The firewall / UTM capabilities of an MX aren't based upon NGFW - containerised or otherwise - they are natively part of the MX.   Some of the associated security tools used by NGFW and MX are common to both though;   e.g. Snort for IDS/IPS and AMP... ... View more