The client

The client, based in US, is the world's leading provider of business information, enabling business-to-business commerce for more than 160 years. The company's information and technology solutions help businesses reduce credit risk, find profitable clients and manage vendors efficiently. The client has the largest company database with 70 million companies worldwide - for helping their clients to make credit, marketing and purchasing decisions.

The client has a centralized data center in New Jersey, USA, hosting all the e-commerce applications, mainframes and the centralized network infrastructure. They were in the process of consolidating some of their old firewalls and proxy servers by incorporating the old rules to new firewalls and getting rid of the old infrastructure. Also, they were in the process of defining policy-based ruleset on their firewalls.

The challenge

The major challenge was to create policy-based rule set on the firewalls and consolidate the firewall rule base. Restructuring part of the network was also important after the company had created an independent business unit out of an existing smaller group. It was necessary to implement a pair of new Nokia IP440 firewalls as a part of the new company.

The solution

For offshore access, we created a service group and included all the services under that. Similarly, we created a group for source networks and destination hosts. All the offshore rules were thus consolidated to one rule. This cut down the number of rules for offshore access from about fifteen to one.

For communication between internal networks, we created group objects instead of individual host objects and cut down on number of rules. Thirdly, we checked unused objects and deleted all the unused rules and objects from the firewall rule base to make the rule base clean and up-to-date.

Moreover, two new Nokia IP440 firewalls were installed in High Availability fashion using Nokia VRRP configured in monitored circuit option. Checkpoint FW-1 was loaded on these firewalls in distributed fashion. This firewall was intended for the new company that had been created. The rule set from the current firewalls was migrated to the new firewall and functionality testing was carried out to ensure that everything works after the migration.

Finally, these two firewalls were put into production and we ensured that the migration was successfully completed well within the maintenance window.

The benefits