Application layer firewalls can filter traffic at the network, transport, and application
layer. Filtering at the application layer also introduces new services, such as proxies.
Application proxies are simply intermediaries for network connections. Assume that a user
in the internal network wants to connect to a server in the external network. The
connection of the user would terminate at the firewall; the firewall would then create
a connection to the Web server. It is important to note that this process occurs seamlessly
to the user and server.
As a result of the proxy, the firewall can potentially inspect the contents of the packets, which
is similar to an intrusion detection system (IDS). This is increasingly important, since a
growing number of applications, as well as illegitimate users, are using nonstandard port
numbers to transmit data. Application layer firewalls are also necessary if an existing
connection may require the establishment of another connection—for example, the
Common Object Resource Broker Architecture (CORBA).
Increasingly, firewalls and other security devices are being merged into a single device
that can simplify management. For example, an intrusion prevention system (IPS) is a
combination firewall and IDS. An IPS can filter packets based on the header, but it can
also scan the packet contents (payload) for viruses, spam, and certain types of attacks.