Firewall and NGFW Implementation
Modern attacks travel over ordinary network traffic, much of it encrypted. A next-generation firewall inspects it before it reaches your systems. We design, implement and maintain Fortinet and Cisco solutions, with availability and response times set in the contract.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is a Next-Generation Firewall (NGFW)?
A Next-Generation Firewall (NGFW) is an advanced network device combining traditional traffic filtering with SSL/TLS inspection, IPS, application control, and zero-day threat protection. nFlo designs, implements and maintains Fortinet and Cisco solutions — rule migration without downtime, high availability where it is needed, and support terms agreed individually in the contract.
Contact your account manager
Discuss Firewall and NGFW Implementation with your dedicated account manager.
Traditional firewalls don't see 80% of modern threats
NGFW tailored to your environment
Design
Architecture matched to business and budget
Implementation
Configuration, migration, tests without downtime
Contract-based Support
Maintenance, optimisation, contracted SLA
Firewall implementation means planning, configuring, testing and launching a network firewall — including a next-generation firewall (NGFW) — and then keeping its rules aligned with the company’s security policy. NIST SP 800-41 describes this cycle in five phases: planning, configuration, testing, deployment and management, and a new firewall is checked on a test network that mirrors production before it takes over real traffic. How a firewall differs from a UTM appliance and what its rules look like is explained in our article From UTM to NGFW and the firewall glossary entry.
When a Firewall Lets Ransomware Through
Without modern NGFW:
- No encrypted traffic inspection (the vast majority of attacks hidden in SSL/TLS)
- No application control - only ports (Dropbox = Facebook = HTTPS:443)
- Don’t know who connects where (no user identification)
- Don’t meet NIS2, PCI DSS and cyber insurance requirements
Complete Implementation - From Design to Contract-based Support
We don’t just sell hardware. We design architecture matched to your business, migrate rules without downtime, train your team, resell vendor support and provide our own support on terms set in the contract — scope and response times (SLA) are agreed individually. You know your network is protected by experts.
What you get:
- Environment assessment and requirements analysis (security, performance, HA)
- Architecture design (standalone, HA, clustering, SD-WAN)
- Solution selection matched to budget and requirements
- Migration from existing firewall without production downtime
- Security policy configuration (App Control, IPS, AV, SSL inspection)
- Integration with Active Directory, SIEM, NAC
- Functional, performance and penetration tests
- Documentation (network diagrams, policy matrix, runbooks)
- IT team training on management and troubleshooting
- Optionally: managed firewall from us, within the contracted scope
Who Is It For?
This service is for you if:
- You have outdated firewall and need upgrade to NGFW
- You’re expanding infrastructure and need new locations
- You’re subject to NIS2, PCI DSS and need compliance
- You want visibility and control over application traffic
- You need expert support - don’t have in-house resources
Why NGFW?
Next-Generation Firewall is more than traditional firewall:
NGFW vs Traditional Firewall Capabilities
| Function | Traditional FW | NGFW |
|---|---|---|
| Port/IP Control | ✓ | ✓ |
| Application Control | ✗ | ✓ (e.g., block Facebook, YouTube) |
| User Identity | ✗ | ✓ (AD integration) |
| SSL/TLS Inspection | ✗ | ✓ (scans encrypted traffic) |
| IPS/IDS | Optional | ✓ built-in |
| Advanced Malware Protection | ✗ | ✓ (sandboxing, AI) |
| Threat Intelligence | ✗ | ✓ (updates every 5 min) |
| Reporting | Basic | Advanced dashboards |
Use Case Examples
Application Control: “Block Dropbox for everyone except IT department”
User-based policies: “Marketing can access YouTube, finance cannot”
SSL Inspection: “Scan encrypted traffic for malware”
Geo-blocking: “Block connections from Russia, China, North Korea”
Supported Platforms
Fortinet FortiGate
Performance and security effectiveness leader (NSS Labs):
- Entry: FortiGate 40F-100F (small offices, 50-200 users)
- Mid-range: FortiGate 200F-600F (medium companies, 200-2000 users)
- High-end: FortiGate 1000F-7000F (data center, ISP)
- Capabilities: Security Fabric, SD-WAN, FortiGuard Services
- Our competencies: NSE 4, NSE 7, NSE 8
Typical price: from €3,750 (FG-60F) to €125,000+ (FG-3000F)
Cisco Secure Firewall (Firepower)
Integrated security for Cisco ecosystem:
- Firepower 1000 Series (small branch)
- Firepower 2100 Series (medium branch, campus)
- Firepower 4100/9300 (data center)
- Capabilities: Snort 3 IPS, Talos Intelligence, SecureX
Typical price: from €7,500 (FPR-1010) to €150,000+ (FPR-4150)
Engagement Models
Implementation Project
One-time firewall implementation:
- Assessment and design
- Hardware delivery and installation
- Configuration and migration
- Tests and training
- Management handover
Time: 2-6 weeks | Price: from €7,500 (work) + hardware and licenses
Managed Firewall
Full management by nFlo:
- Firewall implementation
- Management within the contracted scope
- Rule changes (contracted SLA)
- Monitoring and alerts
- Monthly reports
- Incident response support
Price: from €1,250/month (+ hardware and licenses in lease)
Support and Maintenance
Support for existing firewall:
- 24/7 helpdesk
- Configuration changes
- Troubleshooting and diagnostics
- Quarterly health checks
- Firmware and license upgrades
Price: from €750/month
How do you plan a firewall replacement after End-of-Service and migrate the configuration?
A firewall past the end of vendor support usually still passes traffic, but it loses what makes it part of your defenses: updated signatures, software fixes and vendor help when something breaks. That is why a replacement is planned ahead, not after the first incident — and treated as an opportunity to clean up the rules, not just to swap hardware.
What to inventory before deciding:
- models and software versions of every device, including branches and spares, together with their life cycle dates,
- rules with hit counters, objects, address translations and VPN tunnels,
- integrations: user directory, SIEM, NAC, remote access authentication,
- the traffic that actually flows through the firewall, including encrypted traffic under inspection.
How to migrate without downtime:
- Clean up the rules before migration — unused and duplicate rules should not land on the new appliance.
- Move the configuration and adapt it to the new platform instead of copying it one to one.
- Run the new appliance in parallel with the old one and test the key traffic paths.
- Cut traffic over in an agreed maintenance window, with a rollback plan ready.
- After cutover, check traffic, logs and policies, and update the documentation.
Example: FortiGate. Fortinet describes the device life cycle with three dates: End of Order (the last day to order), Last Service Extension Date (the last day to extend support or security subscriptions, 12 months before End of Support) and End of Support — according to Fortinet, no service contract can be extended past that date. Fortinet publishes the dates for specific models on its public product life cycle list on its support portal. We cover the device family and choosing a successor on the FortiGate and FortiGate NGFW pages.
If your devices are approaching the end of support, contact us — we will start with an inventory and a replacement plan. You can read about how nFlo works with the vendor on the Fortinet page.
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Assessment
Requirements analysis and current architecture audit
Design
Architecture and security policy design
Implementation
Deployment, configuration, rule migration
Testing
Functional, performance, security tests
Handover
Documentation, training, management handover
Benefits for your business
What you gain by choosing this service.
Threat Protection
Block malware, ransomware, exploits in real-time
Traffic Visibility
Know who, what and when sends through network
Regulatory Compliance
Meet NIS2, PCI DSS, ISO 27001 requirements
Business Continuity
HA/redundancy, contract-based support and SLA
Related Articles
Expand your knowledge with our resources.
Network traffic analysis with NetFlow and IPFIX flows: what you see, what you miss and how it supports NIS2
The firewall guards the perimeter, EDR guards devices with an agent. Traffic between servers, printers and cameras inside the network falls outside both. We show what can be detected from flows alone, when you need packet capture and what network data you need within 24 hours of detecting an incident.
Read more →From UTM to NGFW — The Evolution of Firewalls: What to Choose in 2026?
UTM and NGFW represent two generations of network firewalls that competed for dominance in the network security segment for years. In 2026, the boundaries between them are blurring — but choosing the right solution still matters for protecting your organization.
Read more →What is a Firewall? Types, Operation, and Deployment Best Practices
A firewall is a device or software that controls network traffic. Learn about firewall types, how they work, and deployment best practices.
Read more →Frequently Asked Questions
Common questions about Firewall and NGFW Implementation.
How much does NGFW firewall implementation cost?
Implementation project (work): from €7,500 for simple standalone, €12,500-20,000 for HA cluster with migration. Hardware: Fortinet from €3,750, Cisco from €7,500. Annual licenses: a significant share of the hardware price.
How long does firewall implementation take?
Simple standalone firewall: 1-2 weeks. HA cluster with legacy migration: 4-6 weeks. Includes assessment, design, implementation, tests and training. Rule migration happens without production downtime during maintenance window.
Can you take over management of existing firewall?
Yes - we support Fortinet and Cisco. First we do health check, update firmware/licenses, then take over management within the contracted scope. Managed firewall model from €1,250/month with an SLA for rule changes agreed in the contract.
Does NGFW firewall slow down network?
Modern NGFWs are designed for high performance. Fortinet FG-200F: 20 Gbps throughput, 2.4 Gbps with IPS+AV. Cisco FPR-2130: 10 Gbps throughput, 4.5 Gbps with IPS. During design we match model to your traffic with 30% headroom.
What does a firewall implementation look like step by step?
Following NIST SP 800-41, a firewall implementation has five phases. Planning starts after a risk assessment and sets the requirements for the firewall. Configuration covers installing the hardware or software and setting up the rules. Testing takes place on a test network with no connection to production: connectivity, the ruleset, application compatibility, management, logging and performance are checked. Then comes deployment in the company network and management throughout the firewall's life cycle.
How should firewall rule changes be managed after implementation?
NIST recommends changing firewall rules and policies through a formal change management process, periodically reviewing or testing the ruleset against the policy, installing vendor patches and continuously monitoring logs and alerts. For entities covered by NIS2 this is also part of the measures in Article 21(2)(e) — security in the maintenance of network and information systems, including vulnerability handling.