Replace the perimeter firewalls at data centre A

Summary

Replace the two perimeter firewalls at data centre A with the next generation. The current pair runs a firmware that no longer receives fixes, and the new pair offers a managed configuration that we can review.

Impact

Customer traffic through data centre A is interrupted for up to ten minutes at each switch-over, and a mistake in the copied rules could expose a customer's internal service. Both customers with a site-to-site tunnel are told beforehand.

Approval

Planned. Approval by the Network Lead and the Information Security Officer is due the week before the window.

Plan

Install the new pair beside the old one, copy and review every rule with a second engineer, move one customer network as a trial, and then move the rest in an evening window. Check each customer tunnel after the move.

Fallback

Patch the cables back to the old pair, which stays powered and configured until the second week after the move.

Follow-up

Update the network diagrams and the firewall rule review procedure, and retire the old pair in the asset register.

Evaluation

To be written once the Change is closed.