# Solander Wright

> An independent review of firewall and network configuration, done remotely from a file you export. No credentials, no access to your network, nothing installed.

Solander Wright is the network practice of Solander Partners. The work is done remotely, which is the design rather than a limitation: a configuration can be read for a company in another country without anyone travelling, and the only thing that ever changes hands is a file the client chose to send. Every finding carries the line of the client's own configuration that proves it, so their engineer can verify the work rather than take it on trust. A practising network engineer reviews every finding before it goes out.

## Services
- **Configuration and rule review**: every rule, object and interface read in full, checked against the vendor's own hardening guidance for that platform and against what the rules in the file do to each other.
- **Documentation pack**: an estate documented from its configuration, interface by interface, rule by rule, for teams who inherited a network nobody wrote down.
- **Lifecycle and end of support**: software builds checked against the vendor's published end of support dates.
- **Rule and object consolidation**: years of accumulated duplication reduced, with the reasoning shown.
- **A change set, with the rollback**: the exact lines to apply, and the exact lines to undo them.
- **Architecture review and second opinion**: an independent read of a design before it is built.
- **New site design from a blueprint**: addressing, switching, edge and bill of materials, designed from a floor plan.
- **Cloud connectivity, peering, IPv6 planning, capacity, post incident review, migration.**

## What we need from you
An exported configuration, a drawing, a supplier's quote, or a floor plan. Masked addresses are fine. Platforms read today include Cisco ASA and Firepower Threat Defense, Fortinet FortiOS, Palo Alto PAN-OS and Cisco IOS.

## What we can prove, and what we cannot
This is stated up front rather than discovered later. From a configuration file it can be proven that a rule is unreachable, contradicted, duplicated, or wider than anything else in the file requires; that an object is defined twice under different names; that a software build is past its vendor end of support.

It cannot be proven that a rule is unused. Hit counters are not in a configuration file. Anyone claiming to know which rules carry no traffic is reading exported statistics from a management platform, which is deeper access than this practice asks for. Solander Wright will say a rule is structurally redundant, which is a different claim, and will always say which one is meant.

## Example document
A complete technical reference produced from a real production firewall pair and its management centre, published in full, including all 157 access rules and every object and port they use. The organisation it describes has been made unidentifiable: its names, its business partners, every address and every port number that is not a standard default were substituted, and the document states at its end exactly which classes were changed and which were left alone. The rules, their order and structure, the perimeter pair's model and software versions, and every count and ratio are untouched.
- [Perimeter firewall and management centre, technical reference, 55 pages (PDF)](https://wright.solanderpartners.com/example/perimeter-firewall-technical-reference-v3.pdf)

## How it works
The client sends what they have. It is read in full. A practising network engineer reviews the findings. The client receives the document: ranked findings, each citing the line it came from, with an explanation their team can act on and a short summary for the people paying for it.

## Contact
- Email: z.hajdu@solanderpartners.com
- Web: https://wright.solanderpartners.com/