Segmentation
VLANs so that a compromised camera or learner laptop cannot reach finance systems or servers, with the firewall enforcing the rules between them.
Firewalls, web app firewalls and network security, managed to an SLA
Arke Technologies designs, installs and manages firewalls for South African organisations, public bodies and schools: the right firewall at every site, a web app firewall in front of your websites and portals, and the monitoring, change control and POPIA evidence that keep network security accountable, from Johannesburg.
What is a firewall, and what does a firewall do?
A firewall is a device or software that inspects network traffic and allows or blocks it according to rules you set. That is the computer definition in one line. The name comes from buildings and vehicles: a firewall is the fire-resistant barrier between two spaces or, in a car, between the engine and the cabin. A network firewall does the same job for data, separating the internet from your network, and one part of your network from another.
The purpose of a firewall is to enforce your policy at the boundary. Its functions in a modern organisation:
- Filter traffic in and out by address, port, application and user.
- Separate zones such as staff, guests, learners, cameras, finance and servers.
- Connect sites and people through site-to-site and remote-access VPNs.
- Inspect for threats with intrusion prevention, web filtering and malware scanning.
- Record who connected to what, and when, for investigations and audits.
A firewall is a type of network security control, not the whole of it. IT network security is the set of controls that protect a network and the data crossing it; it sits inside cyber security, which also covers identities, devices, applications and people. For a longer primer, read what is a firewall; firewalls sit within our network infrastructure services and wider cybersecurity services.
Web app firewall (WAF): protecting websites, portals and APIs
A web application firewall (WAF) protects a website, customer portal or API by inspecting each web request before it reaches the application. A network firewall sees web traffic and lets it through; a web app firewall reads the request itself and blocks attacks such as SQL injection, cross-site scripting, credential stuffing and abusive bots, the kinds of risk the OWASP Top 10 describes.
We deploy a WAF in one of three ways:
- Cloud WAF, such as the AWS web application firewall (AWS WAF), Azure Web Application Firewall or Google Cloud Armor, in front of applications hosted in those clouds.
- Appliance or virtual WAF, in front of applications on your own servers or in colocation.
- Server-level WAF, using the OWASP Core Rule Set on Apache or Nginx, for smaller sites we host and manage.
A WAF starts in detection mode and is tuned before it blocks, so legitimate users are not locked out. It also buys time: when a vulnerability is published, a WAF rule can shield the application until the code is patched. Pair it with penetration testing and sound web application development, because a WAF reduces risk but does not fix insecure code.
Firewall platforms we configure
We configure firewalls from Fortinet, Sophos, Cisco, MikroTik, Ubiquiti UniFi and TP-Link Omada. This is hands-on experience, not a vendor partner status, and we recommend a platform on your requirements rather than on a sales relationship.
- Fortinet. What is Fortinet? A network security manufacturer whose FortiGate firewalls run the FortiOS operating system. A Fortinet FortiGate combines NGFW, VPN and SD-WAN in one appliance and suits multi-site, security-led networks.
- Sophos. Sophos Firewall is managed from Sophos Central, the same cloud console as Sophos Intercept X, the company's endpoint protection (often searched as Sophos antivirus). Sophos Connect is its remote-access VPN client, and Sophos Home is the consumer edition, not the business product.
- Cisco. Cisco firewalls and routers are common in larger estates, and we take over, audit and manage existing Cisco firewall deployments.
- MikroTik, Ubiquiti UniFi and TP-Link Omada. Capable gateways for smaller sites and branches where budgets are tight and the rule base is simple.
Fortinet and Sophos each run a partner portal for resellers and a support portal for customers. Whoever supplies your firewall, make sure the device, licences and support contract are registered in your organisation's name, so Fortinet support and firmware access survive a change of provider. Appliances are supplied through Server Hub, our hardware division.
Network security beyond the firewall
A firewall is one tool in the network security toolkit, and the others decide whether it works. The net effect is layered defence: an attacker who gets past one control meets the next.
Network access control
Only known, compliant devices join the network, using 802.1X on switches and Wi-Fi.
Firewall authentication
Rules tied to people, not just addresses: users sign in against Active Directory or Entra ID, VPN access requires multi-factor authentication, and guests pass through a captive portal.
Wi-Fi credentials
One shared network security key should not protect a business network; staff Wi-Fi should use WPA2 or WPA3-Enterprise with individual sign-ins. See business Wi-Fi.
Host firewalls and endpoints
Windows Firewall on every computer, managed centrally, plus ransomware and endpoint protection. On company phones, firewall apps that run without root access are no substitute for device management.
The human firewall
Staff who spot phishing stop attacks no appliance sees; see security awareness training.
Network security monitoring
Firewall logs and alerts are collected and reviewed, and can feed Microsoft Sentinel through managed detection and response and network monitoring.
Governance, compliance and procurement
- Governance and change control. Every rule change is ticketed with a requester, an approver and a reason, and the rule base is reviewed at an agreed cadence to remove what is no longer needed. Escalation paths and reporting cadence are written into the SLA.
- Compliance. POPIA section 19 requires reasonable technical measures to protect personal information, and a managed, logged firewall is part of that evidence. King IV Principle 12 places technology and information governance with the board, and PFMA and MFMA audits expect controls and records in departments and municipalities. We work to CIS Controls, the NIST Cybersecurity Framework and ISO/IEC 27001-aligned practice; see POPIA compliance.
- Procurement. A Level 1 B-BBEE contributor (sworn affidavit available on request), giving buyers 135% procurement recognition. Company documents, our CSD supplier number and tax compliance status are available on request, and we complete standard bidding documents when a tender requires them.
- Continuity and exit. Administrator credentials, configuration backups, rule documentation and licences are yours. If you change provider, the handover is complete and documented.
Firewall cost: hardware, subscription and management
Last reviewed: September 2026
A firewall's cost has three parts, and the appliance is often the smallest. For a next generation firewall, the security subscription that feeds its threat intelligence typically costs as much as, or more than, the hardware over three years (Server Hub, September 2026). Server Hub's guide to firewall cost for a small business (opens serverhub.co.za) carries current rand prices. What drives the total:
- Throughput with inspection enabled, sized to your fibre line and user count.
- Sites and redundancy: one appliance or a high-availability pair per site.
- Subscription term: one, three or five years, with the renewal budgeted from day one.
- Web app firewall licensing: per application, or by request volume for cloud WAFs.
- Management: firewall management can sit inside a managed IT agreement priced per user per month, or be quoted separately after an assessment. Published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026).
When you compare providers, ask for throughput with every security feature on, the renewal cost in years two and four, who reads the logs, and which engineers hold current certifications for your platform; Fortinet training and certifications, for example, are examined through Pearson VUE test centres. We hire technicians for experience, education and certifications. Treat a vendor logo on a proposal as a starting point, not evidence.