Managed firewall services: what you get beyond the box
Buying the appliance is the easy part. What a managed service adds, what to hold a provider to, and when it pays for itself.
By the Telappliant team
A firewall is not a product you install and forget. It is a rule set that decays: staff leave, applications change, temporary rules become permanent, and firmware ages. A managed firewall service is really a commitment that someone competent owns that rule set every month.
What the service should include
- Design, deployment and a documented baseline configuration
- Firmware and signature updates within a defined window
- Rule reviews on a schedule, with expired and shadowed rules removed
- Change management with an audit trail of who asked and who approved
- Log retention and alerting on blocked and anomalous traffic
- Failover configuration and a tested restore of the configuration
Next-generation features worth turning on
Application awareness, TLS inspection where lawful and practical, intrusion prevention, geo-blocking of countries you never trade with, and DNS filtering. Each needs tuning; features enabled without tuning generate noise and get switched off again.
The rules nobody reviews
Every estate we audit has them: any-any rules from a migration, a management interface exposed to the internet, RDP left open for a supplier who left in 2021. A quarterly review with a documented owner per rule is the single most valuable part of the service.
Firewall and Cyber Essentials
Boundary firewalls are the first of the five controls. Certification asks for a configured, patched device with default credentials removed, no unnecessary services exposed, and documented business justification for inbound rules. A managed service produces that evidence as a by-product.
When it pays for itself
When you have no in-house network specialist, more than one site, remote workers terminating VPN or SASE tunnels, or a compliance requirement that needs evidence. If a misconfiguration would take you offline for a day, the service costs less than the outage.
What to ask a provider
- Who owns the configuration, and can we export it at any time?
- What is the response time for an emergency rule change?
- How long are logs retained, and can we query them?
- How often are rules reviewed, and do we see the report?
- What happens at end of contract or end of hardware life?
