FIREWALLS / A BUYING AND SETUP CHECKLIST
Before you buy a firewall,
ask eleven questions.
A firewall is a multi-year commitment: hardware, subscriptions, rules and someone to look after them. Use this checklist to compare options and to check the one you already have.
Review my firewall planThis is general guidance, not a security assessment of your network. The right answers depend on your site, staff and risks.
Most problems show up in year two: an expired license, an unpatched unit or a rule nobody remembers adding.
BEFORE YOU BUY
Compare what you will
actually run.
Throughput with inspection enabled
The largest number on a data sheet is usually measured with inspection features off. Ask for the figure with the features you will turn on, such as intrusion prevention, application control, VPN and any TLS inspection, and compare it with your internet speed plus room to grow.
Remote access and site-to-site VPN
Count how many people connect remotely at once and whether other sites need a permanent link. Check VPN throughput, whether remote-access users need per-user licenses, and that VPN sign-in supports multi-factor authentication.
VLANs for guest Wi-Fi, POS and cameras
Guest devices, point-of-sale terminals, cameras and office computers should not share one flat network. Confirm the firewall and switches support enough VLANs, and plan the rules between them so each group reaches only what it needs.
DNS filtering and what it covers
DNS filtering can block known malicious and unwanted domains before a device connects. Check whether it is built in or a separate subscription, how exceptions are handled, and whether devices can bypass it with their own DNS settings.
Firmware updates and end-of-support dates
Look up the model’s published end-of-sale and end-of-support dates before you buy. A firewall that no longer receives security updates should be replaced, not kept in service because it still powers on.
Renewals you can predict
Many features depend on subscriptions. Get the renewal price in writing, find out which features stop or stop updating when it lapses, and put the renewal date somewhere a person will see it.
WHEN YOU SET IT UP AND RUN IT
Make it recoverable
and accountable.
Logs, retention and who reads them
Decide what is logged, where logs are stored and how long they are kept. On-device storage is limited, so send important logs to separate storage. Logs nobody reviews only help after something has gone wrong.
High availability, or a plan without it
A second firewall in a failover pair removes one single point of failure but adds cost and sometimes licensing. Compare that with the cost of downtime. Without a pair, keep a tested way to replace the unit and restore its configuration.
Configuration backed up off the device
Export the configuration after every change and store it securely away from the firewall. Check that a backup can be restored to a replacement unit before you need to do it under pressure.
Multi-factor authentication for administrators
Give each administrator a named account with multi-factor authentication, remove shared logins, and keep the management interface off the public internet. Review who still has access when staff or providers change.
Every change recorded and reversible
Write down what is changing, why, when and how to undo it. Remove rules that no longer have an owner or a purpose. A short change log is often the most useful document when something stops working.
Traffic shaping for voice and video
If the business runs phones or video calls over the same connection, ask how the firewall manages a busy line. Fair-queuing traffic shaping can keep calls responsive while large transfers run.
COMMON QUESTIONS
Short answers to
common questions.
Is the throughput number on the box the one that matters?
Usually not. Headline figures are often measured with inspection features off. Ask for throughput with the features you will actually enable, such as intrusion prevention, application control and any TLS inspection, and compare that figure with your internet connection.
Do I need separate networks for guest Wi-Fi, payment devices and cameras?
Separating them is good practice. Guest devices, point-of-sale terminals and cameras have different owners and risks, so placing each on its own VLAN with firewall rules between them limits what one compromised device can reach.
What happens when a firewall subscription lapses?
It depends on the vendor. Threat signatures, web or DNS filtering, support and firmware access may stop updating or stop working. Ask in writing which features depend on a subscription and what the renewal will cost.
Does a small business need a high-availability firewall pair?
Not always. Compare the cost of downtime with the cost of a second unit and any licensing it needs. For many small sites, a tested configuration backup and a plan to replace the device quickly is the sensible starting point.
AUTHORITATIVE GUIDANCE
Further reading from
CISA and NIST.
CISA Cyber Essentials is written for small business leaders and recommends multi-factor authentication, automatic updates, replacing unsupported hardware and backing up critical data and system configurations. NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy covers firewall technologies and how to select, configure, test, deploy and manage them. The NIST Small Business Cybersecurity Corner gathers free resources for smaller organizations.
UrbanBytez designs, builds and supports firewalls, business phone systems, custom apps and custom DNS/DHCP, working remotely with businesses in Atlanta, Dallas–Fort Worth and Houston. An inquiry is free. A $295 technology assessment can walk through this checklist against your current setup; implementation starts from $1,495 and is quoted before work begins.
You can also email sales@urbanbytezllc.com or call (770) 904-1800. Do not send passwords, configuration exports or network addresses.