Before comparing firewall models, agree the traffic paths, application access and policy responsibilities the design must support. This guide helps IT and procurement teams frame the architecture and the migration questions before a product decision.
Describe the flows and trust boundaries
List users, application paths, remote access and network segments. State which flows are permitted and who owns the policy. NIST firewall guidance offers foundational policy-planning principles, not a product ranking or an Express certification.
Separate security layers
A network firewall, web application firewall, SASE service and application-delivery platform have different roles. Compare the proposed control to the actual traffic and existing identity, routing and provider dependencies.
Plan the operational change
Review rules, licenses, certificates, logs and high-availability needs. Agree validation and rollback before cutover. The design should identify who approves changes and handles alerts after installation.
Technical reference
NIST SP 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy: csrc.nist.gov Published in 2009; use current vendor documentation for product configuration.
Is one security layer a substitute for all others?
No. Match the layer to its defined function and assess the remaining controls.
Should every old rule be copied?
Review its purpose, dependencies and compatibility before retention.