New firewall deployments
Design and configuration of next-generation firewalls in high-availability pairs, with zones, policies, NAT and security profiles built to best practice.
Firewall configuration & review
Next-generation firewalls deployed, migrated and audited properly. Clean rule-bases, meaningful segmentation and secure VPNs, with every rule justified so you can pass an audit and sleep at night.
- CCNA Securityand Juniper firewall trained
- PCIfirewall experience in banking
- Every ruledocumented and justified
Why it matters
A firewall is only as good as its rules
Buying a modern firewall is easy. Configuring it well is not. Over time, most rule-bases collect temporary rules that became permanent, overly broad “any to any” exceptions and objects nobody can explain. Each one is a potential way in.
I deploy and review firewalls with security and operability in mind: segmenting your network so a compromised laptop cannot reach your servers, allowing only the traffic the business needs, and recording why each rule exists and who asked for it.
This is the discipline required in PCI DSS environments, where I have configured and maintained next-generation firewalls for a bank, applied in proportion to your business.
What’s included
How I can help
Rule-base audits and clean-up
Identification of unused, shadowed, duplicate and overly permissive rules, followed by a safe, staged clean-up that removes risk without breaking services.
Firewall migrations
Moving from one vendor or model to another, such as Cisco ASA to Fortinet, with policies translated, rationalised and tested before cut-over.
Network segmentation
Separating users, servers, management, guests and cardholder data environments into zones, so an incident in one area cannot spread to the rest.
Secure VPNs
Site-to-site IPsec VPNs and remote-access VPNs with multi-factor authentication, configured with modern, secure cryptography.
Logging and threat protection
Intrusion prevention, web filtering and logging to your SIEM, such as Splunk, so suspicious activity is visible and investigated.
Technologies and standards
- Fortinet FortiGate
- FortiManager
- FortiAnalyzer
- Cisco ASA
- Juniper NetScreen
- IPsec
- SSL VPN
- Cisco ISE
- Splunk
- PCI DSS
How it works
From first call to handover
Review
Export and analysis of your current configuration, traffic logs and network diagram.
Recommend
A written report of findings and a proposed policy, segmentation model or migration plan.
Implement
Staged changes in agreed maintenance windows, with every change logged and a rollback ready.
Verify
Testing that business traffic flows and unwanted traffic is blocked, followed by updated documentation.
What you receive
Deliverables
- Firewall audit report with risk ratings
- Cleaned and documented rule-base
- Segmentation and zone design
- Rule request and approval template
- VPN configuration documentation
- Evidence pack for auditors
FAQ
Common questions
Which firewall brands do you work with?
Mainly Fortinet FortiGate and Cisco ASA, with experience of Juniper NetScreen firewalls as well. The principles of a good rule-base are the same on every platform.
How often should firewall rules be reviewed?
At least once a year, and more often in regulated environments. PCI DSS, for example, requires firewall and router rule-sets to be reviewed at least every six months.
Will a rule clean-up cause outages?
Not if it is done carefully. Rules are first analysed against real traffic logs, then disabled in stages with monitoring, before anything is deleted.
Can you help us pass an audit?
Yes. I can review your firewalls against the relevant standard, fix the gaps and prepare documentation and evidence that auditors expect to see.
Related services
Often combined with
Let’s talk about your infrastructure
Tell me what you are working on. The initial consultation and quote are free, and if I am not the right fit I will say so and point you to someone who is.