Firewall Change & Cutover Checklist
Questions to answer before a firewall replacement, major policy change or WAN cutover.
Capture the current state
Back up the configuration and record interfaces, WAN details, routes, NAT, VPNs, published services and dependencies.
Identify what can break
List site-to-site VPNs, remote users, voice, cloud tunnels, vendor access, public services and systems that depend on specific addresses.
Prepare the target configuration
Validate licensing, firmware, interfaces, objects, rules, certificates and management access before the maintenance window.
Define rollback
Know exactly when to stop troubleshooting and return to the previous device or configuration.
Build a validation list
Test internet, DNS, VPNs, business applications, voice, remote access and critical inbound services after cutover.
Document the result
Record the final configuration, changed addresses, rule decisions, backups and any follow-up items discovered during the cutover.
Use the guide as a conversation starter
A short checklist can expose unclear assumptions early, before they become change-window or incident problems.
Need help applying this to your environment?
If you want a second set of eyes, we can review the environment and turn the questions into specific next steps.