Which device enforces allow/deny rules to control network traffic?

A firewall enforces allow/deny rules to control network traffic based on predefined security policies. It acts as a barrier between trusted and untrusted networks, inspecting incoming and outgoing traffic to prevent unauthorized access and malicious activity. A switch operates at Layer 2 and forwards frames based on MAC addresses; it doesn't enforce access control rules. A wireless controller manages multiple access points and their configurations, but it doesn't primarily enforce traffic filtering rules. An access point allows wireless devices to connect to a wired network; it doesn't perform deep packet inspection or enforce complex security policies like a firewall.