Firewall Rulebase & Configuration Assessments
Know What Your Firewall Really Allows
Firewalls collect rules over the years, and few businesses know exactly what theirs allows. Pulsar IT reviews your firewall's rules and configuration and gives you a clear, prioritised plan to tighten it.
What is Firewall Rulebase & Configuration Assessments?
A firewall sits between your network and the internet and decides what traffic is allowed in and out, using a list of rules called a rulebase. Over time, rules are added for new systems, suppliers and quick fixes, and are rarely taken away. The result can be a firewall that allows far more than anyone intended.
A Firewall Rulebase & Configuration Assessment is a one-off, independent review. We go through the rules and the key settings: who can manage the firewall, whether its firmware is current and still supported by the vendor, how VPN (virtual private network) remote access is set up and whether activity is being logged.
You get a prioritised report explaining what we found, why it matters and what to change. This is different from Managed Firewalls, where we look after your firewall on an ongoing basis: an assessment is a point-in-time review that suits any business firewall, whoever manages it.
Key benefits
- An independent view of what your firewall actually allows
- Unused, duplicated and overly broad rules identified
- Weaknesses in admin access, firmware and VPN settings highlighted
- Clear, prioritised recommendations in plain English
- Better records of why each rule exists
How does it work?
We agree the scope, obtain the configuration securely, review it rule by rule and setting by setting, then report back.
Agree scope and secure exchange
We confirm which firewalls are included and agree how the configuration export will be shared securely during the engagement. Please don't send firewall exports, passwords or network details through our website.
Review rules and settings
We review the rulebase, administration access, firmware and support status, VPN configuration, logging and alerting, comparing them with good practice and with what your business actually needs.
Report and discuss
We provide a prioritised report and talk it through with you, including which rules to remove, tighten or document and which settings to change first.
- Secure configuration exportShared securely during the engagement, not through our website
- Rulebase reviewUnused, shadowed, duplicated and 'any/any' rules
- Configuration reviewAdmin access, firmware, VPN and logging
- Prioritised recommendationsWhat to remove, tighten, update or document
What we check
- Rules that allow any source, any destination or any service, often called 'any/any' rules, and other overly broad access
- Unused rules with no recent matches, where the firewall records how often each rule is used
- Shadowed rules: rules that can't take effect because an earlier rule already matches the same traffic
- Duplicate and conflicting rules, and rules for systems that no longer exist
- Inbound access from the internet, including services published directly such as remote desktop or file shares
- Administrator access: who can manage the firewall, from where, and whether multifactor authentication is used
- Firmware version and vendor support status
- VPN configuration, including how users authenticate, encryption settings and who is allowed to connect
- Logging, alerting and how long logs are kept
- Rule names, comments and documentation of the business reason for each rule
Examples of issues a review can uncover
The 'temporary' supplier rule
A port opened for a supplier's one-off support session years ago, still allowing connections in from the internet.
Everything allowed between networks
An 'any/any' rule between the guest network and the office network, added once to fix a printing problem and then forgotten.
Admin page open to the internet
The firewall's management page reachable from anywhere, protected only by a password.
Firmware out of support
A firewall running firmware that no longer receives security fixes from the vendor.
Problems solved
Nobody knows why some rules exist
Without comments or records, nobody dares remove old rules. The review identifies what each rule does and which ones look unnecessary.
Inherited firewall, unknown history
After changing IT provider or staff, you may have no clear picture of how the firewall was set up. An assessment gives you a baseline.
Rules that allow far too much
Broad rules added for convenience can expose systems to the internet or to less trusted parts of the network.
Firewall management left exposed
Weak or shared admin passwords and management pages reachable from the internet let an attacker change the firewall itself.
Firmware nobody has checked
Firewalls need updates like any other device, and models past their support date receive no security fixes.
What's included
Included as standard
- Rulebase review covering unused, shadowed, duplicated and overly broad rules
- Administration access and firmware review
- VPN configuration review
- Logging and alerting review
- Documentation review
- A prioritised recommendations report, with a walkthrough of the results
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Making the recommended changes, quoted separately and carried out under change control
- Ongoing management through Managed Firewalls
- Network segmentation design through Secure Your Network
- A follow-up review once changes have been made
What's not included
- Penetration testing or attempts to exploit the firewall; see External Penetration Testing
- Changes to your firewall during the assessment, unless separately agreed
- Replacement hardware, licences or vendor support renewals
- Ongoing monitoring or management of the firewall
The review reflects the configuration at the time it was exported. Rule usage counters and logs only show recent activity, so rules that look unused are confirmed with you before anything is removed.
Firewall exports contain sensitive details. Please don't send them, or any passwords, through our website or quote form; we agree a secure way to exchange them during the engagement.
Who it's suitable for
- Businesses that have inherited a firewall from a previous IT provider
- Organisations whose firewall has run for several years without a review
- Businesses with several sites or site-to-site VPN connections
- Companies preparing for Cyber Essentials, where firewall rules are in scope
- In-house IT teams wanting an independent second opinion
Pricing
This service is tailored to your business, so we confirm the price after a short conversation about your requirements. There is no charge for the conversation.
Use the quote builder to add Firewall Rulebase & Configuration Assessments to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Number of firewalls
- Number and complexity of rules
- Number of sites and VPN connections
- Firewall make and model
- Quality of existing documentation
- Reporting requirements
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Should we have an assessment before moving to a managed firewall service?
It often helps. Managed Firewalls is an ongoing service where we configure, update and monitor your firewall, while an assessment is a one-off review. Doing it first gives you an independent picture of the current rules, which is especially useful if you inherited the firewall or want a second opinion on one someone else manages.
Can you review any make of firewall?
Most business firewalls can export their configuration for review. We confirm your make, model and firmware during scoping, and tell you upfront if anything limits what we can assess.
How do we share our firewall configuration safely?
We agree a secure method at the start of the engagement. Please don't upload firewall exports, passwords, IP addresses or network details through our website or quote form.
Will the review disrupt our network?
No changes are made during the assessment. We work from a configuration export and, where needed, read-only access, so your normal traffic isn't affected.
Will you remove the risky rules for us?
Removing a rule can break something that quietly depends on it, so we recommend changes and agree them with you first. We can then make them as a separate, controlled piece of work.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.