What does the Layer 3 restriction of a perimeter look like, and how do simple filters differ from higher-grade firewalls?

Layer 3 is restricted by a firewall. The simplest models (or filters built into routers) only filter on IP addresses and ports; higher-grade firewalls also inspect higher protocol layers and add control functions such as stateful session handling and anti-spoofing.

• Simple packet filter: decides per packet on source/destination address and port. It cannot tell whether a packet belongs to a connection the inside actually opened.
• Higher-grade firewall: also works above Layer 3 and keeps state. Stateful session handling means it tracks open connections, so a reply is only let in if it matches a request that went out. Anti-spoofing drops packets whose source address cannot be genuine on that interface (for example an "internal" address arriving from the internet).
• From the mid-range up: better management, such as graphical admin interfaces or connection to a central management engine that pushes rules to many firewalls at once.