Sourcefire Monday said it expects to begin shipping its first two next-generation firewall appliances later this month, entering an increasingly crowded market.
BACKGROUND: What you should know about next-generation firewalls
Traditional network firewalls examine and control traffic based on ports, but next-gen models add application-layer filtering. "It's the ability to see the applications traversing your network," says Sourcefire Director of Product Marketing Dave Stewart, who says the two appliances -- the 10Gbps 3D8140 Next-Generation Firewall Edition and the 20Gbps 3D8250 Next-Generation Firewall Edition -- can recognize more than 1,000 applications, down to granular controls. "And we'll constantly be adding more," he points out.
"We don't just identify Facebook, we identify Facebook chat, video and postings, and we can set user groups for Web filtering by URL," Stewart said, adding that the appliances provide a way to monitor and block what's occurring across the network, such as learning who's watching Netflix when they shouldn't be. The two new Sourcefire appliances also include intrusion detection and protection capabilities, the company's more traditional product focus.
Sourcefire anticipates that its customers will be working to gradually adapt the context-based application-layer controls to their networks even as they continue to use port-based firewalling, basically operating in dual-mode.
Operating in application-aware and port-based firewalling modes simultaneously has been the customary experience with other firewall vendors' "application-aware" firewalls, including those from Palo Alto Networks, Check Point and SonicWall.
One limitation in the new Sourcefire firewalls concerns their use in virtualized environments. The appliances cannot yet go deep into the hypervisor layer to inspect traffic which might, for example, be traveling between virtual machines on the same physical machine. But that kind of capability for the VMware environment is expected to be introduced around mid-2012.
Both NGFW appliances, expected to ship Dec. 23, start at $140,000.
Read more about wide area network in Network World's Wide Area Network section.