By Avic Bose
Principal Systems Engineer, Versa Networks
October 17, 2022
Introduction
With the initial introduction of the Secure Access Service Edge (SASE) model in 2019, Gartner defined a framework for a converged security and networking services category. This product category quickly gained broad industry adoption due to accelerating global trends, such as the need to accommodate Work-from-Anywhere (WFA) use cases. As a further response to industry trends toward adoption of SaaS and Cloud applications, Gartner introduced the Security Services Edge (SSE) category in early 2022 to provide a cloud-centric model for security. Most SSE vendors today offer FWaaS as a part of their SSE offering. Most SSE vendors also include Secure Web Gateway (SWG) in additional to FWaaS as a part of their core SSE offering and often there in not a very clear distinction between these two services, thereby creating additional queries with regards to the difference and use cases of these two products. The purpose of this article is giving more insight about these two services.
Definitions
Secure Web Gateway (SWG) as defined by Gartner is “A solution that filters unwanted software/malware from user-initiated Web/Internet traffic and enforces corporate and regulatory policy compliance.” What this entails is a security solution that inspects any outbound internet /web traffic and applies a wide range of security checks, including but not limited to URL Filtering, Application Control (allow sanctioned and Tolerated apps and apply granular controls on them like share, upload, download, login etc. while blocking Unsanctioned apps), Anti-Malware Scanning. Secure Web Gateways thus by design are limited to inspecting web protocols like HTTP and primarily for outbound traffic inspection.
Firewall-as-a-Service, as the name suggests, is a firewall that is hosted in a cloud environment and delivered as a service. The main advantage of Firewall as a Service is the scale as compared to traditional on-prem firewalls. The main use cases of Firewall-as-a-Service is to inspect traffic that may fall outside the purview of Secure Web Gateway and provide additional security features like ZTNA, Intrusion Prevention, Application Identification, etc. for outbound traffic inspection.
Differences
The following table illustrates the main key differences between Firewall-as-a-Service and Secure Web Gateway:| SI NO | FEATURE | SECURE WEB GATEWAY | FWAAS |
|---|---|---|---|
| 1 | Traffic Inspection Direction | Outbound | Outbound |
| 2 | Protocol Support | Internet/Web Traffic limited to HTTP, HTTPS | All other protocols including DNS which are not inspected by Secure Web Gateway |
| 3 | Security Features | Anti-Malware, URL Filtering, Applicatino, Control for SaaS applications, SSL Decryption | IPS, DNS Security, App Identification, ZTNA |
| 4 | End User Traffic on-boarding Method | Explicit Proxy, PAC File | SASE Client |
Use cases
The following table illustrates the use cases where an organization may prefer to use FWaaS or Secure Web Gateway or both:
| SI NO | USE CASE | COMPONENT |
|---|---|---|
| 1 | Inspect Branch Traffic | SWG + FWaaS |
| 2 | Inspect only web traffic from remote endpoints | Secure Web Gateway |
| 3 | Inspect all traffic from remote endpoints | FWaaS |
| 4 | ZTNA | SWG/FWaaS |
Analysis
Today most of the SSE vendors offer both SWG and FWaaS as a part of their core SSE offering and generally do not provide a very clear distinction between these 2 services. Although most SSE vendors do offer both SWG and FWaaS as part of their core SSE offering, it can be confusing for businesses to understand the different value propositions for these services. The primary reason for the same is all the SSE vendors have as the primary Security Solution to be either a Secure Web Gateway or a Next Gen Firewall hosted on the cloud. Some Vendors have:
Next Gen Firewall as their core security offering on which SWG functionality have been added like the ability to onboard remote endpoints using an explicit proxy (PAC) file
while other vendors have.
Secure Web Gateway as their core security offering on which firewall functionality has been added to increase the number of protocols and services they can scan and provide additional security features like IPS.
However, as previously demonstrated, there is a clear distinction between Secure Web Gateways and FWaaS and each of these services have their own distinct use cases. It is advised that customer’s evaluating an SSE vendor, depending on their requirement, should either select a vendor which is offering
FWaaS with SWG functionalities or
a vendor which is offering Secure Web Gateway with FWaaS functionalities in-built. In addition, SSE Solutions of FWaaS with SWG functionalities offer some additional advantages as compared to SSE Solutions of SWG with FWaaS functionalities which are listed below:
Support for a wider range of protocols including voice protocols like SIP, VOIP, ACTIVE FTP
Ability to apply the same set of security controls for both Internet and Private Access Traffic.
ZTNA engine is a part of the core firewall functionality and hence no additional components are required to implement the ZTNA solution including installation of additional VM’s.
Support for server-initiated traffic for Private Access
Conclusion
Versa SSE offers both SWG and FWaaS services from dedicated SSE Gateways using its highly rated Next Gen Firewall with SWG capabilities. Since, the Versa Next Gen Firewall Platform already has native capabilities w.r.t Dynamic Protocol Support, Integrated ZTNA Engine and one single policy for both Internet bound and ZTNA traffic. Versa SSE offers these unique advantages to its users.
