# TLS inspection with a Next Generation policy in AWS Network Firewall
<a name="tls-inspection-policy-v2"></a>

You can use TLS inspection with a Next Generation policy. For information about Next Generation policies, see [Next Generation policies](firewall-policies-v2.md).

**A Next Generation policy supports session holding only**  
A Next Generation policy supports session holding only. This differs from a Classic Network Firewall policy, where session holding is optional and off by default. For information about session holding, see [Using session holding with TLS inspection in AWS Network Firewall](session-holding-tls.md).