They provide little or useful logging. The state of the session is monitored, and traffic is only allowed while the session is still open. This is more secure than packet filtering but allows any kind of data through the firewall while the session is open, creating a security hole. This is better than packet filtering but still falls short of total security. These proxies take external requests, examine them and forward legitimate requests to the internal host that provides the appropriate service.
Application gateways can support functions such as user authentication and logging.
The use of proxies for different services prevents direct access to services on the internal network, protecting the enterprise against insecure or misconfigured internal hosts. Strong user authentication can be enforced with application gateways. Proxies can provide detailed logging at the application level. Application level firewalls shall be configured such that out-bound network traffic appears as if the traffic had originated from the firewall. In this manner, direct access to network services on the internal network is not allowed.