Why are network firewalls alone not enough at the perimeter, and what is the idea behind adding gateways?

Attackers quickly move onto the communication the firewall allows: addresses are easy to fake, and attacks travel through permitted protocols and ports. Gateways answer this with smarter tools specialised in one protocol or kind of communication, which inspect much deeper. They sit as a passage in the perimeter, and all traffic they should control is rerouted through them.

* The firewall only sees that port 25 or 443 is allowed; the gateway behind it looks at what actually travels through. *

A network firewall decides on combinations of address, protocol and port: some are allowed, everything else is denied. That is a coarse check. Once port 25 (email) or 443 (web) is open, the firewall has no idea whether what flows through is a business email or a malware attachment, a normal web page or a manipulated one.

A gateway (a "smart security tool") supports enforcing the perimeter by looking at the content of one specific kind of traffic. It only works if the traffic really goes through it: the firewall is set up so that, for example, only the email gateway may talk email to the internet, and nobody else.

Go deeper:

• Firewall (computing) — Wikipedia — packet filters, stateful and application firewalls side by side.
• MITRE ATT&CK T1071 — Application Layer Protocol — attackers hiding command traffic inside allowed protocols such as HTTPS and DNS.