The 7 Types of Firewalls: What Each One Protects and Where It Fits

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

The seven types of firewalls Canadian businesses encounter in 2026 are packet filter, stateful inspection, proxy (application gateway), next-generation firewall (NGFW), unified threat management (UTM), web application firewall (WAF), and cloud-native firewall. Each inspects traffic at a different layer, and most defensible Canadian SMB stacks run two or three of them together rather than relying on one box at the edge.

Book a Free IT Business Consultation

What does a firewall actually do in 2026?

A firewall is a policy enforcement point that decides which traffic crosses a network boundary. NIST SP 800-41, the reference guideline on firewalls and firewall policy, defines that boundary broadly: between two networks, between a host and a network, or between two internal segments. Every one of the 7 firewall types applies that same idea at a different layer of the stack.

Most Canadian SMB traffic is now encrypted, identity-driven, and routed through SaaS or remote sessions. A firewall built only for ports and IP addresses cannot see inside that traffic. The job of a modern firewall is to identify the application, the user, and the threat behaviour on each session, then apply policy that follows the user across office, home, and cloud.

That is why firewall conversations now span three planes: the network edge (NGFW), the public-facing web app (WAF), and the cloud workload (cloud-native). Choosing the wrong type for the plane is the most common architectural error Fusion Computing sees during assessments.

The 7 main firewall types

The Canadian Centre for Cyber Security baseline controls (v1.2) call for a dedicated firewall between the corporate network and the internet, plus firewall isolation for wireless and point-of-sale zones. The baseline stops there and names no product categories. The 7-category comparison below is Fusion’s own way of mapping products to the workloads they protect.

Vendor category labels overlap heavily. Ignore the label on the box and compare the controls, the tested throughput, and the operating model you actually need. Knowing where each of the 7 types sits on the OSI model is what stops a business paying NGFW prices for basic port-and-state filtering.

Gartner retired its Magic Quadrant for Network Firewalls and replaced it with the Magic Quadrant for Hybrid Mesh Firewall, whose first edition landed in August 2025 with Palo Alto Networks, Fortinet, and Check Point named Leaders. The rename is the point: Gartner now scores a vendor on managing hardware, virtual, and cloud enforcement from one plane. Firewall type still follows the threat model rather than vendor preference.

NGFW vs UTM: how to tell them apart

The Canadian Centre for Cyber Security (2025) reports ransomware remains the top cybercrime threat to Canadian critical infrastructure. AI-assisted attacks are raising both the pace and the sophistication of intrusions. That is why the NGFW vs UTM distinction matters when comparing firewall types: it decides how deeply the edge box inspects the sessions those attacks arrive on.

NGFW and UTM both sit at the network edge and ship with long feature lists. The distinction is whether application identification and intrusion prevention run at Layer 7 on the same policy engine at production throughput, or sit beside a stateful core as bolt-ons.

An NGFW such as Fortinet FortiGate, Palo Alto PA-Series, or Cisco Firepower identifies traffic by application signature first, then user identity from Entra ID, then enforces IPS, URL filtering, and TLS inspection in one pass.

UTM describes the older pattern: a stateful core with antivirus, anti-spam, and web filtering bolted alongside it as parallel modules. Treat both words as vendor marketing categories rather than a reliable taxonomy, because most vendors now brand entry-level appliances as NGFWs. SonicWall’s own Gen 7 TZ series is marketed as a next-generation firewall line.

The datasheet is where the real answer lives. SonicWall publishes 2 Gbps firewall inspection throughput for the TZ270 and 750 Mbps threat prevention throughput for that same appliance. The second number, roughly a third of the first, is what a Canadian branch office actually gets at 5pm on a Friday with the security services switched on.

So skip the category argument. Ask for the vendor’s published throughput for the exact model with your controls switched on, TLS inspection included, and size on that number. On the TZ270, sizing on 2 Gbps instead of 750 Mbps overstates the appliance by a factor of 2.7 before a single rule is written. Our firewall migration plan documents the rule-base audit that exposes the gap before a contract is signed.

Not sure which side of the line your edge box falls on? Ask a CISSP-led engineer to read your running config →

Network firewalls vs cloud-native firewalls

Network firewalls protect the boundary of an on-premise or co-located environment. Cloud-native firewalls protect virtual networks inside a hyperscaler. They are not interchangeable. A FortiGate at the office edge does not see lateral traffic between Azure subnets. Azure Firewall can inspect branch traffic, but only where that branch is routed through a secured virtual hub, which is a deliberate network design rather than something the office firewall gives you.

Three cloud-native services come up in most Canadian SMB environments we assess. Microsoft Azure Firewall is the default for Azure-hosted workloads, billed per hour with managed threat intelligence from Microsoft Defender.

AWS Network Firewall sits in a VPC and uses Suricata-compatible rules. In Google Cloud the two jobs split: Cloud NGFW and VPC firewall rules govern traffic inside the virtual private cloud, while Cloud Armor is an edge DDoS and web application control in front of supported load-balanced services.

For hybrid environments the right pattern is an NGFW at every physical site plus a cloud-native firewall in each cloud tenant, with logs flowing to a single security information and event management (SIEM) platform such as Microsoft Sentinel. Backhauling cloud traffic through an on-premise NGFW adds latency and creates a single point of failure.

“Their CISSP-led monthly reviews caught a misconfigured firewall before our auditor did.”

Web application firewalls (WAF) and where they fit

A WAF inspects HTTP and HTTPS requests bound for a specific web application. It does not replace an NGFW, and it does not replace secure application design either. The NGFW protects the network plane. A WAF filters malicious HTTP requests in front of the application, which reduces exposure to several classes in the OWASP Top 10 without curing the underlying defects.

Be precise about what that buys you. Broken access control sits at A01 in the OWASP Top 10, and OWASP’s own guidance places the effective control in trusted server-side code rather than at the edge. A WAF blunts some request patterns while server-side authorization does the actual work, which is why 1 well-tuned WAF rule set never closes an authorization defect.

Cloudflare WAF, AWS WAF, and Azure Front Door WAF are the managed options we meet most often in Canadian SMB environments. On-premise WAFs from F5 and Imperva still appear where a contract or a sector rule requires traffic to terminate inside Canada.

If a Canadian SMB runs a customer portal, ecommerce store, or member login, application-layer filtering belongs on the shortlist. CIS Controls v8.1 Safeguard 13.10 asks for application layer filtering at implementation group 3, naming a filtering proxy, application firewall, or gateway as the options, so a WAF is one way to satisfy it rather than a universal requirement. Use one where the threat model and the application architecture justify it.

Running a public web app without a WAF in front of it? Managed Cybersecurity Services → covers all three planes.

Hardware vs virtual vs cloud delivery

The major enterprise platforms ship in 3 delivery models, though not every category is sold in all three. The same FortiGate operating system runs on a rack appliance, a virtual machine, and a cloud image, while a cloud-native firewall exists only as a cloud service. Picking the wrong form factor adds cost without adding security, so the comparison below leads with fit rather than features.

The right Canadian SMB stack often blends all three: hardware FortiGate at the office, FortiGate VM in Azure, Cloudflare WAF in front of the customer portal.

How to choose the right firewall for a Canadian SMB

The Canadian Centre for Cyber Security baseline requires a firewall at the boundary but leaves the product choice open. Fusion Computing fills that gap with the same 5-criterion rubric on every firewall assessment, because it is the fastest way to cut 7 categories of marketing down to one defensible short list for a Canadian SMB.

1. What is being protected. Office network, cloud workload, public web app, or all three. Each plane wants a different firewall type.
2. Inspection depth. Decide how deep inspection needs to go from your own risk assessment and your insurer’s stated conditions. PIPEDA requires safeguards proportionate to the sensitivity of the information and does not prescribe TLS decryption or intrusion prevention.
3. Throughput with features on. Sustained throughput with IPS, application control, and TLS decrypt all enabled. Headline numbers are marketing.
4. Operational ownership. Who patches firmware, rotates certificates, reviews logs, and tunes rules. If no one owns it, the firewall degrades quietly.
5. Data location. Know where inspection logs are stored and who can reach them. Canadian privacy law does not impose a blanket residency rule: the Office of the Privacy Commissioner treats cross-border processing as permitted with appropriate safeguards, and Ontario’s PHIPA section 50 sets conditions rather than a prohibition. Residency obligations usually arrive through your contracts and sector rules, so confirm yours before making it a selection criterion.

For a 25 to 200 user Canadian SMB running a hybrid environment, Fusion typically lands on an NGFW at every physical site, a cloud-native control in each cloud tenant, and a WAF in front of any public web app. The fourth item carries as much weight as the other three: a managed contract that names the engineer responsible for each box.

Want the 5-criterion rubric applied to your own environment? Book a Free IT Business Consultation and walk through it with an engineer, not a rep.

Field Note, Mike Pearlstein: The account-takeover cases I get called about are rarely a perimeter problem, and buying a bigger firewall would not have stopped them. A Microsoft 365 admin portal is Microsoft-hosted, so a customer-managed WAF does not sit in front of Microsoft’s application. Edge devices may still proxy or inspect outbound Microsoft 365 traffic, but they do not control that portal’s authentication or authorization.

That surface is defended at the identity layer instead. Microsoft recommends phishing-resistant multi-factor authentication for privileged roles, and Conditional Access can add location or device conditions on top. Check those before you budget for hardware, because no firewall line item substitutes for them.

A firewall is one tier of a larger toolset. Our breakdown of the software and tools behind Fusion’s managed IT shows where the perimeter sits against endpoint, identity and email defence.

Firewall mistakes that get Canadian SMBs breached

Every firewall type can be deployed badly. IBM’s Cost of a Data Breach 2025 report puts the global average breach at $4.4M USD. The firewall post-incident reviews I have sat in keep ending the same way, across vendors and across sectors: the box was present and licensed, but the one feature that would have stopped the intrusion was switched off.

• Treating one firewall as the whole network plan. An NGFW at the edge does nothing for cloud east-west or public web app traffic.
• Leaving TLS decryption disabled. Google’s HTTPS transparency report, which measures pages loaded over HTTPS in Chrome by platform, shows HTTPS is now the norm in Chrome, though the exact share moves with the platform and with whether private-site navigations are counted. Without selective decryption a firewall cannot read encrypted payloads, though it can still act on connection metadata, certificate details, and domain reputation.
• IP-based rules instead of identity. Static IP allowlists break the moment staff work from home. Identity-aware policy through Entra ID or Okta is the modern baseline.
• No log review. CIS Controls v8.1 names log review as a primary control. Without a SIEM or managed SOC, alerts are noise no one reads.
• No application-layer filtering. A public web app needs controls matched to its architecture. A WAF is one option for filtering malicious HTTP requests and bot traffic, and it does not replace server-side authorization, rate limiting, or identity controls.
• End-of-support hardware. Once threat-intel feeds and firmware updates stop, the box is a liability. Replace on the vendor’s published end-of-support date for that model, which is knowable years ahead, rather than on the appliance’s age.

Why firewall type maps to threat plane: NIST SP 800-41 Guidelines on Firewalls and the Canadian Centre for Cyber Security network baseline both frame firewall selection by what is being protected, not by vendor. Gartner’s first Magic Quadrant for Hybrid Mesh Firewall (August 2025), which supersedes its Network Firewalls quadrant, names Palo Alto Networks, Fortinet, and Check Point as Leaders. Sources: NIST SP 800-41, cyber.gc.ca, Gartner Magic Quadrant for Hybrid Mesh Firewall 2025.

Why WAF and NGFW are not substitutes: a WAF filters malicious HTTP requests in front of 1 application; an NGFW enforces policy on the network plane. CIS Controls v8.1 Safeguard 13.10 asks for application layer filtering and accepts a filtering proxy, application firewall, or gateway. OWASP puts the effective control for broken access control in server-side code, so neither box substitutes for secure application design. Sources: OWASP Top 10 A01, CIS Controls v8.1 Safeguard 13.10.

Firewall stack reviews are run by a CISSP-led team at a Microsoft Solutions Partner.

Book a Free IT Business Consultation

Frequently asked questions

What are the main types of firewalls?

Seven categories matter in 2026: packet filter, stateful inspection, proxy, next-generation firewall (NGFW), unified threat management (UTM), web application firewall (WAF), and cloud-native firewall. Each inspects traffic at a different layer and protects a different threat plane.

Is an NGFW the same as a UTM?

No, and the labels overlap enough that most vendors now brand entry-level boxes as NGFWs. Read the datasheet instead: SonicWall lists 2 Gbps firewall inspection throughput for the TZ270 against 750 Mbps threat prevention throughput on the same appliance. Size on the second number.

Do I need both an NGFW and a WAF?

Not as a universal rule. An NGFW protects the network plane. If a public web app is in scope, add application-layer filtering that fits the architecture, and a WAF is one option: CIS Controls v8.1 Safeguard 13.10 also accepts a filtering proxy or gateway. Neither control substitutes for server-side authorization.

What is a cloud-native firewall?

A firewall delivered as a managed service inside a hyperscaler. The cloud controls we see most in Canadian SMB environments are Azure Firewall and AWS Network Firewall, which govern virtual private cloud traffic. In Google Cloud that job belongs to Cloud NGFW and VPC firewall rules, while Cloud Armor protects supported load-balanced services at the edge. Pricing varies by service and tier, so read the vendor’s current page rather than assuming usage billing.

Hardware, virtual, or cloud delivery, which is best?

A hybrid environment usually ends up with more than one. Hardware NGFW at the office, virtual NGFW in the data centre or co-location, and a cloud-native control plus a WAF in the cloud tenant. The right delivery follows the workload rather than a preferred form factor.

FortiGate, Palo Alto, or Cisco for a Canadian SMB NGFW?

FortiGate is the Fusion default for 10 to 200 users on price-to-feature and FortiAnalyzer logging. Palo Alto Networks fits regulated environments at higher cost. Cisco Firepower suits sites already running Cisco networking gear.

Where does Cloudflare WAF fit?

In front of a public web app, customer portal, or ecommerce site where the architecture supports it. It filters malicious HTTP requests, throttles bots, and applies targeted virtual-patching rules without code changes. It does not fix application defects such as broken access control.

How long does a firewall last before replacement?

Plan by support lifecycle, not by age. Fortinet, Palo Alto Networks, and SonicWall each publish a product lifecycle page listing end-of-support dates per model, and that date is the real replacement trigger because threat-intel feeds and firmware fixes stop with it. The second trigger is capacity: once inspected throughput with TLS decryption enabled no longer covers the internet link the site actually bought, the box is undersized whatever its age.

Does a firewall replace EDR?

No. The firewall defends the network, EDR defends the device. A defensible stack runs both with logs flowing to a single review queue such as Microsoft Sentinel.

Do firewalls help with PIPEDA compliance?

Yes. PIPEDA, PHIPA, Law 25, and British Columbia PIPA all expect documented technical safeguards. Firewall inspection logs, change records, and segmentation policy provide evidence of “reasonable” safeguards.

Can Fusion Computing manage a firewall we already own?

Yes. Fusion Computing runs rule-base audits, firmware currency checks, and ongoing management on existing FortiGate, Palo Alto Networks, SonicWall, and Cisco appliances. A healthy, supported appliance that meets your measured throughput and control requirements stays. We recommend replacement when vendor support ends, or when the box cannot deliver the capacity or the controls you need.

What should a firewall quote include for a Canadian SMB?

5 line items: the appliance or cloud service sized to user count and internet speed, security subscription licensing, TLS inspection capacity, professional configuration against a documented rule base, and named ongoing ownership for patching and log review. A quote missing the last two prices a box, not a defence.

A firewall ruleset is only as good as the scan that tests it. When you need proof rather than a scan report, a network penetration test shows which of those exposures an attacker could actually chain together. The network vulnerability assessment guide covers how external scans validate what a Canadian perimeter actually exposes.

Related Resources

• Managed Cybersecurity Services
• IT Infrastructure Security
• Firewall Migration Plan
• Network Security Testing
• Managed IT Services

Last updated: August 2026.