A network administrator is designing security for a branch office. The requirement is to deploy a device at the Internet edge that can filter traffic based on Layer 3/4 rules, perform stateful inspection, control traffic by application and user identity, and terminate VPN tunnels for remote workers. Which network component best meets ALL of these requirements?