What is a Web Application Firewall? A WAF is a layer 7 (application layer)firewall that protects web based attacks like cross site scripting, XML attacks and all the OWASP top 10 vulnerabilities. The WAF is used to protect web applications that ideally run HTTP and HTTPS traffic. What is a Network Firewall? A network firewall is layer 3 firewall that protects non-web based traffic. All traffic that hits the firewall via the network layer of the OSI layers are protected by a network firewall.