2020-07-01 The difference between next-generation firewall and UTM

Three major differences between next-generation firewall NGFW and UTM Three major differences between NGFW and UTM: First, from an architectural perspective, NGFW adopts integrated, single-engine: NGFW unifies the application layer security detection modules into one detection engine, and each functional module also

Linkage can be formed.

Although UTM also provides a single device with multiple security functions, including first-generation firewall and IPS functions, it only superimposes multiple security engines together, which causes the data flow to perform decoding and status in each security engine separately.

Operations such as recovery result in a large amount of resource consumption.

Second, stronger performance and more efficient management: Traditional UTM cannot achieve high application efficiency in terms of function overlay, and it also has shortcomings in management control.

Some UTM devices have many functions, such as firewall, Internet behavior, application identification, IPS, etc., but this is just a stack of various functions. When these functions are fully enabled, the performance will be greatly reduced.

The next-generation firewall uses an integrated engine that can identify and scan data flows at one time to achieve higher performance. Through integration, it can also make it easier for managers.

For example, a German company uses 3,000 next-generation firewalls, but only needs two network administrators. This is because it has a centralized device manager that can monitor all devices efficiently.

Third, it provides more comprehensive L2-L7 layer attack protection and is suitable for enterprises of different sizes: UTM is suitable for saving costs in branch offices and is suitable for smaller companies, but it is difficult to meet the needs of large enterprises.

The NGFW not only has a good protective effect against web attacks, vulnerability attacks, virus Trojans and other types of application layer attacks, but can also inspect outgoing traffic from servers or terminals.

.