One firewall policy for every office — and a change that cannot strand a branch

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

FireWarden runs the same policy on every BranchEdge appliance: rules by application and person, threat intelligence both ways, IPS, HTTPS inspection and antivirus on downloads, with every change versioned and rolled back automatically if an appliance loses the cloud.

2The challenge

Branch firewalls are bought one by one, configured one by one and forgotten: rules nobody remembers adding, a different policy at every site, threat intelligence that never reaches them, and a change made at night that cuts the office off until someone drives there.

The TotalHeal approach. FireWarden runs on TotalHeal BranchEdge appliances — any Linux box with two or more ports, set up with one installer command — and every appliance runs the same policy from the TotalHeal console. Each change is compiled for each appliance, versioned, and applied in one transaction; an appliance that cannot reach the cloud after a change goes back to the last good policy on its own after five minutes.

3Architecture

4How it works

1. InstallTurn any Linux box with two ports into a BranchEdge appliance with one installer command.
2. PlaceGive it a site and its ports — or register its serial number and let it set itself up.
3. WriteWrite one policy: rules, applications, groups, IPS, inspection.
4. ApplyEach appliance gets its compiled version within 30 seconds, applied in one transaction.
5. WatchHit counts, blocks and IPS and malware alerts arrive in the console.

5Capabilities in detail

• Rules by what and whoOrdered rules by zone (WAN, LAN, guest, the other offices), address and service objects, applications — 31 built in, from Microsoft 365 and Zoom to BitTorrent and Tor, recognised by the names they resolve, their address ranges and ports — and people’s groups, from who signed in through NetworkGate and SurfGuard groups.
• Threat intelligence both waysEvery active IP indicator from your TotalHeal threat intelligence is blocked in and out on every appliance; add your own addresses with a reason. SYN-flood and connection limits per address stop simple floods.
• Know what each rule doesEach rule has its own hit counter on every appliance, summed in the console; rules at least 30 days old that matched nothing for 30 days are listed as unused.
• IPSOn the Professional tier, Suricata inspects the traffic of rules you mark — detecting and alerting, or blocking — with TotalHeal rules (EICAR, Log4Shell, path traversal, PowerShell download cradles, SSH brute force …) and your own Suricata rules. Alerts arrive in TotalHeal with the source, target and signature.
• HTTPS inspectionOn the Professional tier, allow rules marked Decrypt send web traffic through an inspection proxy on the appliance that presents certificates from your organisation’s TotalHeal root and checks each site’s real certificate. Online banking and the categories and domains you exempt pass through untouched.
• Antivirus in transitOn the Elite tier, files people download — programs, archives, documents — are checked with ClamAV on the appliance before they are delivered; malware is replaced by a page naming it and raises a high alert.
• Cloud firewall for branchesA branch can send its internet through the tunnel to a hub appliance — in the TotalHeal cloud or your data centre — where FireWarden decides and takes it out, so small offices need only a basic box.
• Safe changesOn the Professional tier a policy change can wait for a second administrator; every version is kept, an appliance can be pinned to an older one, and an unconfirmed change can be rolled back from the console.

6Security and data handling

• All or nothingA policy is applied in one transaction: the old one stays in force until the new one is complete.
• Never strandedAn appliance that cannot reach the cloud within five minutes of a change goes back to the last good policy by itself.
• Exempt is exemptSites and categories exempt from inspection are passed through untouched.
• Keys stay out of historyYour inspection root travels to the appliance on its own and is never stored with the policy versions.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A BranchEdge appliance at each site (installer: --branchedge, with --with-ips and --with-av for the IPS and antivirus)
• The TotalHeal root trusted on devices for HTTPS inspection

Start a 30 days, up to 2 appliances trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.