I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
3
-
4I consider this question as too broad. It is unclear what functionality your current next-gen firewall actually provides and what you use of this and how plan to use the WAF exactly and what needs to be protected (serving static files, dynamic web application, or even other things?)– Steffen UllrichSep 5, 2019 at 17:27
-
1Agree with Steffen, but as a general hint: usually WAFs and firewalls do completely different things (although I suppose I have no idea what a "next-gen firewall" does). "Should I use a WAF" is a question that only you can answer, and you can only answer that yourself once you have a clear understanding of what a WAF is and what purpose it would serve. I have a suspicion it might help if you spent some more time figuring out your own needs and what these things do.– Conor ManconeSep 5, 2019 at 18:08
-
Please provide information on why do you want to use a WAF, details of your web app, has it undergone Web_App_scan, etc– nocutSep 5, 2019 at 18:18
Add a comment
|
1 Answer
The answer to this question would be reliant on the capabilities of your 'nex-gen' firewall. If your ng-firewall offers the ability to perform deep packet inspection and detect and prevent web application vulnerabilities, you need to figure what the delta is for the ng-firewall with a waf. If both offers the same capabilities and have no significant delta, addition of WAF could be an unnecessary expense.
That being said, WAF are generally built with a specific intention - Look at the application traffic and prevent application specific attacks. It is likely to serve better for that puspise than a nex-gen firewall for that purpose.
