Aviatrix Blog 
Firewalls are one of the many features of networking that started as a physical construct, turned into hardware, and were translated into software as technology changed. Here’s a brief overview of how firewalls work, the definition of next-generation and virtualized firewalls, and why cloud firewalls are the cutting-edge solution every network needs.
What is a firewall?
In computer networking, a firewall is a software product that acts as a metaphorical “wall” to prevent harmful traffic from entering a network. The first firewalls in the 1990s were deployed as physical appliances, or chassis, designed for the static, perimeter-based security models of the time, when all traffic flowed through a well-defined boundary.
What is a next-generation firewall?
Over time, firewalls evolved and a new class—dubbed next-generation firewalls (NGFWs)—incorporated additional filtering and security capabilities and enabled more granular control. It’s the natural progression of any product that adds new features and becomes more robust over time.
What is a virtualized firewall?
As cloud computing started taking off—and dissolved the network perimeter in the process—firewall vendors made their physical hardware available for virtual deployment. They used the same operating system and offered the same operational user experience, but instead of installing a physical appliance, you could now deploy the firewall as a virtual machine (VM) instance.
Are virtualized firewalls the same as cloud firewalls?
No. A virtualized firewall is exactly that: a virtualized version of the NGFW. Cloud environments, however, are dynamic, with workloads scaling up and down, communicating across regions, and integrating with numerous external services. This is fundamentally different from the comparatively static workloads that NGFWs were architected to protect and required a shift in firewall design. A cloud firewall is a cloud-native product designed from the start to address the agile and distributed nature of cloud workloads.
How do virtualized firewalls and cloud firewalls differ from a deployment and management perspective?
With virtualized firewalls, you are responsible for all provisioning, patching, and scaling of the firewall instances. A cloud firewall, on the other hand, is a service, which means that deployment, configuration, and maintenance is handled by the cloud firewall provider—and high availability, auto-scaling, and updates are all built in. Furthermore, they integrate natively with cloud services, further reducing operational overhead.
How do virtualized firewalls and cloud firewalls differ from a security policy enforcement perspective?
Virtualized firewalls operate the same way their hardware versions do—routing all traffic through hrough centralized security hubs in order to enforce security policies. Cloud firewalls, however, enable you to manage policies centrally but enforce security at the workload level. This means that cloud firewalls can unlock a range of operational advantages, including:
- Eliminating the need to size appliances in advance to support scaling.
- Reducing the complexity that comes with manual firewall instance configuration.
- Reducing data transfer costs due to unnecessary traffic flows through expensive gateways.
- Speeding response to security incidents.
What are some of the unique capabilities of cloud firewalls?
Because cloud firewalls were explicitly designed for the cloud, they offer a range of capabilities that virtualized firewalls—whose underlying design was built for a very different type of environment—simply can’t deliver. Cloud firewalls can:
- Understand the context of workloads, including the relationships between different cloud resources and their security requirements.
- Automate security policies and configurations based on cloud-specific triggers and events.
- Continuously adapt to changes in the cloud environment and to the threat landscape for robust protection at all times.
- Provide a single pane of glass for managing security across multiple cloud environments.
- Leverage cloud intelligence for proactive threat hunting.
How do virtualized firewalls and cloud firewalls differ from a visibility and control perspective?
Virtualized firewalls may offer centralized management, but they often lack the visibility depth and real-time capabilities needed for dynamic and varied cloud environments. Cloud firewalls provide centralized visibility and control over network traffic across multiple cloud environments, with real-time monitoring, anomaly detection, and automated policy enforcement.
What types of cloud firewalls are available today?
Cloud service providers (CSPs) offer cloud-native firewalls, but they are cloud-specific, so if you have a multicloud environment, you’ll need a different cloud firewall for each CSP. Additionally, the CSP cloud firewalls require a NAT gateway, which can be expensive.
Many of the traditional NGFW vendors have attempted to enter the cloud firewall space, but have had limited success in the market. To date, these offerings are unable to provide the advanced cloud firewall features, required to appropriately secure the diverse and agile surface of the cloud, as mentioned above.
There is another option: a third-party cloud-native firewall, such as the Aviatrix Cloud Firewall™, which is a cloud-native firewall that provides all the capabilities required in a modern cloud environment. In addition to supporting any cloud provider, you get security, visibility, and NAT capabilities—all, in most cases, for less than the cost of the CSP-specific NAT gateway alone.
Is there a role for virtualized firewalls in modern network environments?
Yes! Despite their limitations, virtualized firewall appliances still serve an important role for certain workloads. Some enterprises have complex security and compliance requirements that necessitate advanced firewall features found in traditional products. Virtualized firewalls can be useful for:
- Legacy monolithic applications that are predominately static but still require deep packet inspection and custom threat intelligence
- Hybrid cloud deployments where on-premises security policies must be extended into the cloud
- Organizations with existing investments in firewall vendor ecosystems
Where can I learn more about the Aviatrix Cloud Firewall?
- Aviatrix Cloud Firewall Fast Facts
- Aviatrix Cloud Firewall White Paper
- You Need More than Basic Cloud Security: Introducing Aviatrix’s Cloud Firewall Solution
- 9 Cloud Perimeter Security Challenges Solved with Aviatrix
Can I get a demo of the Aviatrix Cloud Firewall?
Yes! Contact us to book a 30-minute walkthrough of the Aviatrix Cloud Firewall with one of our cloud firewall experts.