies including Web Application Firewalls (WAF), Unified Threat Management (UTM), Next-Generation Firewalls (NGFW), and the differences between Layer 4 and Layer 7 inspection.
Understanding Firewall Types
Firewalls are the cornerstone of network security, but not all firewalls are equal. Different types provide different levels of inspection and protection—from basic packet filtering to deep application-layer analysis.
Firewall evolution: • Packet filters — Basic IP/port filtering • Stateful firewalls — Track connection state • Application firewalls — Deep packet inspection • NGFW — Combine multiple security functions • WAF — Specialized for web applications
The 2017 Equifax breach exploited an Apache Struts vulnerability—a web application flaw that a properly configured WAF would have blocked. Traditional firewalls allowed the traffic because port 443 was permitted; only application-layer inspection could have detected the malicious payload.
Understanding firewall types helps select the right protection for each use case.
Why This Matters for the Exam
Firewall types are heavily tested on SY0-701 because firewalls are deployed everywhere. Questions cover when to use each type and what layer each operates at.
Understanding firewall types helps with security architecture, compliance requirements, and incident response. Wrong firewall type for the threat = false sense of security.
The exam tests comparison of firewall capabilities and appropriate deployment scenarios.
Deep Dive
What Is the Difference Between Layer 4 and Layer 7 Firewalls?
OSI Layer Reference:
| Layer | Name | Data | Firewall Type |
|---|---|---|---|
| 7 | Application | Data | Application/NGFW/WAF |
| 6 | Presentation | Data | |
| 5 | Session | Data | |
| 4 | Transport | Segments | Stateful firewall |
| 3 | Network | Packets | Packet filter |
| 2 | Data Link | Frames | |
| 1 | Physical | Bits |
Layer 4 (Transport) Firewall:
Inspects: IP addresses, ports, TCP/UDP, connection state Cannot see: Application data, URLs, file contents Example rule: Allow TCP from 10.0.0.0/24 to 192.168.1.100:443
Layer 7 (Application) Firewall:
Inspects: All of Layer 4 PLUS application content Can see: URLs, HTTP methods, file types, SQL commands Example rule: Block HTTP requests containing "SELECT * FROM"
Comparison:
| Aspect | Layer 4 | Layer 7 |
|---|---|---|
| Performance | Faster | Slower |
| Inspection depth | IP/port/state | Full application |
| Attack detection | Limited | Comprehensive |
| Resource usage | Lower | Higher |
| False positives | Fewer | More possible |
What Is a Stateful Firewall?
Stateful firewalls track connection state, not just individual packets.
Stateless (Packet Filter):
Each packet evaluated independently Must explicitly allow return traffic No connection awareness
Stateful:
Tracks connection state (NEW, ESTABLISHED, RELATED) Return traffic automatically allowed for established connections Understands connection lifecycle
State Table Example:
Source IP | Dest IP | Src Port | Dst Port | State 10.0.0.5 | 8.8.8.8 | 54321 | 443 | ESTABLISHED 192.168.1.10 | 10.0.0.50 | 12345 | 22 | NEW
Stateful Benefits:
- •Only need rules for outbound traffic
- •Return traffic handled automatically
- •Blocks packets outside valid connections
- •More secure than stateless
What Is a Web Application Firewall (WAF)?
WAF is a Layer 7 firewall specifically for web applications.
WAF Placement:
WAF Protection Against:
| Attack | WAF Action |
|---|---|
| SQL Injection | Block malicious SQL in requests |
| Cross-Site Scripting | Block script injection |
| Command Injection | Block OS command patterns |
| Path Traversal | Block ../ attempts |
| File Inclusion | Block include/require attacks |
| OWASP Top 10 | Comprehensive web protection |
WAF Modes:
| Mode | Behavior |
|---|---|
| Detection | Log attacks, don't block |
| Prevention | Block detected attacks |
| Learning | Build baseline of normal traffic |
WAF Limitations:
- •Only protects web applications
- •Requires tuning to avoid false positives
- •Can't fix application vulnerabilities
- •Performance overhead on traffic
What Is a Next-Generation Firewall (NGFW)?
NGFW combines traditional firewall with additional security features.
NGFW Capabilities:
| Feature | Function |
|---|---|
| Stateful inspection | Traditional firewall |
| Application awareness | Identify apps regardless of port |
| User identity | Rules by user, not just IP |
| IPS | Intrusion prevention |
| SSL inspection | Decrypt and inspect |
| URL filtering | Block malicious/inappropriate sites |
| Malware protection | File scanning |
NGFW vs Traditional Firewall:
Traditional: "Allow TCP 443" - Allows ANY traffic on port 443 - Can't distinguish applications NGFW: "Allow Salesforce for Sales team, block Dropbox" - Identifies application - Controls by user/group - Inspects encrypted traffic
Application Identification:
- •NGFWs identify applications by:
- •Protocol signatures
- •Traffic patterns
- •Behavior analysis
- •Regardless of port used
What Is Unified Threat Management (UTM)?
UTM combines multiple security functions in one device.
UTM Features:
| Function | Included |
|---|---|
| Firewall | Stateful packet inspection |
| IDS/IPS | Intrusion detection/prevention |
| Antivirus | Gateway malware scanning |
| Anti-spam | Email filtering |
| VPN | Remote access |
| URL filtering | Web content filtering |
| DLP | Data loss prevention |
UTM vs NGFW:
| Aspect | UTM | NGFW |
|---|---|---|
| Target market | SMB | Enterprise |
| Performance | Lower | Higher |
| Features | Broad, basic | Deep, advanced |
| Management | Simpler | More complex |
| Scalability | Limited | Higher |
UTM Trade-offs:
- •All-in-one convenience
- •Lower cost than separate devices
- •Performance bottleneck when all features enabled
- •Good for smaller organizations
What Are Cloud-Based Firewalls?
Firewall as a Service (FWaaS):
[Users] → [Cloud Firewall] → [Internet/Apps]
|
Managed in cloud
No on-premises hardware
Global distributionCloud Firewall Benefits:
- •No hardware to manage
- •Scalability on demand
- •Distributed protection
- •Remote worker coverage
- •Integration with cloud services
How CompTIA Tests This
Example Analysis
Scenario: A company's e-commerce website is experiencing SQL injection attacks. Their traditional stateful firewall allows traffic on port 443, but attacks get through. They need a solution that can inspect HTTP content and block malicious requests without affecting legitimate customers.
Analysis - Firewall Selection:
Why Traditional Firewall Fails:
Attack: https://store.com/search?q=1' OR '1'='1
^
SQL injection payload
Stateful firewall sees:
- Source: Internet
- Destination: Web server
- Port: 443 (allowed)
- Result: PASSED ❌
Firewall only checks IP/port, not request contentRequired Capability:
- •Layer 7 (application) inspection
- •HTTP/HTTPS content analysis
- •SQL injection detection
- •Web-specific protection
Solution Options:
| Option | Suitable? | Reason |
|---|---|---|
| Packet filter | No | Can't see content |
| Stateful firewall | No | Only IP/port/state |
| NGFW | Partial | Has some web protection |
| WAF | Yes | Specialized for web attacks |
WAF Implementation:
[Internet] → [WAF] → [Web Server]
|
Inspects: HTTP requests
Detects: SQL injection patterns
Action: Block malicious requests
Attack request:
search?q=1' OR '1'='1
↓
WAF: "SQL injection detected" → BLOCKED ✓WAF Rule Example:
IF request contains: - ' OR ' pattern - UNION SELECT - DROP TABLE - <script> tags THEN: Block and log
Implementation Steps:
- 1.Deploy WAF in front of web servers
- 2.Start in detection mode (learn traffic)
- 3.Tune rules to reduce false positives
- 4.Enable prevention mode
- 5.Monitor and adjust
Key insight: Traditional firewalls operate at Layer 4 (IP/port) and cannot inspect application content. Web application attacks require WAF (Layer 7) that understands HTTP and can detect malicious payloads within allowed traffic.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
Firewall Layers: "Layer 4 = 4our things: IP, port, protocol, state" "Layer 7 = All 7 layers, sees Application data"
Firewall Type Memory:
WAF = Web Application Fighter Fights SQL injection, XSS, web attacks
NGFW = Not just ports Gets apps and users FW Application awareness + user identity
UTM = Unified Tools Machine All-in-one: FW + IPS + AV + VPN + URL
Stateful vs Stateless: "StateFUL = Follows Up on connections Later" Tracks connection state, handles return traffic
"StateLESS = Looks at Each packet Separately, Stupid about connections" No connection awareness
SQL Injection Detection: "Port 443 is OPEN, but the WAF is still WATCHING what goes through" Layer 4 sees door, Layer 7 sees who walks in
Test Your Knowledge
Q1.A company's web application is vulnerable to SQL injection attacks. Their stateful firewall allows port 443 traffic. What additional security control is needed?
Q2.Which firewall feature allows security rules based on the application being used, regardless of port number?
Q3.What type of firewall is BEST suited for a small business that needs firewall, IPS, antivirus, VPN, and URL filtering in a single device?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee