What makes a firewall "next-generation"?

A traditional firewall filters traffic by port, protocol, and IP address. A Next Generation Firewall adds deeper intelligence: it identifies the actual application in use (App-ID), ties policy to users and groups rather than just IPs, inspects the content of traffic including encrypted TLS, and includes inline intrusion prevention and threat blocking. In short, an NGFW understands who is doing what with which application — and can stop threats hidden inside otherwise-allowed traffic.