Network Security and Managed Firewall Services

Managed Firewall and Network Security Across On-Premises, Branch, and Cloud Networks

Firewalls protect the network only as effectively as their rules, firmware, and change history are maintained. Over time, rule sets can accumulate exceptions without clear ownership or documented justification. Calance network security and managed firewall services cover design, deployment, rule cleanup, threat prevention, network segmentation, remote access, change control, and 24/7 monitoring across on-premises, branch, and cloud environments. You receive a documented security baseline, a ruleset aligned with actual business requirements, and a complete record of every change. Threat investigation is supported by our managed detection and response service, access architecture by our zero trust services, and independent security testing by our penetration testing services.

What Our Managed Firewall and Network Security Services Include

Engagements draw on the eight areas below, scoped to the firewalls, sites, and cloud environments you run today.

Firewall Architecture, Sizing, and Deployment

New and replacement firewalls are sized from measured throughput, session counts, and inspection load, then deployed in high-availability pairs where the site requires it. Configurations follow vendor hardening guidance and CIS benchmarks from the first day.

Ruleset Review and Cleanup

Existing rulesets are reviewed line by line to remove any-any rules, shadowed and duplicate entries, unused objects, and rules that have not matched traffic in months. Each remaining rule is given an owner and a documented business reason.

Change Control and Configuration Backup

Every rule, object, and policy change is raised as a ticket, reviewed by a second engineer, applied in an agreed window, and verified afterward. Configurations are backed up automatically after each change so any version can be restored.

Intrusion Prevention and Threat Filtering

Intrusion prevention, anti-malware, web and DNS filtering, and geo-blocking profiles are tuned to your traffic rather than left at vendor defaults. TLS inspection is applied selectively, with exclusions for banking, health, and other sensitive categories documented.

Network Segmentation and Internal Zones

Users, servers, operational technology, guest Wi-Fi, payment systems, and management interfaces are separated into zones with named, logged rules between them. A compromised laptop then reaches only what its zone permits, limiting how far an incident can spread.

VPN and Secure Remote Access

Site-to-site tunnels, remote access VPN, and zero trust network access connectors are configured with multifactor authentication and per-group access policies. Tunnel health and user connections are monitored, and stale accounts are removed during each quarterly review.

Cloud Firewall and Security Group Management

Azure Firewall, network security groups, AWS Network Firewall, and security groups are managed to the same standard as on-premises devices, with rules defined in code where possible. Cloud network operations extend through our Azure managed services.

24/7 Monitoring, Firmware, and Hardware Lifecycle

Firewall health, throughput, high-availability state, tunnel status, and security events are monitored around the clock alongside our infrastructure monitoring services. Firmware is updated in tested windows, and end-of-support dates are tracked so replacements are planned rather than forced.

Common Firewall Issues Addressed During Onboarding

Firewall estates drift as exceptions accumulate and staff change. The issues below appear in most reviews, and each is corrected during onboarding, with deeper exposure testing available through our vulnerability assessment service.

Any-any and overly broad rules

Rules opened for past projects still allow traffic wider than current business needs require.

Undocumented rules

Entries without owners or comments stay in place because removing them without review carries operational risk.

Firmware behind or past support

Devices run versions with published vulnerabilities, or hardware has left vendor support with no replacement plan.

Flat internal networks

Users, servers, and management interfaces share one segment, so a single compromised device can reach almost everything.

Remote access without strong authentication

VPN accounts rely on passwords alone, and accounts for former staff and vendors remain active.

Logs that are not kept or reviewed

Firewall logs are overwritten within days, leaving little to review when an incident or audit request arrives.

Firewall Platforms and Cloud Environments We Manage

Management covers the major next-generation firewall platforms and the native controls in Azure and AWS, so on-premises, branch, and cloud rules follow one standard. [CONFIRM: which firewall vendors Calance supports or holds certifications for]

Fortinet FortiGate

Head office, branch, and SD-WAN edge

Policies, security profiles, SD-WAN rules, and FortiManager where present

Palo Alto Networks

Data center and enterprise perimeter

Security policies, App-ID and threat profiles, and Panorama where present

Cisco Secure Firewall

Data center and campus perimeter

Access policies, intrusion rules, and Firewall Management Center where present

SonicWall

Small sites and branch offices

Access rules, security services, and VPN configuration

Check Point

Enterprise perimeter and internal segmentation

Policy layers, threat prevention, and management server administration

Azure Firewall and network security groups

Azure virtual networks and hub-and-spoke designs

Rule collections, NSG rules, and Firewall Manager policies

AWS Network Firewall and security groups

AWS VPCs and transit gateway designs

Stateful rule groups, security groups, and network ACLs

How Firewall Changes Are Requested, Reviewed, and Applied

Every change, routine or urgent, follows the same six steps, so each one is reviewed, approved, and recorded before and after it is applied.

Change turnaround by priority

Standard changes: Applied within three business days in the next agreed window.
Urgent changes: Applied within one business day after approval is confirmed.
Emergency blocks: Applied within one hour, 24/7, for active threats or incidents.

Request

Raised by your team or ours, with business reason, source, destination, and port
Review

Checked by a second engineer for scope, conflicts, and least-privilege fit
Approve

Confirmed by your named approver for anything outside standing approval
Apply

Implemented in the agreed window with the previous configuration saved first
Verify

Traffic tested against the request, with rollback if the result is wrong
Record

Ticket closed with the rule ID, approver, and timestamp for audit purposes

Onboarding Plan for the First 30 Days

Onboarding follows a fixed 30-day plan for a single site, extended for larger or multi-site estates.

Week 1: Review and Document

DAYS 1–7 • DISCOVERY PHASE

Collect configurations, rulesets,firmware versions, and support statusper device
Map network zones, VPN tunnels, andremote access users with their owners

Deliverable: Baseline Device Dossier & Inventory

Weeks 2 and 3: Clean Up and Harden

DAYS 8–21 • REMEDIATION & HARDENING

Remove unused and duplicate rules,and narrow broad rules with owneragreement
Update firmware, enforce MFA onremote access, and tune threatprevention profiles

Deliverable: Zero-Blindspot Hardened Policy

Week 4: Connect and Hand Over

DAYS 22–30 • TELEMETRY & TRANSITION

Connect logging and 24/7 monitoring,and test alert routing to namedcontacts
Deliver the documented baseline andagree the change approval processwith you

Deliverable: 24/7 Monitored Gateway & CABBaseline

Reporting, Quarterly Rule Reviews, and Audit Evidence

Reporting runs on three cadences so the state of the firewall estate is documented and available when it is needed.

Every Month

You receive a change log with approvers, a summary of blocked threats and intrusion events, VPN and tunnel health, firmware status, and any open recommendations, with the live console available to your team at all times.

Every Quarter

A full ruleset review identifies rules that stopped matching traffic, checks broad rules against current business needs, flags stale VPN accounts, and confirms segmentation still reflects how the network is used. Findings are agreed with you before changes.

On Request

Configuration exports, change histories, and rule justifications are supplied for audits, PCI DSS and HIPAA reviews, and cyber insurance readiness questionnaires, so firewall evidence comes from records already kept rather than assembled after a request arrives.

Why Organizations Choose Calance for Firewall Management

The points below describe how the service is organized and the evidence behind each.

Each change is checked by a second engineer before it is applied. Peer review, saved configurations, and recorded approvals mean every change can be explained, traced to a request, and reversed if needed.

Replacement and platform recommendations follow your traffic, site count, cloud footprint, and team skills. Existing firewalls are kept wherever they remain supported and meet the requirement, and replacement is recommended only with a documented technical or support reason.

Firewall engineers work alongside infrastructure, cloud, and security operations teams within one cybersecurity services practice, supported by partners including CrowdStrike and Arctic Wolf, so suspicious traffic reaches investigation without a handoff between separate vendors.

Onshore engineers own the service while offshore teams cover overnight monitoring and emergency blocks. A 90% client retention rate and relationships such as Yamaha at 15+ years and Isuzu at 20+ years reflect that continuity.

What do managed firewall services include?

The service covers firewall design, ruleset cleanup, change control, intrusion prevention and filtering, segmentation, VPN and remote access, cloud firewall rules, 24/7 monitoring, and firmware management. Scope is confirmed during the initial review against the devices and sites you run.

Can you manage the firewalls we already have?

Yes, in most cases. Existing firewalls are reviewed, cleaned up, and brought under managed change control without replacement. Hardware is replaced only when it has left vendor support or cannot handle the throughput and inspection load required.

Which firewall platforms do you support?

Fortinet FortiGate, Palo Alto Networks, Cisco Secure Firewall, SonicWall, and Check Point are supported on-premises, along with Azure Firewall, network security groups, AWS Network Firewall, and security groups in the cloud. Other platforms are assessed during the review.

How quickly are firewall changes made?

Standard changes are applied within three business days, urgent changes within one business day after approval, and emergency blocks for active threats within one hour around the clock. Every change is peer reviewed and recorded regardless of priority.

How is this different from managed detection and response?

Managed firewall services control what traffic is allowed and keep the firewall itself healthy. Managed detection and response investigates threats across endpoints, identities, and networks. Firewall events feed that investigation, and the two services are commonly run together.

Does our team keep access to the firewalls?

Yes. Your administrators keep read access and, where agreed, change access under the same review process, using named accounts with multifactor authentication. Every change from either team is logged against a ticket, so the history stays complete.

How Are Managed Firewall Services Priced?

Pricing reflects the number of firewalls and sites, high-availability pairs, cloud environments in scope, and coverage hours. Calance confirms the estimate after the initial review, so the proposal reflects the actual firewall estate rather than assumptions.

How Long Does Onboarding Take?

Onboarding typically takes 30 days for a single site, covering review, cleanup, hardening, and monitoring setup. Multi-site estates, cloud environments, or firmware upgrades across many devices extend that period, and Calance confirms the timeline after review.

What Does Our Organization Need to Provide?

Clients provide administrator access to each firewall, current network diagrams if available, a named approver for changes, escalation contacts, and existing vendor support contracts. Calance supplies the engineers, monitoring, change control, documentation, and quarterly ruleset reviews.

What Happens If We End the Engagement?

Configurations, rule documentation, change history, and administrator credentials are handed back over an agreed notice period. Calance briefs your team or the incoming provider on open changes and recommendations, so the firewalls stay protected through the transition.

Network Security and Managed Firewall