Firmware Lifecycle Planning
Tracking vendor security advisories, choosing target releases against the FortiOS support calendar, upgrading in a maintenance window and always taking a configuration backup first.
Managed Security Service
Firewall Maintenance and Management Service
We run firmware planning, configuration backups, rule clean-up, HA and log checks for your firewall on a fixed schedule, with FortiGate as our focus, and can take over day-to-day operation as well.
Firewall maintenance is the set of recurring tasks that keep a firewall current, backed up, readable and auditable: firmware lifecycle planning, configuration backups, rule (policy) reviews, and HA, log and VPN checks. Firewall management goes further, adding monitoring, change requests and reporting so that day-to-day operation is handed to a contracted team.
Buying a firewall and running one are different jobs. Risk rarely comes from the appliance itself; it comes from configuration debt that builds up over time: temporary rules nobody dares to delete, broad policies with "all" as source or destination, firmware waiting for patches, a full log disk, an HA failover that has never been tested. Firewall maintenance puts that debt on a schedule and documents every check with evidence. We describe the periodic checks in our firewall maintenance guide and the rule review step by step in firewall rule clean-up and policy audit.
We offer two working models. With periodic maintenance we carry out health, backup, firmware and policy checks at the frequency set in the contract and report findings by priority; changes are applied by your team, or by us with your approval. With a managed firewall, monitoring, policy change management, patching, log review, reporting and license tracking sit with us, while approval stays with you. For organizations with their own specialists a co-managed model is also possible: routine work is ours, and console access and emergency authority are shared. We compare the models in what is a managed firewall service.
Firmware maintenance is now a remote-access decision. With FortiOS 7.6.3 (April 2025), SSL VPN tunnel mode was replaced by IPsec VPN on every FortiGate model, and existing settings are not carried over on upgrade; on entry-level models such as the 40F, 60F/61F and 90G/91G, SSL VPN web mode is no longer available either. That is why, on our schedule, no appliance that relies on SSL VPN is upgraded to 7.6.3 or later until IPsec IKEv2 or ZTNA access has been verified. The migration steps are in the FortiOS 7.6 SSL VPN migration plan.
Log and compliance checks are an integral part of maintenance. For organizations in Türkiye, the Regulation on Internet Collective Use Providers requires access records to be stored electronically for two years, with a value confirming their accuracy and integrity recorded daily. During maintenance we check that log flow has not stopped, that the time source (NTP) is correct, that the FortiAnalyzer or syslog quota covers the retention period and that time-stamping works. Please confirm your own obligations against the current legislation; see Law No. 5651 log retention and central log management and the KVKK technical measures checklist.
Sora Yazılım is an independent solution and procurement partner for Fortinet products. We deliver maintenance and management mainly for FortiGate firewalls; for other brands, the scope is agreed during the discovery call. Service hours, response and intervention times and change classes are defined in the contract. We have no fixed price list; quotes depend on the number of appliances and sites, HA design, change volume and log retention needs.
Out of scope: hardware faults follow the vendor's RMA process, and license and support contracts are handled separately under our FortiGate License Renewal Service. Moving from a legacy firewall to FortiGate is planned as a separate project (see our firewall migration plan). A full security operations center (SOC) or endpoint detection and response (EDR) service is not part of this contract.
Maintenance Scope
What firewall maintenance and management includes
The frequency and output of each item are written into the contract, and every check goes into the report together with its evidence.
Configuration Backup and Rollback
Dated backups before and after every change, stored off the appliance, and a written rollback note for every major change.
Policy Management and Rule Clean-up
Hit-count and last-used analysis; detection of shadowed, duplicate, any-any and expired temporary rules; an owner, purpose and ticket reference for every rule.
HA and Health Checks
HA sync status, planned failover tests in a maintenance window, CPU, memory, session and disk usage, interface errors and management-access restrictions.
VPN Posture: From SSL VPN to IPsec and ZTNA
Remote-access inventory, MFA and user groups; an IPsec IKEv2 or ZTNA migration plan in line with the FortiOS 7.6 change, validated with a pilot.
Monitoring, Logs and Reporting
Checks on log flow, NTP, FortiAnalyzer/syslog retention quota and Law 5651 time-stamping; periodic reports on changes, findings, firmware and license dates.
Our Approach
Turning maintenance into a routine in 5 steps
An initial audit makes the current state visible; every period after that repeats the same checklist and the same report format.
- 01
Discovery and Inventory
Appliances, FortiOS versions, license end dates, rule count, HA, VPN and log architecture are documented. Output: a baseline report.
- 02
Initial Audit and Priorities
A dated backup is taken; policy, management-access, VPN and log findings are ranked by risk, and urgent items are closed first.
- 03
Schedule and Contract
Maintenance frequency, windows, approval matrix, escalation chain, service hours and response times are put in writing.
- 04
Periodic Maintenance and Change Management
Every change passes through request, approval, implementation, verification and logging, with a backup before and after.
- 05
Reporting and Review
Periodic reports cover changes, findings, firmware and license status; a full policy review is repeated at least every six months.
Tools and Coverage
Which platforms and methods do we work with?
Platform
FortiGateFortiOSFortiManagerFortiAnalyzer
Remote access
IPsec IKEv2FortiClientFortiClient EMSZTNAFortiSASE
Logs and compliance
FortiAnalyzerSyslogLaw 5651 time-stampingKVKK technical measures
Method
Hit-count analysisChange logConfiguration backupNIST SP 800-41
Who It's For
Which organizations is this service for?
An IT team without a security specialist
Periodic maintenance and a prioritized findings report for teams that run daily IT but have no time for firmware, rule reviews and log checks.
Several FortiGates and VPN tunnels
Consistent policy across sites, central backups and a single report; appliances stuck on different releases brought onto one firmware plan.
Organizations asked for KVKK and Law 5651 evidence
Maintenance records that document log retention, access control and rule reviews with dated evidence, ready to show an auditor.
Organizations that depend on SSL VPN
A controlled move to IPsec IKEv2 or ZTNA ahead of the FortiOS 7.6 change: pilot users first, upgrade afterwards.
The person or company that set it up has left
An inventory of an undocumented rule base, re-approval of rules without a justification and a documented management process.
Solutions We Pair With This
Which solution brands do we deploy alongside?
Global vendor solutions we position within this service scope.
Authoritative Reference
NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy
NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy →Related Services
Services to combine with maintenance
FortiGate License Renewal Service
We plan your FortiGuard security bundle (ATP, UTP, Enterprise Protection) and FortiCare support contract before they expire, procure them, register them to your appliance and verify that the services are actually updating again.
DevOps and Infrastructure Management
CI/CD pipeline setup, container orchestration, observability and zero-downtime deployment processes that put your infrastructure on a modern foundation.
Frequently Asked Questions
Firewall maintenance and management: common questions
Can't find your question here? Use the form below.
What does firewall maintenance include?
Firewall maintenance covers firmware and security patch planning, configuration backups, rule (policy) review and clean-up, HA and resource checks, log flow and retention checks, and a review of VPN posture. The result of every check is delivered in a dated report.
How often should a firewall be maintained?
There is no single right interval; it is set in the contract according to change volume and risk. We recommend a full policy review at least every six months (the interval PCI DSS v4.0 requires for network security controls) and every three months in high-change environments. Critical security advisories do not wait for the next maintenance cycle.
What is the difference between periodic maintenance and a managed firewall service?
With periodic maintenance we run checks at set intervals and report the findings, while day-to-day operation stays with you. With a managed firewall service, monitoring, change requests, patching, log review and reporting move to the contracted team, and approval authority stays with your organization. A co-managed model is also possible for organizations with their own specialists.
How should firewall policy management be done?
Every rule should be created from an approved request with an owner, a purpose and, where relevant, an expiry date; take backups before and after each change and write a rollback plan. Unused rules are identified with hit-count and log data, and any-any rules are measured with logging and replaced by narrower rules. We describe the method in FortiGate policy management.
We use SSL VPN. Should we upgrade FortiOS?
Move remote access first, then upgrade. FortiOS 7.6.3 removed SSL VPN tunnel mode on all models, and the settings are not migrated during the upgrade. Fortinet's recommended primary path is IKEv2-based dial-up IPsec VPN, and ZTNA is an option for organizations that want application-level access. We upgrade only after the new access has been validated with pilot users.
Is Law 5651 log retention part of the maintenance?
Yes. We check that log flow is continuous, the time source is set correctly, the FortiAnalyzer or syslog retention quota covers two years of storage and the daily integrity time stamp is being produced. We recommend confirming which obligations apply to your organization against the current legislation.
How are response times and service hours defined?
Service hours, response times for change requests (urgent, standard, planned) and incident response times are defined in the contract. A good contract commits not only to device availability but also, separately, to change and incident response; our quote shows the frequency and output of every item.
Can you take over a firewall installed by another company?
Yes. A handover starts with a dated backup and a full rule inventory; rules without a traceable justification go to the business owners for approval before anything is removed. We maintain mainly FortiGate firewalls; for another brand we agree the scope during the discovery call and, if needed, prepare a migration plan to FortiGate.
Request Form
Let's talk about your firewall maintenance
Tell us the appliance model, the number of sites and whether you use SSL VPN. We will assess the current state and come back with a maintenance scope and quote.
24-hour response
We work Monday–Friday, 09:00–18:00 (TRT).
Your data is safe
GDPR/KVKK compliant — never shared with third parties.
Free discovery call
No commitment required; a proposal follows.
When was your firewall last reviewed?
An initial audit shows the priorities across firmware, rules, HA, logs and VPN; we then build the maintenance schedule around them.