The firewall is the front door of your network. It decides what gets in, what gets out, and how branches and remote staff connect. Most companies buy one when they open an office and don't think about it again until it slows everything down or its support contract runs out. This guide covers what to look at when choosing a new one.
Size it for what you will turn on
Datasheets list several throughput numbers. The highest is usually for plain firewall traffic with nothing else enabled. In real use you will want intrusion prevention, web filtering, application control and inspection of encrypted traffic, and each of these reduces throughput. Look for the figure that includes threat protection, and size for your internet speed plus room to grow over the next three to five years.
Features that matter in practice
- Inspection of encrypted traffic. Most web traffic is encrypted, so a firewall that can't inspect it sees very little. Check that the model can do this at your required speed.
- Secure remote access. If staff work from home or travel, the VPN or zero-trust access should be easy to use and work with multi-factor authentication.
- Branch connectivity. For more than one site, look at SD-WAN features that use multiple internet links and route traffic intelligently.
- Central management. With several firewalls, one console to manage policies saves time and reduces mistakes.
- Logging and reporting. You will want to see what was blocked and why, and keep logs long enough to investigate an incident.
The brands we see most often
Fortinet, Sophos and Palo Alto Networks are all widely used by UAE businesses, and all three are solid choices. The differences tend to come down to the management experience, how the security subscriptions are licensed, and how well the firewall fits with the rest of your tools. Sophos, for example, integrates closely with its own endpoint protection. Fortinet offers a wide range of models with SD-WAN built in. Palo Alto is common in larger organisations with dedicated security teams. We are happy to compare them for your situation.
Don't forget the subscriptions
Threat protection, web filtering and support are usually annual subscriptions on top of the hardware. When comparing quotes, compare the total cost over three or five years, not just the price of the box. A firewall whose subscriptions have lapsed still passes traffic, but it stops recognising new threats.
Plan the change-over
- Document the current rules and remove the ones nobody can explain.
- Build the new configuration in advance and test it.
- Switch over out of hours, with the old firewall ready to go back in.
- Check remote access, branch links and key applications the next morning.
BluDATA supplies, configures and supports firewalls from Fortinet, Sophos and Palo Alto Networks. If you want help sizing one, send us your internet speeds, number of users and sites, and we will suggest options.