Network & Security
Network security, firewalls, and cloud connectivity.
We design, review, and migrate the firewalls, segmentation, SD-WAN, and cloud transit that connect your sites and clouds, on Fortinet, Palo Alto Networks, Check Point, and Cisco, and on AWS, Microsoft Azure, and Google Cloud. Every change gets a purpose, a validation plan, and an operational owner, and every design is checked against tested traffic flows rather than diagrams alone.
Platforms
- Google Cloud
Who this is for
Network and security leads who are connecting cloud and on-premises environments, consolidating firewall policy across vendors, designing transit and inspection on AWS, Microsoft Azure, or Google Cloud, or planning a network modernization. It also suits teams that inherited a mixed-vendor estate and cannot say with confidence why each rule exists.
Complex infrastructure needs a coherent security model
Over the years, networks accumulate firewall rules nobody can explain, segmentation that exists on diagrams more than in policy, VPNs created for a project that ended, and cloud environments attached with routes that grew by exception. Each change was reasonable when it was made. Together they produce an architecture that cannot be reasoned about, and every new change carries unknown risk.
We connect cloud routing, firewalls, inspection, and segmentation into a design with traceable traffic flows and clear ownership.
What you get
01
A current-state map. Network and trust boundaries traced from real traffic flows, not from diagrams alone.
02
A firewall and policy review across Fortinet, Palo Alto Networks, Cisco, and Check Point platforms: rule usage from hit counters and logs, any-to-any rules, shadowed rules, NAT, and VPN, with an owner and a justification for each rule that stays.
03
Cloud transit and inspection design. On AWS: Transit Gateway route segmentation and centralized inspection, with AWS Network Firewall or with Gateway Load Balancer and third-party firewalls. On Azure: hub-and-spoke or Virtual WAN, and where the firewall sits. On Google Cloud: VPC and hybrid connectivity design. Connectivity between clouds where the estate spans more than one.
04
SD-WAN and VPN design: site-to-site and remote-access VPN, SD-WAN segmentation, and failover behavior.
05
Change procedures: methods of procedure, change windows, monitoring requirements, and handover documentation.
How it works
Architecture
Collect configuration, logs, and routing tables; trace representative flows end to end; identify trust boundaries and the owner of each system. Decide what the target architecture must provide and how that will be tested.
Onboarding
Build the target design: routing, inspection points, segmentation, and failover. Agree acceptance criteria per flow before anything is configured, prepare the target environment, and compare behavior before switching.
Migration
Move traffic in agreed stages with explicit rollback conditions. For a firewall migration: export and review every rule, NAT entry, and VPN; remove what no traffic uses; map features rather than syntax; convert with the vendor’s tool; test real flows before and after the cutover; and keep a parallel run where possible.
Support
Watch the first days closely, remove temporary rules, recertify what remains with its owners, and update the runbooks.
Limits
Conversion tools help, but they do not decide policy, and their support status changes: Palo Alto Networks, for example, ended support for its Expedition migration tool. Each tool’s status is checked in the vendor’s documentation at the time of the project. Cost, throughput, and latency depend on your traffic and are measured, not assumed. Where a requirement comes from a regulation or an audit, technical controls are mapped to it and the legal interpretation stays with your counsel.
Questions
What should a firewall review check first?
Rule usage from the platform’s hit counters and logs, any-to-any rules, shadowed rules, and whether each rule has an owner and a justification. Remove what no traffic uses before converting anything. Migrations succeed or fail on the audit and the validation, not on the conversion tool, and a review is useful even if no migration follows.
How do you inspect traffic centrally on AWS?
Route inter-VPC, internet, and on-premises traffic through one inspection point on the transit gateway, with appliance mode so both directions of a flow reach the same firewall. AWS documents three designs: an inspection VPC with AWS Network Firewall, Network Firewall attached directly to the transit gateway, or Gateway Load Balancer with third-party firewalls such as Palo Alto Networks VM-Series.
Can you work across several firewall vendors?
Yes: Fortinet, Palo Alto Networks, Cisco, and Check Point. The review maps features, not syntax, because platforms differ in how they order NAT and security policy and in their implicit rules. The goal is that policy intent survives a change of platform, with tested traffic flows as the proof, not a conversion report.
How do you handle a firewall cutover?
With rollback conditions agreed in advance, flow tests before and after, and a parallel run where possible. The cutover checklist covers pre-cutover checks, the change itself, verification, and rollback. The source firewall stays configured until the verification period ends, and temporary rules are removed once the new platform has proved itself.
How do you connect AWS and Azure?
Usually with a Site-to-Site VPN between an AWS transit gateway and an Azure VPN gateway, using BGP, or with dedicated circuits where bandwidth or the internet path rules a VPN out. Autonomous system numbers and address ranges are planned on both sides before anything is built, because some values cannot be changed later.
Do you also cover Google Cloud?
Yes. The same method applies: trace the flows, design routing and inspection around them, and test before cutover. Google Cloud networking is designed alongside AWS and Azure where an estate spans more than one cloud, with the vendor’s current documentation checked for limits and behavior during design, not assumed from another platform.