The platform being replaced had no software support at all and no current documentation. Before a migration could even be planned against it, the city had already paid an outside contractor some eighty-five hours simply to reverse-engineer the running configurations — which is what an undocumented perimeter costs before anyone touches it.
Out went Nokia appliances running Check Point software. In went Cisco Firewall Services Module blades in the Catalyst 6509 core, with ASA appliances alongside and multiple-context licensing so one pair of blades carried separate policy per zone.
This was held as a stated performance objective in 2007 — design, plan and implement — and run from the written justification that carried it through Administrative Awards to the floor-by-floor cutover. By September 2007 all internet traffic crossed the new modules and five demilitarized zones were live, the zone architecture riding on them designed inside the group by its network security engineer. The residual appliances were retired against a follow-on plan called in February 2008.
Who wrote the design
Four vendors quoted a bill of materials that had already been settled internally. No manufacturer or reseller produced an assessment, a design or a proposed architecture at any point in it.
That is worth stating because the opposite is the norm, and the norm has a cost: an architecture written by whoever is selling the hardware is an architecture shaped by what they sell. The quoting was procurement. The design was not for sale.
The platform that succeeded this one was chosen three years later on an instrument written for the purpose — see the Juniper enterprise security suite.
Outcome
A supported, documented perimeter with per-zone policy on one pair of blades, and a follow-on plan that actually retired the residual appliances rather than leaving them powered on.