I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?

closed as too broad by Steffen Ullrich, Xander, Conor Mancone, YLearn, schroeder Sep 6 at 6:34

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    I consider this question as too broad. It is unclear what functionality your current next-gen firewall actually provides and what you use of this and how plan to use the WAF exactly and what needs to be protected (serving static files, dynamic web application, or even other things?) – Steffen Ullrich Sep 5 at 17:27
  • 1
    Agree with Steffen, but as a general hint: usually WAFs and firewalls do completely different things (although I suppose I have no idea what a "next-gen firewall" does). "Should I use a WAF" is a question that only you can answer, and you can only answer that yourself once you have a clear understanding of what a WAF is and what purpose it would serve. I have a suspicion it might help if you spent some more time figuring out your own needs and what these things do. – Conor Mancone Sep 5 at 18:08
  • Please provide information on why do you want to use a WAF, details of your web app, has it undergone Web_App_scan, etc – nocut Sep 5 at 18:18

The answer to this question would be reliant on the capabilities of your 'nex-gen' firewall. If your ng-firewall offers the ability to perform deep packet inspection and detect and prevent web application vulnerabilities, you need to figure what the delta is for the ng-firewall with a waf. If both offers the same capabilities and have no significant delta, addition of WAF could be an unnecessary expense.

That being said, WAF are generally built with a specific intention - Look at the application traffic and prevent application specific attacks. It is likely to serve better for that puspise than a nex-gen firewall for that purpose.

Not the answer you're looking for? Browse other questions tagged or ask your own question.