Security
Firewalls and remote access: Cisco, Fortinet, Palo Alto or Check Point, supplied and integrated.
Request a quoteSecurity
Firewalls and remote access: Cisco, Fortinet, Palo Alto or Check Point, supplied and integrated.
Request a quoteYour firewall has an end-of-support date. We supply and install the replacement, planned ahead of that date.
Palo Alto's PA-3200 Series moves to extended support on May 3, 2027, and ends August 31, 2028.¹⁰ Send your models, or a wider security program. We design, supply, integrate and support it: Cisco, Fortinet, Palo Alto or Check Point firewalls, with F5 and Splunk where they fit. Whoever recommends it delivers it.
Disconnect by Friday: a government order on remote-access gateways.⁸
Remote access.
Ivanti, January 31, 2024: CISA told US federal agencies to disconnect these gateways by February 2.⁸ So remote access must switch off within a day, on any vendor, and your people keep working.
Sized to the need.
The PA-5570 is the smallest PA-5500 model at or above the required throughput.
Not past end of sale.
The PA-5450 was not used: its end of sale was announced for Nov 22, 2026.
Proved clean.
We check how a device is proved clean without relying only on its vendor’s own checker.
One node down.
Users see nothing; the cluster carries on.
Fail-closed, by design.
Failing open was considered and rejected because it fails the requirement.
A second factor, always.
Every interactive login to a firewall or the policy engine needs MFA.
Watch first, then enforce.
Four weeks in monitor mode, then enforcement site by site.
Two design models from builds published by NIST.
Which model fits us?
Model A or Model B, by where users work.²
Policy engine.
Cisco ISE 3.5 on current SNS-3895 appliances.³
Enforcement.
802.1X on every access port, and a PA-5570 HA pair at each data-center edge.³
Policy engine.
Cloud Identity Engine with Prisma Access.³
Remote users and SaaS.
Remote and SaaS traffic runs through the cloud edge.³
Both published.
Both follow builds published in NIST SP 1800-35.²
Not zero trust.
A hardened VPN on a flat network was considered and rejected: it is not zero trust.²
Fixed per model.
Only the policy engine and data-center firewall are set. Every other component can stay your own, where supported.³
Attacked on purpose, before you accept it.⁴
What we test.
21 tests, each with its pass mark written first.⁵
Moving sideways.⁵
An OT device tries to reach other segments. Pass: blocked, and an alert raised.
No second factor.⁵
An admin logs in to a firewall without MFA. Pass: denied.
A user disabled.⁵
A user is disabled in the directory. Pass: access lost within 5 minutes.
An unhealthy laptop.⁵
A laptop falls out of compliance. Pass: quarantined, a fix is reachable, then restored.
We write into your requirement:
Every critical system can be rebuilt from scratch on software its vendor still supports, and any that cannot is listed by name.
What we check.
Which of your systems are past vendor support, and whether each restores on a new platform.
Built on a published comparison.
This design is built on Firewalls: Nine Vendors to One.
Five platforms, one written requirement: a bank’s nine firewall estates in 18 branches and two data centers, under one policy. Three platforms meet it, each with a named condition. Two stay open on clauses their own documents do not settle.
Led by David Morgan
David Morgan, Principal Security Architect. He wrote the Security Blueprint.
Led by David Morgan
David Morgan, Principal Security Architect. He wrote the Security Blueprint.
240 Gbps.¹
Threat prevention per data-center firewall.¹ Each branch gets a FortiGate 200G pair.³
21 tests.⁵
Every test has its pass mark written before the build.
30 minutes.³
If the policy engine fails, new sessions are refused and open ones are designed to run on for 30 minutes. Failing open was rejected.
Design studies to explore
Design studies
More designs, by industry.
You get a reply the same day.
Send your firewall models and your date. You get a reply the same day, then a quote.
You get a reply the same day.