Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls

Question

All of the material I'm reading on Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls indicates that they are inherently unique devices / applications. But the descriptions for each are so similar that it seems like there should be a broader relationship. I understand what each one does on it's own, but the line between them is really blurry.

For instance, doesn't a proxy firewall, which reads application layer data, inherently provide content inspection? Wouldn't that be the exact description of an application layer firewall?

Can anyone provide some real-world examples of when / why to implement each one of these devices vs any of the others?

Answer 1

A web proxy is the part of an Application Layer Firewall which does Content Inspection for connections from client (i.e. browser) to the web server. It resides on the side of the client and its task is to protect the client against malware etc. A Web Application Firewall (WAF) is a different part of an Application Layer Firewall which also does Content Inspection but sits in front of the server. Its task is to protect the server against application layer attacks like SQL injection. In a way a WAF is also a proxy, but a reverse proxy. Some Application Layer Firewalls provide both web proxy and WAF, others only one. This depends on what the firewall is used for.

Apart from these basics there are other kinds of proxies for different protocols (i.e. mail, ftp...) which can also be part of an Application Layer Firewall. The quality and depth of content inspection between various products differs a lot but all of them provide at least a basic parsing of the application protocol.