Firewall buyer's guide for UAE businesses: what to check before you buy.

Start with what the firewall is for

A firewall is the control point between your office network and everything else: the internet, branch offices, remote staff and, increasingly, cloud services. A next-generation firewall adds application awareness, intrusion prevention, web filtering and often VPN on top of basic traffic filtering. Before comparing models, write down what you need it to do. The answers shape every item below, and they stop a quote for the wrong box from looking like a bargain.

• How many people and sites will sit behind it, and how many connect remotely?
• Which internet links will it terminate, and is there a second line for failover?
• Which security features do you actually intend to switch on and monitor?
• Who will manage it day to day, and who is called when it fails?

Throughput: read the datasheet against real traffic

Datasheets quote several throughput figures, and they are not interchangeable. The headline number is usually measured with simple traffic and almost every inspection feature turned off. The figure that matters is the one with the security features you will really use enabled, such as intrusion prevention, application control, antivirus and inspection of encrypted traffic. That figure is normally much lower, and it is the one to compare with your internet bandwidth and your busiest periods.

Also look at the session or connection limits, the number of VPN tunnels supported and how the box behaves when several features run together. Size for the traffic you expect to have in a few years, not only today, and ask the supplier to explain how they reached their recommendation. A firewall that is too small becomes a bottleneck that staff blame on the internet provider.

Licensing and subscriptions

With most next-generation firewalls the hardware is only part of the cost. Security features such as threat signatures, web filtering, sandboxing and firmware updates are sold as subscriptions for a fixed term. When the subscription lapses, the firewall usually keeps passing traffic, but protection stops being updated and support may end. That is a quiet failure, because nothing visibly breaks.

• Ask exactly which features are included in the quoted bundle and which are extra.
• Ask what happens at the end of the term, and how renewals are priced and tracked.
• Check that the licence account is registered in your company's name, not a reseller's or an individual's.
• Put the renewal date in a shared calendar or have your IT partner track it for you.

Because features and bundles change from time to time, always confirm the current terms with the vendor or supplier before ordering.

VPN: site-to-site and remote access

If you have more than one office, the firewalls are usually what connects them. Check that the model supports the number of site-to-site tunnels you need, and that both ends are compatible, especially if the sites already have different brands. For remote staff, ask what the remote-access VPN client looks like for your laptops and phones, whether it supports multi-factor sign-in, and how users are added and removed. A VPN that only one person knows how to administer is a risk in its own right. Our guide to IT for multi-site UAE groups covers how branch connectivity fits into the wider design.

Logging and visibility

A firewall that blocks threats but tells nobody is only half useful. Look at how logs are stored and for how long, whether they can be sent to a central collector or a monitoring service, and whether alerts reach a person who will act on them. If you have compliance, insurer or customer requirements to show evidence of security controls, logs and reports are what you will be asked for. Decide in advance who reviews them. Where the business does not have a security team, a monitored service such as managed cybersecurity and MDR can sit behind the firewall and turn raw alerts into action.

High availability

High availability means a second firewall that takes over when the first fails. It is worth the extra cost when the business cannot trade without connectivity, but it needs thought. Ask whether the licences cover both units, whether failover is automatic, and how often it is tested. For smaller offices, a documented spare unit and a tested configuration backup, or a secondary internet line, may be a more proportionate answer. Whichever route you choose, write down what happens when the firewall fails and who does what.

Management and change control

Day-to-day management is where many firewalls quietly degrade. Rules are added for a project and never removed, temporary exceptions become permanent, and nobody remembers why a port is open. Ask how the firewall is administered, whether there is a central console for several sites, and how configuration backups are taken. Agree a simple change process: who may request a change, who approves it and how it is recorded. A firewall with clean, documented rules is easier to audit, easier to replace and safer to hand over.

Support and replacement

Find out what support comes with the hardware and what happens if a unit fails: how replacement works, who ships it, and whether your supplier can configure it for you. Ask whether your IT partner is trained on the platform you are buying, because a good product supported badly is still a poor outcome. Confirm who holds the administrator credentials and make sure they are recorded securely and accessible to more than one senior person.

A short buying checklist

• Throughput measured with the security features you will actually use enabled.
• Subscription contents, term, renewal process and licence ownership confirmed in writing.
• VPN capacity and client experience checked for sites and remote staff.
• Logging, alerting and report access agreed, with someone responsible for reviewing them.
• A high availability or recovery plan that matches how much downtime the business can tolerate.
• Management, change control and configuration backup defined before go-live.
• Support, replacement and handover documentation included in the offer.

If you are replacing an ageing firewall or reviewing an existing one, our firewall supply, installation and management service covers sizing, installation and ongoing renewals. A free IT health check will also show how the firewall fits with the rest of your network and security. Missan Global has supported UAE organisations since 2004 from its Al Majaz, Sharjah head office, and the networks, cabling and CCTV team can help where the firewall change touches the wider network.