The Achilles heel of next-gen firewalls