Next-gen firewalls require external visibility tools