I am looking into putting a Firewall in front of our web servers. But we just recently implemented new next-gen firewalls. Does it make sense to put a WAF in front of our web servers as well?
closed as too broad by Steffen Ullrich, Xander, Conor Mancone, YLearn, schroeder♦ Sep 6 at 6:34
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The answer to this question would be reliant on the capabilities of your 'nex-gen' firewall. If your ng-firewall offers the ability to perform deep packet inspection and detect and prevent web application vulnerabilities, you need to figure what the delta is for the ng-firewall with a waf. If both offers the same capabilities and have no significant delta, addition of WAF could be an unnecessary expense.
That being said, WAF are generally built with a specific intention - Look at the application traffic and prevent application specific attacks. It is likely to serve better for that puspise than a nex-gen firewall for that purpose.