Firewall Migration: Replace an Old Firewall Safely
Replacing a firewall is the riskiest hour in a network's year. We plan it so that the rules, address translations and VPNs you depend on are all working on the new unit before the old one is unplugged.
How we do it
- Export and read the old configuration, and list what is still in use
- Rebuild it on the new firewall, removing rules that nothing uses
- Test on the bench: internet, published services, VPNs
- Cut over in an agreed window, with the old unit kept ready to plug back in
- Watch the logs for the first days and adjust
Changing brand
Rules do not translate one-for-one between brands, because each models applications, zones and address translation differently. We rebuild the policy on the new platform's own terms and do not paste in a machine conversion, which tends to carry old mistakes across.
What to have ready
Admin access to the old firewall, your internet provider's details, and a list of the services people would notice first if they stopped: email, the accounting system, remote access, phones.
Common questions
How long will we be offline?
The cut-over itself is usually a matter of minutes. We schedule it outside working hours and keep the old firewall ready as a fallback.
Can the old firewall's VPNs be kept?
Yes. Site-to-site tunnels are rebuilt on the new unit. Remote users may need a new VPN client or profile, which we prepare in advance.
Do you take the old firewall away?
We can wipe its configuration and return it to you, or you can keep it as a spare.