Key takeaways
- ISP routers aren't security devices
- NGFWs understand applications, users and content
- Size the firewall for throughput with all features on
- Firewalls need ongoing updates and monitoring
Many small offices rely on the router supplied by their internet provider. It connects you to the internet, but it offers little real protection. A next-generation firewall (NGFW) sits between your network and the internet and inspects everything that passes through.
Beyond ports and addresses
Traditional firewalls allow or block traffic based on ports and IP addresses. NGFWs understand applications, users and content, so they can allow Microsoft Teams while blocking unknown file-sharing apps, or apply different rules to different departments.
Key features
A modern NGFW typically includes:
- Intrusion prevention that blocks known attack patterns
- Malware and sandbox inspection of downloads
- Web filtering by category and reputation
- Application control and bandwidth shaping
- Secure VPN for remote staff and branch offices
- Detailed logging and reporting
Encrypted traffic
Most web traffic is encrypted, which hides threats from basic filters. NGFWs can inspect encrypted traffic where policy allows, finding malware that would otherwise pass straight through.
Sizing matters
Firewall throughput drops when security features are enabled. Choose a model sized for your internet speed with all protections on, not just the headline figure.
Management and updates
A firewall is only as good as its configuration and updates. Threat signatures change daily, and firmware needs patching. Managed firewall services keep rules, updates and monitoring under control.
Firewalls for remote work
Most NGFWs include VPN capability for remote staff. Modern designs go further with zero-trust network access, which checks each user and device before granting access to specific applications rather than the whole network. This reduces risk if a laptop is compromised.
Signs your firewall needs attention
Review your firewall if:
- Its security subscriptions have expired
- Firmware hasn't been updated in months
- No one has reviewed the rules in years
- It can't keep up with your internet speed
- It's reached end of support from the manufacturer
- You have no logs or reports from it
How firewalls fit a layered defence
A firewall is one layer in a complete security approach, not the whole answer. It controls what enters and leaves your network, but attacks also arrive through email, compromised passwords and infected laptops that connect from outside. A strong design combines the firewall with endpoint protection on every device, email security, multi-factor authentication, regular patching and reliable backups. Many firewalls integrate with endpoint agents, so a laptop that shows signs of infection can be isolated from the network automatically. Together, these layers mean an attacker has to get past several independent controls, not just one.
Planning a firewall replacement
Replacing a firewall is an opportunity to review your whole network. Document existing rules and remove those no longer needed, plan network segments for staff, guests, phones, servers and cameras, and set up VPN access with multi-factor authentication. Configure the new firewall in advance and swap it in out of hours, testing internet access, remote access, phones and key applications before staff return. A well-planned cutover usually takes an hour or two.
Firewall reporting
Firewall reports provide valuable insight into how your internet connection is used and what threats are being blocked. Monthly reports can show top applications and websites, bandwidth use, blocked attacks and malware, and VPN usage. This helps you spot unusual activity, identify bandwidth-hungry applications and demonstrate security controls to auditors or clients. Reports are most useful when someone reviews them and acts on the findings, which is why many businesses include firewall reporting in their managed IT service.
Which brand?
We deploy Fortinet, Sophos, Palo Alto Networks, WatchGuard and SonicWall firewalls, and recommend based on your size, features and budget.
Frequently asked questions
Yes. Small businesses are frequent targets precisely because they often lack proper protection.
Annual licences that provide threat updates, web filtering, sandboxing and support. Without them, the firewall loses much of its protection.
An undersized one can. Correct sizing keeps performance high with security features enabled.
Yes. Managed firewall services handle updates, rule changes and monitoring.
