NGFW
Replacing a firewall is like repairing the engine of a car that is still driving
The old device has to go, but the business will not stop and wait at the side of the road. I spent eight years at Palo Alto Networks selling NGFW in a market that was not buying it, and later I worked on the launch of PT NGFW. Now I help companies choose, and I sell nothing myself.
What we work through
Five parts, and none of them is a list of features
| Block | What you get from it |
|---|---|
| What exactly are you replacing | A certificate, an entry in the state register and a long list of features answer the formal questions only. Real protection and uptime depend on the network design, the policy, the resources of the platform and the team that runs it. First describe your traffic and your limits, then choose the device. |
| How an NGFW blocks and what it costs | IPS, application control, antivirus, filtering and sandbox integration all cost performance. How to read a datasheet: which modules were switched on, which type of traffic was used for the test, how many new connections per second, and what happens to delay and to false alarms. |
| Architecture, cluster and TLS inspection | What happens when a node fails, when a link fails, when the management system fails, how sessions are synchronised, and how the cluster behaves when the nodes lose contact with each other. Treat TLS inspection as a separate project: performance, trusted certificates, exceptions, privacy and application compatibility. |
| Rules, management and SOC events | You cannot move an old set of rules to a new firewall the way you move a wardrobe to a new flat. Every rule needs an owner, a purpose, a confirmed traffic flow and a date to review it. For the SIEM, agree the detection scenarios and the required fields in advance, or the useful signals will disappear in expensive noise. |
| Pilot, migration and operations | A copy of the traffic shows how well the device detects attacks, but it proves nothing about blocking, delay or failover. A real test combines traffic analysis with careful inline tests: acceptance criteria, long periods under load, an upgrade you can undo, and the old and the new firewall working side by side. |
A beautiful dashboard does not bring back a site that is down. The support contract is part of the engineering decision, not a formality for the purchasing department.
Why me
I do not resell firewalls and take no commission from vendors
That is exactly why it is useful to ask someone from outside. I sold NGFW for a vendor long enough to know which slides mean something and which ones exist only to get through the meeting.