What's a practical production-readiness checklist for a new firewall deployment?

A practical, step-by-step checklist to run through before putting any new firewall into production.

The checklist:

☐ Firmware up to date (also app-ID, IPS signatures, threat feeds)
☐ Default config loaded as starting point — not "carry over from previous test"
☐ Management interface on a separate, restricted network
☐ Strong admin password (a default like "Hslu1234" is for practice only!)
☐ Zones defined with clear trust-level rationale
☐ Layer 3 mode (unless V-Wire is specifically needed)
☐ Address objects for every recurring IP/subnet
☐ Interfaces assigned to correct zones
☐ Outbound SNAT for all internal subnets that need Internet
☐ Whitelisting rules: explicit allows + final deny
☐ Most-specific-first rule ordering (no shadow rules)
☐ DHCP server with appropriate lease times and full options
☐ DNS proxy with static entries for internal names
☐ DNAT for any externally-reachable internal services
☐ DNAT placed ABOVE SNAT in NAT policy
☐ Logging enabled (especially on deny rules — see what's blocked)
☐ Backup of configuration BEFORE any changes
☐ Commit + verify after each change ("immer zuerst commiten bevor Sie Änderungen testen")
☐ Document which IP serves which role (maintain an IP/address inventory)

The "production-readiness gap" — what a basics walkthrough doesn't cover:

The mental model takeaway:

A firewall isn't a fire-and-forget appliance. It's a continuously maintained system with:

Tip: This is your introduction to firewall configuration. The advanced follow-up (Firewall Advanced) covers application-layer features — App-ID, URL filtering, file blocking, IPS — which is where the "Next-Generation" in NGFW actually lives. Basics are "make it work"; advanced is "make it smart."

Go deeper:

• Defense in depth (computing) (Wikipedia) — why a firewall is one layer in a maintained, multi-control posture (segmentation, logging/SIEM, HA, patching, least privilege) rather than a fire-and-forget appliance.