A world-leading Satellite Broadband Provider, operating a global network of ground stations, chose Flint Technology Services to support their Firewall Migration.
The Challenge
Our customer’s existing infrastructure, comprising 40 pairs of Cisco ASA firewalls, had reached its end of life.
Due to this, both the hardware and software were no longer supported.
They therefore asked us to carry out a comprehensive firewall migration to enhance their security posture and firewall capabilities.
The primary objectives were to enhance security, firewalling capabilities, and network resilience while consolidating and restructuring backbone networks at critical sites.
The Solution
Having carefully assessed the best solution, we migrated the customer’s outdated Cisco ASA firewalls to a new platform of Next-Generation Firewalls (NGFW) from Palo Alto Networks.
The project involved decommissioning obsolete IPSec VPN tunnels and taking advantage of advanced NGFW features such as:
- External Dynamic Lists (EDL)
- Zone-based firewalling
- Flood protection
- DoS protection
- Policy clean-up – including the removal of ‘Zero Hit’ rules and other redundant configurations.
We used the External Dynamic Lists, a useful feature provided by Palo Alto Networks’ NGFW that allows the firewall to dynamically incorporate external IP addresses, URLs or domains into security policies.
This capability enables the customer to have real-time threat prevention by using external intelligence feeds and blocklists to stop malicious traffic efficiently.
This replaced the old blocklists which had to be updated manually on each firewall pair whenever a new threat had been identified. By using EDL, this is centralised and automated.
The Solution Implementation
The project was divided into several stages to ensure a smooth transition while maintaining the security and integrity of the customer’s critical services.
Planning and Preparation
Our team of Subject Matter Experts collaborated closely with the customer’s stakeholders to fully understand their requirements and expectations.
We created highly detailed high-level and low-level documents to outline the migration strategy, which included an assessment of potential risks and plans to mitigate these should they arise.
Lab Testing
Before deploying the new firewalls in production environments, we conducted extensive testing in the customer’s lab.
Both the Flint Technology Services (Flint TS) team and the customer worked to identify vulnerabilities, to ensure the optimal performance and reliability of the new firewall.
Implementation
The migration was carried out by two experienced experts, with the project managed by our Project Managers.
Automation tools were employed to execute time-intensive bulk tasks, ensuring accuracy and minimising the possibility of network failures during the migration.
Documentation
We maintained a high degree of documentation throughout the project, before and after the migration, including creating detailed:
- Upgrade and Procedural Documents
- Methods of Procedure (MoPs)
- Handover Packs (HoPs)
- Site-Specific Diagrams (SSDs)
This documentation facilitated knowledge transfer, and will be invaluable for future maintenance and troubleshooting.
Stakeholder Engagement
Regular meetings were held with the customer’s stakeholders to ensure the project was meeting their expectations and requirements.
This meant that any concerns could be addressed promptly and we could make the necessary adjustments to enhance the resilience of the services.
The Result
The successful execution of the firewall migration project delivered numerous benefits to the satellite broadband provider including:
Enhanced Security
The deployment of Palo Alto Networks’ NGFWs significantly bolstered the customer’s security posture.
The incorporation of EDLs and advanced firewalling features offered robust protection against emerging threats and ensured real-time threat prevention.
Network Efficiency
By restructuring the backbone networks and decommissioning obsolete IPSec VPN tunnels, the customer’s network became more efficient. Thus, reducing complexity and improving performance.
Risk Mitigation
The thorough testing in Flint TS’s lab and the use of automation tools during migration minimised risks and potential disruptions to the customer’s services.
High-Quality Documentation
The comprehensive documentation provided clear insights into the project’s progress and ensured smooth knowledge transfer and future maintenance.
Increased Resilience
The project’s successful execution ensured the stability and resilience of the customer’s ground station data centres and satellite communication services.
Overall, our expertise, our collaboration with the customer, and effective utilisation of cutting-edge firewall technology resulted in a seamless and successful migration.
The satellite broadband provider now has a modern and robust security infrastructure to support their mission-critical operations.