baselineRFIWhat deep packet inspection and application-identification capability does the platform provide beyond port/protocol filtering — how many applications are identified out of the box, and how are new/unknown applications classified?weight 3
Answer key — what a strong answer shows
Look for a specific application-identification count and a described classification methodology for unknown traffic, not just 'Layer 7 visibility.'
baselineRFPDescribe threat-prevention throughput (IPS/threat-prevention enabled, not just firewall-only) at a stated hardware/virtual tier, and provide a customer-validated real-world throughput figure versus the vendor's lab-tested maximum.weight 3
Answer key — what a strong answer shows
Throughput often drops significantly with full threat-prevention features enabled — look for a real-world figure distinct from the marketing maximum.
baselineRFIHow does the platform handle encrypted traffic inspection (SSL/TLS decryption) at scale, including which certificate types and TLS versions are supported, and the performance impact when decryption is enabled?weight 3
Answer key — what a strong answer shows
Strong answers state a specific performance impact figure for decryption enabled versus disabled, since this is a common gap between marketing throughput and real deployed performance.
baselineRFIDoes the platform support Zero Trust segmentation/microsegmentation natively, or does it require a separate product, and how is policy managed across a hybrid on-prem/cloud/branch environment from one console?weight 3
Answer key — what a strong answer shows
Look for genuinely unified policy management across environments, not separate consoles per deployment location requiring manual reconciliation.
baselineRFPDetail centralized management at scale — how many firewalls/branches can a single management console handle, and what is the typical policy-push time for a global rule change across a large distributed deployment, per a customer reference?weight 3
Answer key — what a strong answer shows
Look for a real customer-referenced figure for scale and policy-push latency, not a theoretical maximum.
baselineRFIWhat SD-WAN integration exists — is it native to the firewall platform, or does it require a separate overlay product, and how is security policy applied consistently across SD-WAN paths?weight 3
Answer key — what a strong answer shows
Native SD-WAN integration avoids policy fragmentation between the security and networking layers; a bolted-on separate SD-WAN product often creates gaps.
baselineRFPExplain high-availability and failover architecture — stated failover time, and whether active sessions survive a failover event without disruption, backed by a customer-tested example.weight 3
Answer key — what a strong answer shows
Look for a real customer-tested failover time and session-persistence confirmation, not just an architecture diagram claim.
baselineRFIHow does the platform integrate threat intelligence feeds (built-in vendor feed versus support for third-party/custom feeds), and what is the update frequency for newly identified malicious IPs/domains?weight 3
Answer key — what a strong answer shows
Look for a stated update frequency and confirmation that third-party/custom feeds can be ingested, not just a closed proprietary feed.
baselineRFIWhat is the licensing/pricing model — perpetual hardware license, subscription, or a hybrid — and are threat-prevention/IPS features bundled or a separate paid subscription on top of base firewall functionality?weight 3
Answer key — what a strong answer shows
Look for transparent, explicit disclosure of what's bundled versus a paid add-on; threat-prevention features gated behind a separate subscription is a common way buyers underestimate real total cost.
baselineRFPDescribe device-fingerprinting and IoT/OT-aware network access control — can the platform identify and apply differentiated policy to unmanaged/IoT devices on the network distinct from managed corporate endpoints, and provide a customer reference.weight 3
Answer key — what a strong answer shows
IoT/unmanaged-device-aware policy is a materially more advanced capability than treating all network traffic uniformly — ask for a concrete example of differentiated policy in production.
baselineRFIWhat virtual/cloud-native firewall deployment options exist (VM-based, container/CNF, cloud-marketplace images for AWS/Azure/GCP) as an alternative to physical hardware appliances, and is feature parity maintained between hardware and virtual form factors?weight 3
Answer key — what a strong answer shows
Look for an explicit answer on feature parity — virtual form factors sometimes lag behind hardware appliances in capability, which matters for a customer building a hybrid or cloud-first architecture.
baselineRFIDoes the platform hold relevant compliance/security certifications (Common Criteria, FIPS 140-2/140-3) required for government or highly regulated customers, and at what specific certification level?weight 3
Answer key — what a strong answer shows
Ask for the specific certification level and scope — a vague 'certified' claim without a level and validation number is not sufficient evidence for regulated buyers.
baselineRFPExplain automated response integration — when the IPS/threat-prevention engine detects an active exploit attempt, can it automatically trigger a broader response (e.g., quarantine the source host via EDR/NAC integration), or does response stop at simply blocking the traffic?weight 3
Answer key — what a strong answer shows
Cross-tool automated response (not just traffic blocking) is a materially stronger security outcome — ask for a concrete integration example, not just a generic 'integrates with your stack' claim.
baselineRFIWhat is a customer-referenced migration timeline and process for replacing an incumbent firewall vendor (rule/policy translation tooling, parallel-run period, cutover risk mitigation), and what tooling exists to automate policy migration versus manual rebuild?weight 3
Answer key — what a strong answer shows
Strong answers describe real migration tooling and a concrete, customer-validated timeline; a vendor with no migration story is asking the customer to manually rebuild potentially years of accumulated firewall policy from scratch.
baselineRFIHow is policy and management consistently delivered to remote/branch offices and a distributed remote workforce — is this the same NGFW platform extended via SD-WAN/cloud delivery, or does remote coverage require an entirely separate product (e.g., a SASE/SSE add-on)?weight 3
Answer key — what a strong answer shows
Look for a coherent single-platform story across headquarters, branch, and remote workforce; a fragmented answer requiring multiple disconnected products for different populations is a real operational complexity cost.
baselineRFPWhat is the measured false-positive rate on IPS/threat-prevention specifically (legitimate traffic incorrectly blocked), and what tuning support or default-policy maturity minimizes business disruption during initial rollout, backed by a customer reference?weight 3
Answer key — what a strong answer shows
A false positive on an inline blocking firewall directly breaks legitimate business traffic — ask for a real customer-validated false-positive figure and rollout-tuning process, not just a detection-accuracy claim.
baselineRFPProvide firewall administration, configuration, monitoring, and best practices.weight 3
baselineRFPProvide periodic firewall reviews with a report and debriefing upon completion.weight 3
baselineRFPDemonstrate configuration, support, and architectural design experience with AppDynamics, Azure Application Insight, HP Fortify, F5 Web Application Firewall, Checkpoint Next-Generation Firewalls, Microsoft SQL databases, and cloud/hybrid/on-premise application platforms in an enterprise environment.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
