What are the three (or sometimes more) generations of firewalls, and how did they evolve historically?
Firewalls evolved in three classic waves: Packet Filters (1980s) → Stateful Inspection (1990s) → Application Layer Gateways (2000s+). "Next-Generation Firewall" (NGFW) is a marketing label for modern stateful firewalls with deep packet inspection — the term has been around 15+ years.
* Where each firewall generation inspects in the OSI stack. *
* Firewall generations: packet filter → stateful → ALG/proxy → NGFW. *
The three generations:
| Gen | Name | Layer | What it inspects | Era |
|---|---|---|---|---|
| 1 | Packet Filter | L3-L4 | Source/dest IP, port, protocol, TCP flags | 1980s |
| 2 | Stateful Inspection | L4 + state | Same as Gen 1 PLUS connection state | 1990s |
| 3 | Application Layer Gateway (ALG) / Proxy | L7 | Full application content (HTTP, FTP, SMTP) | 2000s+ |
Historical timeline:
| Era | Milestone |
|---|---|
| 1980s | First concepts of network access control. Routers with packet-filtering ACLs |
| 1990s | Internet boom → companies need protection. Commercial FW products. Stateful Inspection introduced (pioneered by Check Point's FireWall-1) |
| 2000s | Application-layer filtering, IPS integration → "Next-Generation Firewalls" |
| 2010s+ | Cloud, virtual appliances, AI/ML threat detection, IoT, Zero-Trust |
The "4th and 5th generation" myth:
Some marketing material talks about "generation 4" or "generation 5" firewalls — these aren't standard industry terms. As is often noted: "In Wirklichkeit gibt es keine solchen Bezeichnungen." Treat them as vendor branding, not technical categories.
The "Next-Gen Firewall" trap:
The term NGFW has been around since the early 2000s. What was "next-gen" in 2005 (basic deep-packet-inspection + IPS) is now the baseline. Today's "NGFW" usually means Gen 3 + IDS/IPS + application awareness + SSL inspection + threat intel feeds.
Tip: When evaluating a "Next-Gen" product, ignore the label and ask: does it do stateful inspection (Gen 2), application identification (Gen 3), and IDS/IPS integration? Those are the substantive features.
Go deeper:
Firewall (computing) — Wikipedia — its "History" section dates each generation (1st-gen packet filter 1987, 2nd-gen circuit-level 1989-90, 3rd-gen application 1993+).