Before this course turns to a specific product, it is worth looking at the category itself. This lesson is deliberately product-neutral. It explains what a next-generation firewall does in general, regardless of which vendor built it.

Packet filtering versus stateful inspection

A simple packet filter examines each packet on its own. It looks at sender, recipient and port and then decides, based on fixed rules, whether the packet is allowed through. Every packet is judged individually, with no memory of what happened before.

A stateful firewall, known as stateful inspection, goes a step further. It remembers which connections are currently allowed and active. This memory is called a state. When an internal machine opens a connection to the outside, the firewall remembers that state. Response packets from outside are then automatically let through, because they belong to a connection that has already been allowed. Without this state, every response would need its own rule.

IDS and IPS: detection and prevention

An Intrusion Detection System, or IDS, observes traffic and reports suspicious patterns. It detects an attack but does not intervene itself. An Intrusion Prevention System, or IPS, goes further and actively blocks the detected attack. The difference is detection versus prevention. Both systems work with rule sets that describe what an attack looks like.

Deep packet inspection

Classic firewalls only look at a packet's header data: sender, recipient, port. Deep Packet Inspection, or DPI, also looks into the actual content of the packet. This makes it possible to recognize which application really sits behind a connection, regardless of the port used. Encryption makes this analysis significantly harder. When a packet's content is encrypted, DPI can no longer read the content directly. Modern systems then rely on metadata and on targeted decryption, which has its own limits and its own cost.

Proxy and reverse proxy

A proxy sits between a company's own machines and the internet. It receives requests from the internal network, checks them, and forwards them on the user's behalf. A reverse proxy works the other way around. It sits in front of an internal service, such as a web server, and receives requests from outside before passing them on to the actual server inside. This keeps the real server hidden from the outside world.

VPN as a channel, not as protection

A Virtual Private Network, or VPN, encrypts the connection between two points. It creates a secure channel through an untrusted network such as the internet. A VPN, however, only protects the transport path. What happens at the end of that channel is decided by the endpoint device itself. If a machine at the end of a VPN tunnel is already infected with malware, the VPN does nothing to prevent that.

Key point: A state remembers that a packet belongs to a connection that has already been allowed. Without this state, every packet would need to be checked individually.

Key point: A VPN protects the transport, not the endpoint.

Why this matters for AIMdefense

AIMdefense brings all of these building blocks together in one piece of software: stateful filtering, IDS and IPS, deep packet inspection, proxy and reverse proxy, and VPN. The following lessons in this course show exactly how.