It must terminate connections and perform deep-layer packet inspection on the content

It requires the host to constantly update its checksum database

It lacks the hardware to handle basic packet filtering

It only operates at layer 3 of the OSI model