Terminal Access Point (TAP) mode
Next-Generation Firewall (NGFW)
Proxy
A simple hardware device copies all network traffic for offline analysis, including SSL inspection.
Network connections stream through an NGFW with only packet-level visibility, which limits threat detection.
Two separate connections are created between client and server, with full inspection across network flow and sessions.
Expensive hardware (e.g., 10G network TAPs) is required to ensure all traffic is copied at full line rate without data loss.
NGFWs only see a fraction of malware, allowing it to be delivered in pieces. They require bolt-on proxy functionality and tend to underperform when key features like threat prevention are enabled.
Entire objects can be reassembled and scanned, allowing for scanning by additional threat detection engines, such as sandbox and DLP.
Retrospective SSL inspection no longer works due to “perfect forward secrecy,” which requires new keys for every SSL session.
Performance drops notably due to the higher performance and scale requirements of TLS 1.3 ciphers, requiring a hardware upgrade to overcome.
In the case of a cloud proxy delivered as a service, no appliance refresh is required on the customer side to meet TLS 1.3 performance and scale needs.