A firewall refresh is rarely only about hardware. It is the best chance in years to remove rules nobody understands and fix how the network is segmented. Use this checklist to avoid carrying old problems into new equipment.
- Inventory every rule, object and NAT entry, and note when each was last used.
- Identify the business owner of each rule. Rules without an owner are candidates for removal.
- Measure real throughput with inspection features switched on, not the datasheet figure.
- Plan high availability and test failover before cut-over.
- Review VPN and remote access, and require multi-factor authentication.
- Check licences: which security features are paid for, and which are actually enabled.
- Design segmentation: users, servers, guests, cameras and operational systems should not share one flat network.
- Send logs to a central place with enough retention for investigations and audits.
- Write the cut-over plan with a rollback step and a maintenance window.
- Document the new design and train the people who will run it.
If the estate spans several branches, standardise the design so every site is built and managed the same way. That is where central management earns its cost, and it makes the next refresh far easier.