Firewalls enforce network access via a positive control model, where only specific traffic is granted access to the network. Access Control Lists initially performed this functionality, often in routers, but their rudimentary approach gave way to dedicated packet filtering and stateful inspection firewall devices that offered deeper levels of access controls. The use of proxy-based devices began providing more granular visibility into a small set of applications and protocols where traditional firewalls were blind. This white paper provides an overview of the problems with proxies and standalone URL filtering.”]