Next-generation firewall for every branch, built in India
IPS, gateway antivirus, web filtering, application control and reputation blocking on the same edge that runs your SD-WAN, managed from one console.
- 5 engines
- IPS, antivirus, web filter, anti-spam, InstaShield IP
- 1 edge
- Firewall and SD-WAN on the same device
- ML-KEM
- Post-quantum VPN key exchange
In short. Nexapp NGFW puts IPS, gateway antivirus, web filtering, application control and reputation blocking on the same edge that runs your SD-WAN. Every site is managed from one console, and VPN tunnels use hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203). It is built by an Indian OEM with a 24×7 NOC in Pune.
Key facts
- One edge, two jobs
- Firewall and SD-WAN on the same device, under one policy.
- Threat protection
- IPS, gateway antivirus, web filtering, anti-spam and InstaShield IP reputation blocking.
- Application control
- DPI identifies applications so you can allow, steer or drop them.
- Quantum-safe VPN
- Hybrid classical + ML-KEM key exchange and ML-DSA authentication.
- Scale
- 75,000+ devices deployed across 400+ enterprise and banking customers since 2014.
- Certifications
- IEC 62443, TEC MTCTE, CE, RoHS. TEC MTCTE certificate 244903206 (valid to March 2035) covers Instaroute IR1100, ODU and IRX100-5G routers, not the IRX100-5Gv2 or IRX400 to IRX5000 edges.
Security on the edge
See every threat stopped at every branch
IPS, gateway antivirus, web filtering, anti-spam and InstaShield IP reputation, managed as one policy across the estate from the Nexapp Controller.
Home / Access Control / Security
Security events
Intrusions blocked
4,902
↓ 8% vs last week
Malware stopped
1,318
Gateway antivirus
Blocked web requests
62,480
Web filtering
Bad IPs dropped
211k
InstaShield IP
Top IPS signatures
Blocked web categories
Events by severity
- Critical412
- High1,820
- Medium3,144
- Low1,855
Recent security events
| Time | Site | Engine | Detail | Action |
|---|---|---|---|---|
| 14:02 | Branch · Indore | IPS | SMB exploit attempt | Blocked |
| 13:58 | Store · Kochi | Web filter | Phishing site | Blocked |
| 13:51 | Plant · Surat | Antivirus | Trojan in download | Quarantined |
| 13:47 | HQ · Pune | InstaShield IP | Known-bad IP | Dropped |
Illustration with sample data.
- Security on every edgeIPS, antivirus and web filtering run on the branch device.
- InstaShield IPKnown-bad IP addresses dropped before they reach the site.
- One policy, every siteZones, VRFs and rules pushed from the Nexapp Controller.
- Evidence for auditsEvents export to your SIEM, with scheduled reports.
Why a converged firewall
Indian branch networks usually carry a router, a firewall and an SD-WAN box from three vendors, each with its own console and contract. That adds cost, delays fixes and leaves gaps between policies. Nexapp NGFW runs on the secured edge you already use for SD-WAN, so one device and one policy cover routing, steering and threat prevention.
Outcomes you can plan on:
- Fewer boxes per branch. Firewall, VPN and SD-WAN on one edge reduce hardware, power and field visits.
- Consistent policy. Security profiles are defined once in the Nexapp Controller and pushed to every site.
- Faster response. Local internet breakout is inspected at the branch, not backhauled to the data centre.
- Audit evidence. Central logs and reports support your CERT-In 6-hour reporting and 180-day in-India log obligations. They also support RBI's 31 Jul 2026 Directions on secure network interconnections and strong cryptography.
NGFW or UTM?
A UTM bundles several filters on one box. An NGFW adds application awareness, so policy is written by application and user, not only by port and IP. Nexapp combines both approaches: DPI-based application control with IPS, antivirus and web filtering, managed centrally across hundreds of sites. Still running a UTM appliance past its vendor's end of support? See our UTM firewall replacement guide.
How it works
- Deploy the edge. Instaroute or Nexapp SD-WAN edges come up zero-touch, admitted by serial number.
- Apply a profile. Choose IPS, antivirus, web-filtering and application rules per site group.
- Inspect traffic. DPI classifies each flow; traffic is allowed, steered to the overlay or a gateway, or dropped.
- Block bad actors. InstaShield IP drops traffic from IP addresses with a poor reputation.
- Review and roll back. Config snapshots, diff and rollback keep every change auditable.
Post-quantum encryption on every IKEv2 tunnel
Site-to-site and management traffic uses hybrid classical + ML-KEM key exchange (FIPS 203) and ML-DSA (FIPS 204) authentication. Firmware and configuration are post-quantum-signed, and the console uses post-quantum TLS 1.3 (X25519MLKEM768). This protects recorded traffic against harvest-now, decrypt-later attacks. Post-quantum mode is on by default.
Specification (GeM Firewall (V4) format)
| Field | Nexapp NGFW |
|---|---|
| Models | On request |
| Firewall throughput | On request |
| NGFW throughput | On request |
| IPS throughput | On request |
| Threat protection throughput | On request |
| IPsec VPN throughput | On request |
| Concurrent sessions / new sessions per second | On request |
| Interfaces | ; any-port WAN on Instaroute models |
| Security features | IPS, gateway antivirus, web (URL) filtering, anti-spam, InstaShield IP reputation blocking, DPI application control |
| SSL inspection | TLS inspection through Nexapp SSE; |
| Sandboxing, DLP | Delivered through Nexapp SSE |
| Botnet and DNS protection | IP reputation scoring across malware, phishing, botnet, scanner and Tor categories; DPI detection of DNS tunnelling and data-exfiltration patterns; DNS security on the Nexapp platform |
| Networking | NAT, VLAN, BGP, OSPF, IS-IS, static routes, VRF, SD-WAN; IPv4/IPv6 dual-stack on Instaroute (NexappOS) |
| VPN | IPsec IKEv2 with hybrid ML-KEM key exchange; OpenVPN, GRE/DMVPN (Instaroute) |
| High availability | Device HA (VRRP) |
| Management | Web GUI, REST API (OpenAPI), centralised management on-premises or Nexapp-hosted in India; CLI, SSH and browser terminal on the device |
| Authentication | TACACS+, RADIUS |
| Logging | Syslog to a remote collector; security events exported by syslog, webhook or email to your SIEM; |
| Power | On request |
| Warranty | Coming soon |
| Local content | On request |
Proof
- Secured edges in production across 400+ enterprise and banking customers, including KFC, Pizza Hut, Blinkit, Zudio, Westside and Aadhar Housing Finance.
- 24×7 NOC in Pune; one SLA across hardware, firmware and platform.
- Company certifications: ISO 9001:2015, ISO 14001:2015, ISO/IEC 20000-1:2018, ISO/IEC 27001:2022.
Related guides
Frequently asked questions
What throughput does each model deliver?
Throughput by model for firewall, NGFW, IPS, threat protection and VPN is published on the datasheet with test conditions.
Ask us to map a model to your GeM band.
Which security features are included?
IPS, gateway antivirus, web filtering, anti-spam, InstaShield IP reputation blocking and DPI application control run on the edge.
Sandboxing, DLP and CASB are delivered through Nexapp SSE under the same vendor.
Can logs be sent to our SIEM?
Yes. Edges send syslog to a remote collector, and security events can be forwarded by syslog, webhook or email to your SIEM.
With an on-premises controller, logs stay in your data centre, which helps you meet CERT-In's 180-day in-India retention requirement.
Do I need a separate firewall box at each branch?
No. The NGFW runs on the same edge device as your SD-WAN and is managed from the same console, so each branch needs one device and one policy.
For Class-I local-supplier questions in tenders, see government and PSU.
Is the firewall VPN quantum-safe?
VPN tunnels use hybrid classical + ML-KEM key exchange (NIST FIPS 203) with ML-DSA authentication.
That protects recorded traffic against harvest-now, decrypt-later attacks.
Is Nexapp an Indian firewall brand?
Yes. Nexapp is an Indian OEM based in Pune, in production since 2014, and a Class-I local supplier under the Public Procurement (Preference to Make in India) Order.
The firewall runs on NexappOS, Nexapp's own operating system, and is supported from a 24×7 NOC in Pune.
Do I need a separate SD-WAN box?
No. The NGFW runs on the same Nexapp edge as SD-WAN, managed from the Nexapp Controller.
Size a firewall for your branches and get a spec sheet in GeM format.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.