Planning a network and firewall refresh without downtime

Networks tend to be replaced in one of two ways. Either something fails and the replacement happens in a rush, or someone plans it, and most staff barely notice it happened. I have done both over the years, and the planned version is cheaper, calmer and far less likely to break the phone system on a Monday morning.

This article covers how to tell a refresh is due, what to assess before you spend anything, and how to stage the cutover so the business keeps running.

Signs your network is due for a refresh

Age alone is not the trigger. These are the signals I look for:

• The firewall or switches are out of vendor support. No more firmware updates means newly found vulnerabilities stay open for good. For a device that sits between your business and the internet, that is the clearest signal of all.
• Security subscriptions are expiring or have lapsed. Many firewalls quietly lose web filtering, intrusion prevention or threat updates when the subscription ends, while still passing traffic as if nothing changed.
• The firewall cannot keep up with your internet connection. If turning on security inspection drops your throughput well below what you pay your provider for, someone will eventually be tempted to turn inspection off.
• Wi-Fi complaints are constant. Dead zones, dropped video calls and consumer-grade access points added one at a time over the years.
• Everything is on one flat network. Staff laptops, guest devices, printers, cameras and the door system all share the same segment, so one compromised device can reach everything.
• Nobody fully understands the configuration. Rules nobody can explain, port forwards for vendors you no longer use, settings that only one former employee understood.
• The business has changed. A new office, a move to cloud services, more remote staff or a new phone system often outgrows a network designed for how you worked five years ago.

What to assess before you buy anything

The most common mistake I see is choosing hardware first and working out the design afterwards. The assessment comes first, and it is mostly about finding the things that will break if nobody accounts for them.

• Inventory. Every firewall, switch, access point and internet circuit, with model, firmware version and end-of-support date.
• Current configuration. A full export of the firewall rules, NAT, VPNs, DHCP scopes and reservations, VLANs and wireless settings.
• Dependencies. Site-to-site VPNs to other offices or partners, inbound services published to the internet, vendors that connect in remotely and whitelist your static IP, printers and scanners with fixed addresses, phones that rely on quality of service settings, cameras, door access and building systems.
• Traffic and growth. Peak usage on each circuit, how much traffic goes to cloud services, and expected headcount and site changes over the next few years.
• Power and cabling. Power over Ethernet requirements for phones, cameras and access points, the state of the cabling, and whether the network cabinet has battery backup.

Talk to the people who use the network, too. The receptionist knows which corner of the office drops calls. The controller knows which vendor connects in at month end. These details rarely appear in a configuration file.

Design before hardware

With the assessment in hand, the target design can be written down. It should cover how the network is segmented, with staff, guests, servers, voice, printers and building systems kept apart and only the connections they need allowed between them. It should include an IP addressing plan with room to grow, a cleaned-up firewall rule set where every rule has an owner and a reason, and a remote access approach that ties into your identity system and MFA.

Then decide where redundancy is worth paying for. A second internet connection from a different provider, with automatic failover, is good value for most offices. A pair of firewalls in high availability makes sense when an hour offline costs more than the second unit. These are business decisions, and the cost of downtime is the number that should drive them.

Only now is it time to choose hardware, sized for the design and for inspected throughput, not the headline number on the box.

Staging the cutover

This is where most of the downtime is won or lost. The approach I follow has five parts.

1. Build and test off the production network. New equipment is updated to current firmware, configured from the new design and tested on a bench before it goes anywhere near the live network. Every rule and VPN is checked with real devices.
2. Move what you can in parallel. Not everything needs to change in one night. New Wi-Fi can run alongside the old network while groups move over. Switches can be replaced one closet at a time. The firewall swap is usually the one true cutover, so keep it as small as possible.
3. Prepare the outside world. Lower DNS record lifetimes a few days ahead if public IP addresses will change. Warn vendors who whitelist your IP. Confirm with your internet provider whether anything on their side needs to change.
4. Agree a rollback plan in advance. The old firewall stays powered, configured and labelled. Cables are labelled. Before the window starts, decide exactly what would trigger a rollback and by what time, so nobody is tempted to keep troubleshooting at three in the morning.
5. Test against a written checklist. Internet access, VPNs, phones, printing, the main business applications, vendor remote access, inbound services, Wi-Fi in each area, DHCP and DNS. Each item is ticked off by a person, not assumed.

Schedule the cutover outside business hours, and make sure someone is on-site or on the network first thing the next business day. Most remaining issues surface when everyone arrives and starts working, and they are quick to fix when someone is already watching.

What without downtime really means

I want to be honest about this. Swapping a firewall involves a short interruption, usually in a planned window outside business hours. The realistic goal is no unplanned downtime and no disruption during the hours your team is working. With good preparation, that is very achievable.

After the cutover

• Update the network diagram, configuration backups and documentation the same week.
• Watch logs closely for traffic being blocked that should not be.
• Review the rule set again after a month, removing anything that turned out to be unnecessary.
• Wipe the old equipment before disposal. Old firewalls hold VPN keys and passwords.
• Put firmware updates and subscription renewals on a schedule so the new equipment does not age the way the old one did.

How Ceifa plans and runs network refreshes

Network and firewall refreshes are a regular part of the work we do for clients, from the assessment through to the morning after the cutover. Our managed network services cover design, staged replacement and ongoing monitoring, and our managed infrastructure team keeps the servers and services behind it running. If your firewall is approaching end of support or your network has outgrown how you work, get in touch and we can help you plan the change.

Frequently asked questions

How long does a business firewall last?

The practical limit is vendor support, not the hardware. Once a model stops receiving firmware and security updates, it should be replaced, even if it still powers on and passes traffic.

Can a firewall be replaced during business hours?

It is possible but rarely wise. The swap itself causes a brief interruption, and any surprise affects everyone at once. A short evening or weekend window with a tested rollback plan is the safer approach.

Do we need two internet connections?

If your team depends on cloud applications and phones, a second connection from a different provider with automatic failover is usually worth it. It protects you from the most common cause of outages, which is the internet circuit itself.

Should we replace the switches and Wi-Fi at the same time as the firewall?

Plan them together, but stage them separately. A single design keeps everything consistent, while separate changes keep each cutover small and make it easier to find the cause of any issue.