Firewall AMC · 25,000+ firewalls deployed
A firewall AMC is usually bought as insurance against hardware failure, which is the least likely thing to go wrong with a modern appliance. What actually degrades is everything around it: firmware drifts years behind, the HA pair has never failed over under load, the config backup is from two rule changes ago, and nobody has read a log since the install.
FortiGate · Cisco ASA and Firepower · Sophos · SonicWall · Palo Alto · Check Point
Cover levels
What you are really buying
Coverage arithmetic, not marketing arithmetic.
An in-house engineer on standard hours delivers roughly two thousand productive hours a year once leave, public holidays, training and sickness are taken out. The firewall is exposed for all eight thousand seven hundred and sixty. An AMC is one way to buy some of the difference; it is worth being precise about how much of it you are actually buying.
| Cover | What it includes | What it does not |
|---|---|---|
| Break-fix AMC | RMA coordination, replacement configuration restore, firmware on request, config backup. | Nobody is watching between failures |
| Proactive AMC | The above plus scheduled firmware review, tested failover, periodic rule-base review and a named escalation path. | Not continuous monitoring — still a scheduled service |
| Managed firewall | Policy owned and operated on your behalf, monitored, with change management and response. | A different commercial model — see firewall services |
Scroll the table sideways on a narrow screen.
If a quote does not say which of these three it is, it is the first one.
The work
What we check on a maintained estate
Firmware currency
Reviewed on a schedule against known issues, and upgraded in windows with a rollback position — not left three major versions behind because the upgrade is frightening.
Failover, actually tested
An HA pair that has never failed over is a hypothesis. We test it, in a window, and report what happened.
Configuration backup
Automated, off-box, versioned, and restore-tested. A backup nobody has restored is a file, not a backup.
Rule-base drift
Periodic review so the decay described in our firewall audit work does not simply resume.
Entitlement watch
Support and subscription expiry tracked ahead of the date, not discovered after it. See licence renewal.
A named escalation path
A person and a number, agreed in advance, that does not route through a queue at 02:00.
Before you sign
How to read an AMC quote
AMC quotes are unusually hard to compare because the expensive differences are the ones left unstated. Four questions separate a contract that will help you from one that will merely exist.
What is the response time, and to what?
A four-hour response to an email acknowledgement is not a four-hour response to a failed firewall. Ask what the clock measures, when it starts, and what stops it. A commitment that stops at “we have opened a ticket” is not a commitment to fix anything.
Who holds the vendor entitlement?
Hardware replacement speed is set by the support contract registered against the serial number, not by your AMC provider. If the provider is coordinating an RMA on an entitlement that expired last year, the AMC cannot deliver what it promises. Check the serial before you sign, not after.
Is firmware included, or chargeable?
Firmware upgrades are the single most deferred maintenance task in the industry, precisely because they carry risk and require a window. An AMC that treats each upgrade as chargeable additional work will produce an estate that never gets upgraded.
How many changes are included, and what counts as one?
Most AMCs include a change allowance. Few define whether “a change” means one rule, one ticket or one window. The definition is where the disagreement happens in month seven, so it is worth having in writing in month one.
Honest limits
What an AMC will not do for you
We would rather set this out plainly than have it discovered later. An AMC is a maintenance contract, and there are real limits to what maintenance can achieve on its own.
| It will not | Because | What does address it |
|---|---|---|
| Watch your traffic | Maintenance is scheduled work. Nobody is looking at the console between visits. | SOC as a Service or NOC services |
| Fix a bad rule base | Keeping a firewall healthy is not the same as keeping its policy correct. A well-maintained box can enforce a badly wrong policy indefinitely. | Firewall audit |
| Extend end-of-life hardware | Once a platform passes end-of-support, no maintenance contract can obtain firmware or replacement parts that the vendor no longer produces. | Refresh, or rental while you plan one |
| Recover an expired subscription | Support entitlement and security subscriptions are separate purchases with separate dates. | Licence renewal |
Scroll the table sideways on a narrow screen.
If a proposal claims to do all four, read the definitions section rather than the summary page.
Questions
Firewall AMC, answered
What does a firewall AMC cover?
At minimum: firmware currency, configuration backup, hardware replacement coordination with the vendor, change support within an agreed window, and a named escalation path. What separates a useful AMC from a paper one is whether it also covers proactive work — failover testing, rule review, and someone actually reading the logs.
Is an AMC the same as a managed firewall service?
No, and the distinction matters commercially. An AMC keeps the box healthy and available. A managed service runs the policy on your behalf, monitors it and responds. Many estates need the first and think they are buying the second. See firewall services for the managed option.
How is AMC different from renting a firewall?
Ownership. Under an AMC you own the hardware and buy support for it. Under firewall on rent we own it and you pay for the outcome. The right answer depends on your balance sheet and how long you expect to need the box, not on the technology.
Do you support firewalls you did not supply?
Yes. A good proportion of the estates we maintain were bought elsewhere. We will ask for a configuration review before taking on support, because committing to an SLA on a rule base nobody has read is not a commitment worth much to either of us.
What happens when hardware fails?
We coordinate the vendor RMA and carry out the replacement and configuration restore. The speed of the physical replacement is set by the entitlement you hold with the vendor, not by us — which is exactly why the support tier you buy at purchase time matters more than most buyers realise.
Which platforms do you hold AMCs on?
FortiGate, Cisco ASA and Firepower, Sophos, SonicWall, Palo Alto and Check Point. We are a Fortinet partner with NSE-certified engineers, so FortiGate estates get the deepest bench.
Next step
Tell us what you own and we will tell you what it needs
Send the model, the firmware version and the current support expiry. That is enough for us to say what an AMC should cover and where your real exposure is.