It is a Layer-7 firewall that does a deep-packet inspection. The difference between an application-layer firewall and the firewalls mentioned earlier is that the application-layer firewall can check inside the content of the payload.

For example, this type of firewall does more than looking at just the port number, such as port 80 identifying HTTP. It can identify whether the structure of the HTTP payload looks like malicious code and can drop it.