Business Firewall Guide: How to Choose a Next-Generation Firewall (NGFW)

A firewall is the front door of your business network. It decides what traffic can enter and leave, and a modern next-generation firewall also stops malware, phishing sites and intrusion attempts before they reach your PCs and servers. This guide explains what to look for and how to choose the right one.

What is a next-generation firewall?

Traditional firewalls allowed or blocked traffic using only IP addresses and port numbers. Next-generation firewalls look inside the traffic and combine several security tools in one box:

• Application control: allow, limit or block apps such as social media, streaming, torrents or personal cloud storage.
• Intrusion prevention (IPS): detect and block known attack patterns and exploits.
• Anti-virus and anti-malware: scan web downloads and email attachments at the gateway.
• Web filtering: block malicious, phishing and unwanted website categories.
• SSL/TLS inspection: find threats hidden inside encrypted HTTPS traffic.
• VPN: secure connections for remote staff and between offices, plants and warehouses.
• SD-WAN and load balancing: use two internet lines together and fail over automatically.

Signs your business needs a better firewall

• You rely on the basic router supplied by your internet provider.
• Staff work from home, or you have branches, factories or warehouses to connect.
• You have had ransomware, a virus outbreak, or suspicious logins to email or servers.
• Your current firewall is end-of-life or its security subscription has expired.
• Internet feels slow because a few users or apps take all the bandwidth.
• An auditor, client or insurer has asked about your network security.

How to size a firewall correctly

The biggest mistake we see is buying on the “firewall throughput” figure on the box. That number is measured with security features switched off.

Check this figure	Why it matters
Threat protection throughput	Real speed with IPS, anti-malware and app control switched on
SSL inspection throughput	Most traffic is now HTTPS, and inspection is CPU-heavy
IPsec / SSL VPN throughput	Decides how many remote users and branches you can support
Concurrent sessions	Busy offices and servers open many connections at once

As a rough guide, take your total internet bandwidth, add 30 to 50% for growth, and make sure the threat protection throughput is above that number.

Pro tip: Count every device, not just employees. CCTV, printers, phones and IoT sensors all create sessions on your firewall.

Choosing between popular brands

Brand	Known for	Typical fit
Fortinet FortiGate	High performance per rupee, built-in SD-WAN	SMEs to large multi-site companies
Sophos XGS	Easy management, strong endpoint integration	SMEs that want simple central control
WatchGuard Firebox	Straightforward licensing, good cloud management	Small and mid-sized offices
Cisco (Meraki / Secure Firewall)	Cloud-managed networks, enterprise features	Businesses standardised on Cisco

All four are solid. The right choice depends on your users, internet lines, branches, existing switches and Wi-Fi, and who will manage the firewall day to day.

Licences and total cost

A next-generation firewall has two costs: the hardware and an annual security subscription that keeps IPS signatures, anti-malware and web filtering up to date. When the subscription lapses, the box keeps routing traffic but most protection stops updating. Always compare 3-year or 5-year total cost, not just the hardware price.

Logging and CERT-In compliance in India

Under CERT-In directions issued in April 2022, Indian organisations must report specified cyber security incidents to CERT-In within 6 hours of noticing them, and keep ICT system logs for 180 days within India. A properly configured firewall that sends logs to a central log server or cloud service makes this much easier, and helps you investigate what happened after an incident.

Firewall security checklist

1. Change default admin passwords and restrict admin access to internal IPs or VPN.
2. Turn on IPS, anti-malware, web filtering and application control.
3. Enable SSL inspection for high-risk categories, with exceptions for banking and health sites.
4. Use multi-factor authentication for VPN users.
5. Separate guest Wi-Fi, CCTV and IoT devices onto their own network segments.
6. Apply firmware updates after testing, at least every quarter.
7. Back up the configuration after every change.
8. Review alerts and reports every week, not only when something breaks.

Frequently asked questions

Is a hardware firewall better than antivirus on each PC?

You need both. A network firewall protects the whole office at the internet edge. Endpoint security protects each device, including laptops used outside the office.

How long does a business firewall last?

Typically five to seven years, until the vendor ends support. Plan a replacement before the end-of-support date so you keep receiving security updates.

What is the difference between UTM and NGFW?

Both combine multiple security functions. NGFW usually refers to newer platforms with deeper application awareness and SSL inspection. In practice, most vendors now use the terms interchangeably.

Can a firewall stop ransomware?

It greatly reduces the risk by blocking known malware, malicious sites and exploit attempts, but it should be combined with endpoint protection, patching, MFA and tested backups.

Do I need someone to manage the firewall?

Yes. A firewall is only effective if it is updated, tuned and monitored. Many businesses choose a managed firewall service for this reason.

Get the right firewall, properly managed

Altn Technology supplies, installs and manages FortiGate, Sophos, WatchGuard and Cisco firewalls for offices, factories and multi-site businesses, including VPNs between plants and head offices. See our firewall security services and managed network services, or request a free quote.