A next-generation firewall is an Application Layer tool, which is Layer 7. This is because a NGFW examines traffic across packets, so it is more than a Network Layer tool that would only be concerned with individual packets. It is also more than a Session Layer tool because it examines the contents of the packets. It is also higher than the Data Layer because the system deals with intent and function rather than just data, so it operates at the top layer of the OSI stack.