Managed Firewall: a service, not a box

A managed firewall is a firewall delivered as a service: the service is delivered as a monthly subscription, and configuration, monitoring, configuration backup and support are handled continuously by someone else under a service agreement. That is how ONYX offers it: a service, not a box.

A firewall alone is not security

A firewall is at its best on the day it is installed. After that rules change, temporary permissions are never removed, firmware ages and nobody reads the logs. A year later the device is still there, but the protection no longer matches the original design.

The idea behind a managed service is simple: a firewall needs a permanent owner.

What goes wrong over time

This is a common picture in many companies. When nobody owns the device, it drifts:

• Temporary permissions stay open after the project ends.
• The rule list grows and nobody remembers why each line exists.
• VPN access for former employees or old partners remains.
• Firmware goes months, sometimes years, without an update.
• Alerts exist, but nobody reads them.

A managed model assigns an owner to every item on that list. The difference lies in discipline, not in the brand of the device.

The ONYX managed firewall offer

The customer gets a firewall, typically FortiGate or MikroTik, and pays a monthly subscription. The subscription covers:

• Configuration: setting the device up to fit your network.
• Monitoring: monitoring of the device's status.
• Configuration backup: so a failed device can be restored.
• Support: under a service agreement.

For context, see enterprise network security and firewalls and Fortinet vs Palo Alto.

What a managed firewall generally includes

Across the market, a good managed service usually covers these stages:

1. Initial design: zones, segments, inbound and outbound logic.
2. Rule and policy management: adding new rules, cleaning out old ones.
3. Firmware updates: kept current on schedule.
4. Configuration backup: after every change.
5. Log review and alerts: reacting to suspicious events.
6. Change requests: a branch opens, a new service goes live, a rule has to change.

When the model makes sense

Three typical situations:

• No in-house network engineer. The answer to "who watches the firewall" is "nobody".
• Several branches. Keeping one standard at every site is repetitive work.
• Compliance pressure. An auditor or partner asks for evidence of network control.

How to evaluate a provider

Ask four questions before you sign:

1. Who owns changes? Who edits a rule and who approves it?
2. How fast are changes handled? Is the time from request to implementation in writing?
3. What is monitored? Only whether the device is up, or events too?
4. What is the exit? If you leave, do you get the device and the configuration back?

The last question is the one most often forgotten, and it shows how locked in you really are.

A short note on ONYX Firewall

ONYX also develops its own firewall platform, ONYX Firewall, and runs it in its own network; it has been in ONYX's own production since 24 September 2026. It is a Debian-based appliance with a cloud management portal and signed over-the-air updates with rollback. The box connects out to the cloud, so management is box-initiated. It supports web filtering, VPN, IPS, multi-WAN, VLAN and a captive portal. More at ONYX Firewall.

How to set the service up from day one

For a good start, agree on two things in advance: which network segments and branches are covered, and how a change request is sent and who approves it. A third question belongs with any provider: which response times are written into the service agreement? When these are clear the service becomes routine; when they are not, you are back to the question of who is responsible.

What to do next

Start by checking when your current firewall was last updated and who looks at its rules. If the answer is "we are not sure", a model with a permanent owner may fit. For device choices see security equipment, and for the wider picture see infrastructure services.

Frequently asked questions

What is a managed firewall?

A managed firewall is a firewall delivered as a service. The service is delivered as a monthly subscription, and someone else continuously handles configuration, monitoring, configuration backup and support under a service agreement.

When does a managed firewall make sense?

When there is no in-house network engineer, when there are several branches, or when compliance pressure is growing. In those cases a permanent owner who watches rules and updates makes the real difference.

Which devices does the ONYX managed firewall service use?

Typically FortiGate or MikroTik. The service comes with a monthly subscription and covers configuration, monitoring, configuration backup and support.

What should I check when choosing a provider?

Ask who owns changes, how fast change requests are answered, what is actually monitored, and how the device and configuration are handed back to you if you leave.