The firewall project really started the morning of the ransomware incident, when one of the paths the threat actor used to move around the network turned out to be a legacy VPN appliance that nobody had been watching closely. Replacing the perimeter was already on the roadmap. After the incident it became the roadmap.

Where we were starting from

We were running a mix of Cisco ASA and Aruba gateway hardware that had served the company well for years but had aged past where modern security policy could meaningfully live. Rules were written in ports and IP addresses. There was no application awareness, no usable TLS visibility, and no real correlation between what the firewalls saw and what the rest of the security stack saw. The legacy VPN endpoint was the most acute problem, but the underlying issue was the policy model itself.

The two units already on the shelf

We had already bought two Palo Altos before the incident and were running them through an evaluation, working toward a planned cutover. That timeline collapsed the morning of the attack. Inside the recovery window those two units went into production at the corporate office and the primary datacenter, replacing the perimeter where it mattered most. Additional units were purchased shortly after to cover the remaining sites.

The rollout from there went in this order:

• Corporate office and primary datacenter first, using the two evaluation units. Highest blast radius for a bad rule, fastest payoff from TLS inspection.
• Plant sites in waves as additional hardware arrived. Each cutover landed during a shift change or a planned line stop, with rollback criteria written down before the window opened.
• Legacy VPN retired outright. Global Protect with Azure AD-backed MFA replaced it. The old appliance came out of the rack rather than running alongside.

The part that actually mattered

The piece that did the real work was not the hardware swap. It was rewriting policy. Rules moved from “this subnet can talk to that subnet on these ports” to “this group of users can reach this application.” Outbound traffic started getting inspected at Layer 7 with TLS decryption and category-based blocking, which surfaced a meaningful amount of traffic that had previously been invisible. Firewall logs started flowing into the SIEM alongside endpoint and identity telemetry instead of sitting in their own silo.

Where it landed

By the end of the program the full perimeter was modernized across corporate, datacenter, and plants. No site took an unplanned production hit during the cutovers. The specific paths the ransomware incident had exploited were closed, not patched. More importantly, the policy model was something a person could actually read and reason about, which is the part of a firewall upgrade that determines whether the next five years go quietly or not.