Consolidating three firewall brands at a European retail group
Northline Retail Group operates 14 distribution centres, two data centres and an e-commerce platform in AWS, and employs 1,900 permanent plus up to 2,500 seasonal staff. Its estate carries three firewall brands: two are past end-of-support and one is managed by a logistics partner that refuses console access. PCI DSS scope covers the e-commerce VPC and 60 payment-handling sites. The MPLS contract ends in nine months and will be replaced by broadband with SD-WAN at every site. Six network engineers currently hold certificates from two different vendors, and two of them have resigned. Finance has frozen headcount and demanded a 20 percent cut in security opex, while the CISO wants one policy, one console, and evidence that branch traffic is inspected rather than merely tunnelled. A four-person cloud team owns the AWS account and resists giving up change control over it.
1. Map each stated requirement to the appropriate Check Point solution area, and identify at least one requirement that should not be solved with a firewall at all. Justify each mapping.
Read the worked answer
Separate inspection requirements from architecture and commercial ones, because only the first maps cleanly onto a product.
Inspection belongs to the Quantum family. PCI-scoped enforcement at the 60 payment sites and the two data centres fits Quantum Force gateways running IPS, Application Control, URL Filtering, Anti-Bot, Anti-Virus and Threat Emulation, with SmartEvent supplying the audit trail PCI assessors ask for. Branch internet egress over broadband fits either Quantum Spark where a physical appliance is mandated, or Harmony SASE where direct-to-internet from many small sites is cheaper than appliance refresh plus backhaul to a data centre. The e-commerce VPC needs CloudGuard network security inside AWS, because that traffic never crosses your data centres and the cloud team already owns the account.
Two requirements are not firewall problems. The logistics partner's console refusal is a contract and interconnect issue: negotiate API or read-only access, or re-terminate the partner traffic on a gateway you own. The 20 percent opex target is a licensing exercise: count blade subscriptions, support renewals and management servers before promising anything.
Finally, do not sell a single rip-and-replace. With two engineers leaving, absorptive capacity, not product capability, is the binding constraint.
2. Recommend a management architecture: single SmartConsole domain, or Multi-Domain Security Management. What would make you change your answer, and where does Harmony SASE sit relative to it?
Read the worked answer
Default to a single management domain. Fifteen enforcement points, one administrator group and one regulatory regime do not justify MDS. A single Smart-1 management server plus SmartConsole gives one policy, one object database and one log view, which is exactly what the CISO asked for, and it is administrable by three remaining engineers.
I would change the answer if any of three conditions appears. First, genuine policy separation with separate administrators per domain, for example the partner-managed logistics sites or an acquired brand under different regulators. Second, delegated administration where the cloud team must see only its own objects. Third, scale beyond what one management server can handle, or a requirement for per-domain log retention. MDS then adds real overhead: domain design, global policy, per-domain upgrades, and staff who understand it. Note that CloudGuard gateways in AWS can be managed from the same console, so cloud is not by itself a reason to split domains; ownership is.
Harmony SASE sits outside that management plane by design. It enforces web, SaaS and private-access policy for roaming users and small branches from the cloud, so it is not a gateway object in SmartConsole. Accept two policy surfaces, and define which traffic goes where.
3. Propose a phased migration sequence and name the top three risks, explaining how the sequence mitigates each.
Read the worked answer
Sequence: (1) stand up management and import existing objects, building the policy for the data centres in parallel; (2) migrate the two data centres first, where skills and rollback paths are strongest; (3) migrate stores in waves aligned to the broadband/SD-WAN rollout, never in the same maintenance window as a connectivity cut; (4) migrate the AWS VPC jointly with the cloud team, using their change process; (5) handle partner-managed sites last, once the contract position is settled.
Risks and mitigations. Skill loss: two leavers mean the design must be documented and at least two people trained before data-centre cutover, otherwise the project stalls the moment the first engineer departs. Cutover collision: coupling firewall replacement to an MPLS-to-broadband migration in one window makes fault isolation impossible; separating them keeps one variable at a time. Ownership conflict in AWS: migrating the VPC without the cloud team's sign-off produces either a stalled project or a policy the team quietly bypasses; give them delegated visibility and joint change control rather than absorbing their account.
Deliberately deferring Harmony SASE until after the store waves also avoids running three change programmes simultaneously with reduced staff.