Hammer Partner with Acronis
Firewall estates are rarely static. Networks grow, traffic patterns change, organisations introduce new applications, and security requirements become more demanding.
Over time, a firewall that once met an organisation’s needs may start creating limitations around performance, security, management or support. Replacing it, however, involves more than selecting a newer appliance and transferring the existing configuration.
For MSPs and IT resellers planning a firewall migration, the process presents an opportunity to reassess the customer’s network security requirements and identify what needs to change. This may also include reviewing the security vendor itself, particularly where digital sovereignty, technology provenance and independent security assurance are becoming more important to the customer.
Here are eight questions worth asking before planning a migration.
1. Why Does the Existing Firewall Need Replacing?
Start with the reason for the migration.
An ageing firewall may still function, but that does not necessarily mean it continues to meet the organisation’s requirements. The existing estate may be approaching end of support, struggling with current traffic levels or creating too much administrative work.
Look at areas including:
- Vendor support and product lifecycle
- Current and expected traffic volumes
- IPS and threat prevention performance
- VPN requirements
- Encrypted traffic
- Management overhead
- Availability requirements
- Changing security or regulatory requirements
- Vendor transparency, technology provenance and digital sovereignty requirements
Understanding the underlying problem gives you a much better basis for evaluating the replacement.
2. What Does The Customer Actually Need From Their Next Firewall?
Avoid treating migration as a like-for-like hardware replacement.
The network the existing firewall was originally specified for may look very different today. Cloud applications, remote working, additional sites, connected devices and greater volumes of encrypted traffic can all change what is required.
Consider both current requirements and what the customer expects over the next few years.
This could include additional capacity, new VPN connections, stronger segmentation, centralised management or requirements around IT and OT security.
For customers operating in regulated or security-sensitive sectors, it may also be worth considering a sovereign firewall. This means looking at where the technology is developed, the jurisdiction governing the vendor and the independent security qualifications or certifications that apply to the solution.
Migration provides an opportunity to design for where the customer is going rather than recreating the environment they already have.
3. How Will The New Firewall Perform With Security Features Active?
Headline throughput figures can make firewall comparisons look straightforward, but they do not always reflect real-world performance.
Intrusion prevention, threat detection, VPN traffic and deeper inspection all require processing capacity. A more useful comparison looks at how the firewall performs with the services the customer intends to use enabled.
Review metrics such as:
- Firewall throughput
- IPS throughput
- Threat prevention performance
- IPsec VPN throughput
- Concurrent connections
- VPN tunnel capacity
The customer's own traffic profile matters too. For larger or more complex projects, testing the proposed solution before migration can help confirm that it meets the required performance criteria.
If a sovereign firewall is being considered, its security credentials and European provenance should be assessed alongside these performance requirements to ensure the solution is technically suitable.
4. Which Existing Policies And Configurations Need To Be Migrated?
Firewall estates can accumulate years of rules, objects, VPN configurations and exceptions.
Simply transferring everything to the replacement environment can carry unnecessary complexity forward.
Before migration, review the existing configuration and identify which policies are still required. Look for redundant rules, outdated objects, duplicate configurations and access that may no longer be appropriate.
Documenting the current environment also makes it easier to identify dependencies that could otherwise cause problems during the changeover.
A migration can therefore become an opportunity to simplify the firewall policy rather than reproduce years of accumulated configuration.
5. What Other Systems Depend On The Existing Firewall?
A firewall rarely operates in isolation.
VPNs, authentication services, monitoring platforms, routing, remote access, cloud environments and third-party integrations may all depend on its current configuration.
In industrial environments, the firewall may also sit between IT and OT networks or control communication with operational systems.
Mapping these dependencies before migration helps you identify what needs testing and reduces the risk of discovering an important integration during the cutover itself.
The more complex the environment, the more valuable a structured discovery and testing phase becomes.
6. How Will The New Firewall Estate Be Managed?
Deployment is only the beginning of the firewall lifecycle.
Consider how the customer or MSP will manage policies, configurations, updates, monitoring and reporting once the migration is complete.
For organisations with multiple sites or MSPs supporting several customer environments, centralised administration can reduce repetitive work and improve visibility across the estate.
Stormshield Management Center provides centralised administration for SNS firewalls, including policy management, configuration backups, updates, VPN supervision and automation capabilities.
As a European cybersecurity vendor, Stormshield also offers an alternative for organisations reviewing their security technology supply chain and digital sovereignty requirements.
Management requirements should therefore form part of the firewall selection process rather than being considered after deployment.
7. How Will You Test The Solution Before Migration?
A proof-of-concept can help validate assumptions before a customer commits to a wider deployment.
Rather than relying entirely on specifications, testing allows partners to assess the proposed firewall against requirements that matter to the customer's environment.
This could include performance with IPS enabled, VPN connectivity, policy configuration, application compatibility, centralised management or IT and OT requirements.
Hammer's technical pre-sales team can support partners with solution design and proof-of-concept evaluations, becoming an extension of your team, helping establish agreed testing criteria and assess the proposed Stormshield solution before rollout.
For complex migrations, this process can give both the partner and customer greater confidence in the migration plan.
8. What Is The Migration And Rollback Plan?
Even a well-designed migration needs a clear plan for the changeover.
Define what happens before, during, and after deployment, who is responsible for each stage, and how the new environment will be validated.
The plan should cover areas such as:
- Configuration and policy preparation
- Backup of the existing environment
- Testing requirements
- Cutover sequence
- Connectivity checks
- Security validation
- User and application testing
- Rollback procedures
- Post-migration monitoring
A rollback plan is particularly important. If an unexpected issue appears during migration, the team should know how to restore service without having to make decisions under pressure.
Planning A Firewall Migration With Hammer
A successful firewall migration begins well before you install the hardware.
Understanding why the existing estate needs replacing, reviewing the customer's current requirements, cleaning up existing policies and testing the proposed environment can all help make the transition more controlled.
It also gives partners an opportunity to address issues that may have developed over the lifetime of the existing firewall rather than carrying them into the replacement.
For customers reassessing their existing security vendors, Stormshield provides a European-developed firewall alternative with a focus on digital sovereignty, independent security assurance and network protection across IT and OT environments.
Hammer works with partners throughout the Stormshield migration process, with technical pre-sales, solution design and proof-of-concept support available to help assess requirements and validate proposed solutions.
Planning a firewall migration for a customer? Speak to the Hammer team about your requirements and explore whether Stormshield is the right fit for the environment.
