2 cissp ® Official Study Guide Eighth Edition

Stateful Inspection Firewalls Stateful inspection firewalls
(also known as 
dynamic packet 
filtering firewalls
) evaluate the state or the context of network traffic. By examining source 
and destination addresses, application usage, source of origin, and relationship between 
current packets and the previous packets of the same session, stateful inspection firewalls 
are able to grant a broader range of access for authorized users and activities and actively 
watch for and block unauthorized users and activities. Stateful inspection firewalls gener-
ally operate more efficiently than application-level gateway firewalls. They are known as 
third-generation firewalls, and they operate at the Network and Transport layers (layers 3 
and 4) of the OSI model.
Deep Packet Inspection Firewalls Deep packet inspection (DPI) firewalls
is a filtering mech-
anism that operates typically at the application layer in order to filter the payload contents of 
a communication rather than only on the header values. DPI can also be known as complete 
packet inspection and information extraction (IX). DPI filtering is able to block domain 
names, malware, spam, or other identifiable elements in the payload of a communication. DPI 
is often integrated with application layer firewalls and/or stateful inspection firewalls.
Next-Gen Firewalls
A next-gen firewall is a multifunction device (MFD) composed of sev-
eral security features in addition to a firewall; integrated components can include an IDS, 
an intrusion prevention system (IPS), a TLS/SSL proxy, web filtering, QoS management, 
bandwidth throttling, NATing, VPN anchoring, and antivirus.

---

490
Chapter 11 
■
Secure Network Architecture and Securing Network Components