WatchGuard Security

What we actually deploy: Firebox and WatchGuard EPDR

With WatchGuard we work on two distinct layers of business security: Firebox appliances for the network perimeter, with next-generation firewall features such as intrusion prevention, application control and geo-blocking by country, plus VPN for site-to-site and remote access, and the WatchGuard EPDR endpoint suite to protect every individual device, from employee laptops to servers. The two protections work together: the Firebox controls what enters and leaves the network, while EPDR watches the behaviour of each device and blocks anything that gets past the perimeter, so a single compromised laptop doesn't turn into a network-wide incident.

We configure Firebox appliances around the client's real network traffic, not factory defaults: access rules, application traffic categorisation and centralised alert management through WatchGuard Cloud, so threats get flagged and handled instead of piling up in a log nobody checks. On EPDR we enable behavioural monitoring that classifies every running process, blocking unrecognised executables until they've been analysed, and we tune the policies so legitimate line-of-business software isn't quarantined by mistake.

• Firebox for perimeter firewall, VPN and application traffic control
• WatchGuard EPDR for behavioural endpoint protection
• Centralised alert management across network and devices
• Rules configured around real traffic, not factory defaults

Typical SME scenarios, and when you need something else

We recommend WatchGuard to businesses that want a single vendor for licensing, hardware and direct technical support, with fast replacement if the appliance fails and clear warranty terms on the hardware itself. It's a common choice for companies that want a more guided configuration than an open-source platform, without giving up advanced features such as encrypted traffic inspection, intrusion prevention or multi-WAN failover for locations with more than one internet line.

It's not the right fit when a business needs very specific network rules a closed appliance can't fully customise: in those cases we work with pfSense, the open-source platform behind most of the firewall configurations we manage. WatchGuard also only covers the perimeter and endpoints: it doesn't replace backup, staff training or network segmentation, which remain part of the same security project and of the processes we run under our ISO 9001 and ISO 27001 certifications.

How we work: from analysis to testing

Before installing a Firebox appliance we analyse the existing network and real application traffic, to size the model correctly and define access rules, VPN tunnels and the VLANs each department actually needs. Cabling and configuration are tested in our lab in Melzo, near Milan, whenever possible, and the on-site installation happens within an agreed testing window, to confirm critical services stay reachable before we consider the project closed.

We follow the same approach with EPDR on endpoints: we roll out the agent across PCs and servers, check that behavioural monitoring doesn't flag false positives on business-critical applications, and stay available for ongoing alert management, not just the initial install. Twenty-five years of hands-on server and network support have taught us that an endpoint agent left unmonitored is only marginally better than no protection at all.

Updates, licensing and appliance end of life

Firebox appliances and EPDR licences need periodic renewal, which we plan together with the client well before the expiry date, checking that active security features stay covered without gaps. Firmware updates are applied within an agreed window, after a preliminary check in our lab, to avoid an untested update disrupting critical services during business hours.

Like any network appliance, the Firebox has a hardware lifecycle: we monitor its condition and plan replacement before vendor support runs out, rather than waiting for a failure to force the decision. For businesses that prefer not to tie up capital in hardware, we also offer operational rental, with in-warranty support included in the plan and out-of-warranty repair available afterwards if the business chooses to keep the appliance longer.