Which capability does the application‑aware firewall provide?

The application-aware firewall provides the capability to block traffic by application. Unlike traditional firewalls that inspect traffic based on IP addresses and port numbers (Layer 3 and Layer 4), an application-aware firewall understands and identifies specific applications (Layer 7). This allows for more granular control, enabling administrators to permit or deny traffic for applications like Facebook, Netflix, or specific enterprise applications, regardless of the port they might use. Blocking traffic by MTU (Maximum Transmission Unit) is not a primary function of an application-aware firewall; MTU issues typically relate to network fragmentation. While some firewalls can inspect encrypted traffic (e.g., through SSL decryption), "blocking encrypted traffic" as a general capability isn't the core differentiator of an application-aware firewall. Blocking traffic by MAC address is a Layer 2 security function, typically handled by switches or basic access control lists, not an application-aware firewall.