Perspective

Firewall Consolidation

Why the next firewall refresh is the best chance a mid-sized organisation will get to simplify network security, and how to make the choice once and get years of value from it.

New to this? Start with the plain-language version.

1. Why the firewall decision matters again

For most mid-sized organisations, the firewall was chosen years ago, renewed each year on the same terms, and otherwise left alone. Three changes now force a fresh look.

• Equipment is reaching end of support. Many firewalls installed five or more years ago are reaching, or have passed, the end of vendor support. An unsupported firewall receives no security fixes, and it is difficult to defend to an auditor or a regulator.
• The network has moved. Staff work from home and on the road, applications run in cloud and SaaS, and branches connect over the internet instead of private lines. A firewall at the data centre door now protects a shrinking share of the traffic that matters.
• Most traffic is encrypted. Inspecting encrypted traffic takes far more processing power than older firewalls were sized for. Many organisations quietly switch inspection off to keep the network fast, and lose most of the protection they are paying for.

Each of these is a reason to replace or reconfigure a firewall. Together, they are a reason to rethink network security as a whole.

2. How mid-sized organisations overspend

Network security spend in mid-sized organisations tends to grow one product and one site at a time. The waste follows predictable patterns.

• One product per problem. A firewall from one vendor, branch routers from another, remote access from a third, web filtering, switches and wireless from others. Each has its own console, contract, renewal date and specialist.
• Features bought as add-ons. Intrusion prevention, web filtering, malware sandboxing and application control licensed separately, on different terms at different sites.
• Hardware sized wrongly. Firewalls bought large for peak load and never fully used, or bought small and then run with inspection switched off.
• Renewal without review. Support and licences renewed on the same terms every year, with no check of what is actually switched on and used.
• Rule bases that only grow. Rules are added for every project and rarely removed. After a few years nobody can say what half of them do, every change is slow, and auditors raise findings.
• Firewall logs sent to the SIEM at full price. Firewall and network traffic logs are among the largest log sources by volume, and they rarely trigger a detection on their own. Paying SIEM ingestion prices for all of them is one of the most common sources of wasted security spend.

3. The case for consolidation

Consolidation means replacing several point products with one platform that provides the firewall, branch networking (SD-WAN), secure remote access, and management of switches and wireless access points, on one operating system and from one console.

• One policy, written once. The same security policy applies at head office, every branch, cloud environments and remote users.
• Fewer contracts. One supplier relationship and fewer renewal dates to track and negotiate.
• Fewer specialist skills. A small team can run one platform well; it cannot run five platforms well.
• One place for evidence. Configuration, change history and security events for every site are in one system when an auditor or regulator asks.
• Fewer boxes at each site. At a branch, one device can replace a separate router, firewall and remote access appliance.

The goal is not the lowest price per box. It is the lowest cost of keeping the whole estate secure, supported and provable over the life of the equipment.

4. What to look for in a platform

Not every platform delivers consolidation in practice. Some are a set of acquired products sold under one brand, with separate consoles and separate operating systems underneath. Score each option against the criteria below.

Few platforms meet every criterion. Weight each one by what matters most in your estate, and test the shortlist on your own traffic with inspection switched on.

5. Who this fits

Consolidation delivers most where people are scarce and sites are many.

• Organisations with a few sites to several hundred, such as branch-based businesses in retail, logistics, insurance, healthcare and manufacturing.
• Small network and security teams that cannot specialise in five products.
• Regional offices of global groups that need local control of local infrastructure.
• Regulated organisations that must show supported, patched and consistently configured network controls.

Very large enterprises with a dedicated team for each domain may still choose a separate product for each job. For most mid-sized organisations, that model costs more than it returns.

6. Making the refresh pay for itself

The cheapest consolidation is one timed to spending that is already planned.

• List every renewal and end-of-support date for every network security product at every site. This list is usually the business case.
• Replace at end of life or renewal, not early. Bring each point product onto the platform as its contract ends.
• Clean up during the move. Migrate only the rules that are still in use. A migration is the one time a rule base can be rebuilt without risk to the old one.
• Size from measured traffic, with inspection switched on. Buy what each site needs, not what a spec sheet suggests.
• Buy for the estate, not site by site. Pricing, support and licence terms are better negotiated once for the whole organisation.

7. Firewall logs and the SIEM bill

Firewall logs are essential for investigations. They are also high in volume and low in detection value, and most SIEM platforms charge by the volume they ingest.

A better arrangement:

• send security events to the SIEM: blocked threats, intrusion alerts, malware detections, administrator changes and policy violations;
• keep full traffic logs in low-cost storage that can still be searched for investigations;
• filter and summarise repetitive events before they leave the site.

This is the same principle as the federated SOC: analyse data where it sits and send on only what matters. Choose a platform whose logging can be configured this way.

Organisations that already run a modern firewall estate can often make this saving without replacing anything. A log cost review shows how much firewall data reaches the SIEM today, what it costs, and how much of it ever contributes to a detection.

8. Run it yourself, or have it managed

A managed service works best when the provider runs the same platform for many clients. Its engineers know the platform in depth, its configurations follow a tested standard, and firewall events can feed directly into its security monitoring.

9. Optimising an estate you already have

If the current firewall estate is supported and fit for purpose, the right move is optimisation, not replacement.

• Rule base review: remove unused, duplicated, shadowed and overly broad rules.
• Licence review: compare what is paid for with what is switched on and used.
• Firmware currency: confirm every device runs a supported version with known vulnerabilities fixed.
• Inspection check: confirm that encrypted traffic inspection and intrusion prevention are on where they should be, and that the hardware copes.
• Log review: measure what goes to the SIEM, what it costs and what it detects.
• Hardening check: compare configurations against a recognised security baseline.

The same review shows which devices are close to end of support, which is the starting point for section 6.

10. A practical roadmap

1. Inventory (weeks 1 to 4). List every network security device, licence, contract, renewal date and support end date, by site.
2. Review (weeks 2 to 6). Assess rule bases, licence use, firmware, inspection settings and log volumes.
3. Decide (weeks 6 to 10). Score platforms against section 4, choose an operating model from section 8, and build the business case from the renewal calendar.
4. Pilot one site (months 3 to 4). Deploy at a representative site with inspection switched on. Measure performance, user impact and log volume.
5. Roll out site by site (months 4 to 18). Move sites in order of end-of-support date, risk and renewal timing.
6. Optimise continuously. Review rules, licences and log routing every quarter.

11. How to measure success

12. Common questions

Do we have to replace everything at once?

No. Most organisations move site by site, timed to end-of-support and renewal dates. The platform is managed centrally from the first site onwards.

Doesn't one platform create lock-in?

It is a trade-off. Reduce the risk with high availability at critical sites, standard configurations, open log formats and sensible contract terms. Running five platforms carries its own risk: five sets of gaps, skills and patches to get right.

Will inspecting encrypted traffic slow the network down?

It can on hardware that was not built for it. Size every device with inspection switched on, and prove performance at the pilot site before rolling out.

Can our existing SIEM keep working?

Yes. What changes is what it receives: fewer, more useful events, with full traffic logs kept in cheaper storage.

Do we need a managed service?

No. It depends on the size and experience of your team. Many organisations start co-managed and adjust over time.