NetContinuum this week is scheduled to launch an updated version of its application-firewall appliance for protecting HTML-based and some non-Web applications from about 4,000 known attacks aimed at subverting servers.

NetContinuum's Web Security Gateway 4.0 adds a way to guard against attacks aimed at 22 TCP and User Datagram Protocol (UDP) ports used by Oracle databases, application servers and e-commerce applications.

NetContinuum also has built a stateful-inspection firewall directly into its Web Security Gateway with the idea that IT managers wouldn't have to buy a separate network firewall, as they often do now, to place in front of the Web application firewall.

"It comes from a desire to simplify the DMZ," says Wes Wesson, NetContinuum's vice president of marketing. There are too many devices in the firewall-based demilitarized zone at the perimeter of corporate access to the Internet, he says.

Independent test lab, ICSA Labs is testing Web Security Gateway 4.0's integrated stateful-inspection firewall. Beta versions are available now, and general availability is expected at the end of next month.

NetContinuum will be the first vendor - competitors include KaVaDo, Sanctum and Teros - to integrate a traditional firewall that blocks TCP and UDP port access into an application firewall that works by stopping a variety of attacks, such as cross-site scripting or SQL Injection.

While some IT managers like the idea of blending the two capabilities into one unit, others are less convinced this is a good path. 

"We'd want to have a separate firewall in front of the Web application firewall," says Eric Beasley, senior network administrator at Baker Hill, which hosts online loan applications for about 100 banks in the U.S. "There are a growing number of multi-function devices, but I'm shying away from them because I'm not sure they represent the best of breed."

Baker Hill, which is in Indianapolis, puts Check Point and Nokia firewalls in front of Teros Secure Application Gateways appliances in three sections of its network to block possible attacks against internal Microsoft-based applications. The network-layer firewall is an added line of defense, especially if the application firewall fails for any reason, Beasley maintains.