In short
A managed firewall is a firewall whose configuration, updates and security services are looked after by a provider. Forever Systems manages Sophos, Cisco, WatchGuard, Check Point and Meraki firewalls: rules, firmware, VPN, intrusion prevention, web filtering and change control, with logs fed to a vendor MDR or SIEM service where you buy one.
Get a quote for a managed firewall
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is a managed firewall?
A next-generation firewall does far more than block ports. It inspects traffic for intrusions and malware, filters web access, controls applications, terminates VPNs for home workers and other sites, and logs what it sees. Each of those features needs configuring, and the configuration drifts: temporary rules become permanent, firmware falls behind, subscriptions lapse, and nobody reads the logs.
A managed firewall service hands that ongoing work to a provider. You still own the decisions about what should be allowed; the provider makes sure the firewall enforces them, stays up to date and is connected to the services that watch for attacks. At Forever Systems we manage firewalls from several vendors and agree the scope with you at quote.
Managed firewall service description
This is what a managed firewall service from Forever Systems typically includes. Your quote sets out exactly what is in scope.
| Area | What we do | Notes |
|---|---|---|
| Rule management | Make agreed rule changes, document them and review rules for ones no longer needed | Changes through an agreed request and approval process |
| Firmware and updates | Plan and apply firmware updates in maintenance windows you agree | Critical security fixes prioritised with your approval |
| VPN | Site-to-site and remote access VPN set-up, user changes and troubleshooting | Identity-based access with MFA where the platform supports it |
| Threat protection | Configure intrusion prevention, malware scanning, sandboxing and application control | Depends on the vendor's security subscription |
| Web filtering | Category and policy settings, with exceptions handled on request | Supports acceptable use and safeguarding policies |
| Logging | Send firewall logs and alerts to a vendor MDR, NDR or SIEM service where you buy one | Retention depends on the service chosen |
| Configuration backup | Keep current configuration backups so a replacement can be restored | Hardware replacement depends on the vendor's support terms |
| Subscriptions | Track renewals for security services and support | Handled through your Forever Systems account |
What we do not do is watch your firewall logs around the clock ourselves. If you want 24/7 monitoring of network activity, that comes from a vendor service such as Sophos MDR, WatchGuard Total MDR or Check Point MDR, which we set up and manage. See cyber security monitoring services for how that works.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
Firewalls we manage
We manage firewalls from several vendors, so we can work with what you have or recommend a change when there is a good reason. The table describes each platform; it is not a ranking.
| Platform | Management | Security features | Links to detection and response |
|---|---|---|---|
| Sophos Firewall | Locally or from the Sophos cloud console, with zero-touch deployment | Network, Web and Zero-Day Protection, or the Xstream Protection bundle | Synchronized Security with Sophos Endpoint; threat feeds from Sophos MDR and NDR Essentials in Xstream Protection |
| Cisco Secure Firewall | Management Center or Security Cloud Control | Snort 3 intrusion prevention, application and URL control, malware defence | Feeds Cisco XDR |
| WatchGuard Firebox | WatchGuard Cloud or locally | Basic Security Suite: intrusion prevention, gateway antivirus, application control and web filtering; Prime and Total suites add APT Blocker sandboxing | WatchGuard Total MDR can monitor Fireboxes; WatchGuard NDR analyses Firebox traffic |
| Check Point CloudGuard Network Security (now listed by Check Point as Cloud Firewall) | Check Point management, with policy shared with on-premises Check Point gateways | Firewall, intrusion prevention, application control, VPN and threat prevention for cloud traffic | Check Point MDR covers network alongside endpoint, email, cloud and identity |
| Meraki MX | The cloud-based Meraki dashboard | Stateful firewall and VPN; Advanced Security adds intrusion prevention, content filtering and malware protection | Logs can be sent to a SIEM |
Forever Group's Meraki firewall page covers the Meraki range, and its Cisco security pages cover Cisco Secure Firewall alongside the rest of Cisco's security portfolio. For firewalls in Azure and AWS, see WatchGuard Firebox Cloud and the Check Point option above. We do not quote model numbers here: the right appliance depends on your connection speed, user count and features, so we size it at quote.
Network detection: seeing inside the network
A perimeter firewall sees traffic entering and leaving. It does not see an attacker moving from one internal device to another, or a printer, camera or building system that cannot run an endpoint agent. Network detection and response (NDR) fills that gap:
- Sophos NDR: a passive sensor on a switch mirror port spots lateral movement, command-and-control traffic and rogue devices, with detections flowing into Sophos XDR and Sophos MDR
- WatchGuard NDR (formerly ThreatSync+ NDR): analyses Firebox traffic, and on higher options flow logs from other switches, firewalls and cloud workloads, without in-line sensors
- Blackpoint CompassOne Standard: not NDR as such, but it collects firewall and network logs into its SIEM, with 365 days of log storage, alongside Blackpoint's 24/7 MDR
When an MDR analyst confirms a threat, some combinations can act at the network edge. With Sophos, for example, a confirmed threat can be pushed to Sophos Firewall so Active Threat Response blocks the activity. That joined-up response is the main reason to choose a firewall from the same vendor as your MDR service, and it is one of the questions we help you weigh. Managed XDR covers services that correlate network, endpoint and identity data.
Is a managed firewall the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Change control and rule hygiene
Most firewall weaknesses are not product flaws but configuration: an old rule allowing remote desktop from anywhere, a VPN account for someone who left, an admin interface exposed to the internet. A managed service reduces that risk through process:
- Baseline. We review the current configuration, document what each rule is for, and flag risky or unused rules.
- Request. Changes come through an agreed channel, with the reason recorded.
- Approve. Changes that widen access are approved by the person you nominate.
- Apply and record. We make the change, back up the configuration and keep a history.
- Review. At agreed intervals we review rules, VPN accounts, admin access and subscription status with you.
That record is also useful evidence for auditors, insurers and customers who ask how your perimeter is controlled.
Choosing a managed firewall provider
When you compare managed firewall services, ask:
- Change process: how requests are made, who approves changes that widen access, and how changes are recorded
- Updates: how firmware updates are tested and scheduled, and who decides when a security fix cannot wait
- Visibility: whether you keep read access to your own firewall and its logs
- Detection: where the logs go, who looks at them, and whether that is a 24/7 service or business hours only
- Hardware: whose support contract covers a failed appliance, and how a replacement is configured
- Exit: whether you receive the configuration and admin credentials if you move provider
We answer each of these in the quote. Our guide to choosing an MSSP covers the wider questions, and SIEM as a service explains how firewall logs can be kept and searched for investigations. Firewall management is one of our managed security services.
Firewalls, Cyber Essentials and compliance
Firewalls are one of the five technical control areas in Cyber Essentials, which expects default admin passwords to be changed, administrative interfaces to be kept off the internet unless protected, unauthenticated inbound connections to be blocked by default, and inbound rules to be approved and documented by an authorised person. A managed service with change control and a rule history helps you show that.
For larger or regulated organisations, firewall logs are part of the logging and monitoring evidence that ISO/IEC 27001 and the NCSC Cyber Assessment Framework look for. See ISO 27001 logging and monitoring and our other compliance guides.
Pricing depends on the platform, the number of firewalls, the security subscriptions and the scope of management, so ask us for a quote. Contact us to talk about your firewalls.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is a managed firewall?
A managed firewall is a firewall whose rules, firmware, VPN, threat protection and logging are looked after by a provider. You decide what should be allowed; the provider keeps the firewall configured, updated and connected to the services that detect attacks.
What does a managed firewall service include?
Usually rule changes through an agreed process, firmware updates in maintenance windows, VPN management, intrusion prevention and web filtering settings, configuration backups, subscription renewals and sending logs to a monitoring service. With Forever Systems the exact scope is written into your quote.
Do managed firewall services include 24/7 monitoring?
Not on their own. Forever Systems manages the firewall but does not run its own 24/7 monitoring. Round-the-clock monitoring of network activity comes from vendor services such as Sophos MDR, WatchGuard Total MDR or Check Point MDR, which we can set up and manage.
Which firewalls do you manage?
We manage Sophos Firewall, Cisco Secure Firewall, WatchGuard Firebox, Check Point CloudGuard Network Security and Meraki MX. We can take over management of an existing firewall after reviewing its configuration.
How much do managed firewall services cost?
It depends on the platform, the number of firewalls, the security subscriptions each one needs and the management scope. Ask us for a quote.
Still have a question about a managed firewall?
Ask us and a member of our team will reply by email.