A firewall guards the boundary between your own network and the internet, or between different parts of a network. It only lets through traffic that is permitted by the rules.
A commercial building often has several networks: the tenants' network, the building systems network and sometimes a guest network. A firewall helps keep them separate (see network segmentation). That way, a vulnerability in a smart thermostat cannot give someone access to a tenant's files.
What does this mean for the IT-Label?
A firewall falls under Infrastructure (network management) and matters for Integration: building systems must be able to work together without making the network vulnerable. Tenants covered by NIS2 also have requirements for how the network is protected. See network segmentation, IoT and our page on IT and regulation.