Application-aware firewall rules Signature-based IPS/IDS threat detection Content, country, domain, and ad filtering VLAN/subnet-based traffic segmentation Full stateful firewall