Prague Airport: Core Firewall Renewal

The airport operates a complex communications environment connected to control authorities, commercial partners, public administration and the internet. Its perimeter firewalls were reaching the end of their lifecycle and no longer met functional and capacity requirements.

A preliminary market consultation in 2020 was followed by a public tender in 2021, which selected ComSource’s Juniper-based solution.

• Replace the ageing platform, targeting approximately six-to-ten times the performance.
• Enable next-generation firewall capabilities.
• Increase port capacity to 4 × 40GE and 8 × 10GE.
• Clean up and migrate approximately 3,500 internal and 1,000 external rules, with 8,500 objects.
• Ensure spare parts availability and service and operational support.

ComSource supplied two firewall clusters, prepared configurations and the migration process, and put the platforms into operation. The scope included security policy migration and support with recovery commitments under the agreed SLA.

Main steps in 2021

• June–July: migration design, segmentation firewall deployment, cluster connection and configuration.
• August–September: software updates, integration with Junos Space Security Director, installation of Security Director Insight and rule preparation.
• October–November: phased migration of both parts of the cluster.
• December: preparation of Juniper QFX5120 switches and migration of DMZ switches.

Preparation identified differences between documentation and actual communications flows, which the team addressed during the project. Migration took place in repeated overnight windows. Agreed infrastructure services were tested after migration, and confirmation of their functionality formed part of acceptance.