I would like to know from an information security respect, is antivirus software needed to be separate from the firewall?

In my company, they have a Palo Alto firewall and they mention that it is a firewall and antivirus. Is that is acceptable in information security, or must they be separate? Is that good solution or does it need to be changed?

2 Answers 2


It all depends on where you want the detection to be. Antivirus on the perimeter firewall detects viruses traveling across your perimeter. Antivirus on the computer detects malware on the computer. You need both. If you only have one, you lack the detection capabilities of the other.

For instance, if only on the perimeter, a virus can be built on a computer or passed computer to computer. If only on the computers, then rogue devices can send viruses out or viruses can come in and threaten devices that do not have antivirus (or are not updated).

One reason why you might not want antivirus on the firewall is if this extra feature increases the load on the firewall. But that is not a security concern, but an operational one.


Do they need to be separate? No, but it's a bad idea to only rely on perimeter security and do nothing on the endpoint. The question comes down to defense in depth. You can put AV on the firewall, which will do a decent job of catching malware as it comes in via the web. That, however, won't do anything once malware is inside the perimeter, such as malware introduced via a thumb drive. Also, unless you have a segmented network, a network worm (once introduced) would have very little to stop it from infecting every device on the network if you don't have endpoint AV active.

You don't want to go crazy with security tools; each added tool has a performance, administrative, and cost impact and eventually you can wind up with multiple tools working at cross-purposes. However, adding AV to your firewall is a good step and can help protect your endpoints from malware traversing the firewall. Like any tool, it's never 100% so an additional layer (AV on the endpoint) is needed to cover what the firewall AV allows by.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .