Packet filtering firewall

• A single device can filter traffic for the entire network.
• Efficient and fast at processing packets.
• Enables complex security policies through filtering on protocol headers.
• Inexpensive.
• Minimal impact on other resources, network performance, end-user experience.

• Incapable of filtering at the application layer.
• Lacks broad context of other firewall options.
• Can be difficult to securely configure.
• Lacks features like user authentication, logging.
• Vulnerable to spoofing attacks.
• Access controls lists can be difficult to set up and manage.

Circuit-level gateway

• Provides privacy for data passing in/out of private network.
• More secure than packet filtering firewalls.

• Cannot filter individual packets.
• Limited application support.
• Vulnerable to attacks that exploit protocol weaknesses.

Application-level gateway (aka proxy firewall)

• Provides more granular control over network traffic.
• Can filter traffic based on specific applications or protocols.
• Can provide user authentication and logging.

• Can be expensive.
• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.

Stateful inspection firewall

• Keeps track of the state of network connections.
• Only allows traffic that is part of an established connection.
• Can provide more granular control over network traffic than packet filtering firewalls.

• Can be expensive.
• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.

Next-generation firewall (NGFW)

• Combines traditional firewall capabilities with other network security features.
• Can provide intrusion prevention, application awareness, and deep packet inspection.
• Can provide more granular control over network traffic than packet filtering firewalls.

• Can be expensive.
• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.

Hardware firewall

• Provides physical protection between a private network and the Internet.
• Can provide more granular control over network traffic than packet filtering firewalls.

• Can be expensive.
• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.

Software firewall

• Can be installed on a computer or server to protect against internal and external threats.
• Can provide more granular control over network traffic than packet filtering firewalls.

• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.

Cloud-based firewall

• Hosted in the cloud and provides network security for cloud-based applications and services.
• Can provide more granular control over network traffic than packet filtering firewalls.

• Can be expensive.
• Can introduce latency.
• Can be complex to configure.
• Can be vulnerable to attacks that exploit protocol weaknesses.