Which capabilities do gateways typically have, and what condition must hold for them to perform security checks?

Question

Accepted Answer

They connect systems (LAN to internet, LAN to DMZ…), are specialised in certain protocols, and can usually break connections so that the systems communicate only indirectly. That enables address translation (private to public IP), address aggregation (many clients behind one address, or many servers behind one), breaking encryption (SSL breaker), protocol conversion, authentication and authorisation, and manipulating content. The condition: the traffic to be controlled must be routed through them completely.

* Gateways often translate old or insecure protocols into new, secure ones. *
These abilities are why gateways suit additional security checks such as content control. In security architecture they are also popular as converters from old/insecure to new/secure, for example:

unencrypted traffic converted to SSL/TLS;
Kerberos authentication (the classic Windows-domain ticket system) converted to SAML2 (the XML-based single sign-on standard used by web applications).

Go deeper:

Network address translation — Wikipedia — private-to-public address translation, one of the gateway abilities.
 SAML — Wikipedia — the target of the Kerberos-to-SAML2 conversion example.