I know this is an old thread, but in case anyone else comes across it as I did, IP Firewall (cmdb_ci_ip_firewall) is the class that ServiceNow Discovery will put most firewalls when found. If you add a firewall to Firewall Hardware (cmdb_ci_firewall_network) and you are running Discovery, it will get moved to IP Firewall, unless there's a better class that matches a "discovery pattern" (set of rules and descriptors to identify a device using its OID). Some firewalls have their own class under IP Firewall, such as Juniper Firewall Device (cmdb_ci_firewall_device_juniper), Palo Alto Firewall Device (cmdb_ci_firewall_device_palo_alto), etc.
