Short answer
FirstNet manages the firewall itself: setup, policy, firmware and signature updates, monitoring, approved changes and incident response. You stay responsible for your internal LAN, endpoints, cabling, ISP handoffs and apps, and for giving accurate inputs.
In detail: Managed firewall responsibilities and ownership
The split applies to every FirstNet managed firewall, Fortinet or Sophos, at your site or hosted on FirstNet's platform, with 8x5 or 24x7 support through Rapid Response. Agreeing it at the start avoids gaps after go-live.
What FirstNet manages, within the contracted scope:
- The firewall platform, its setup and the applying of policy
- Firmware and signature updates, with a quarterly firmware programme on Fortinet estates run through FortiManager
- Monitoring, tuning and regular posture reviews
- Approved changes, with testing and rollback plans
- Incident response
- For hosted firewalls, the hosting platform as well
- Monthly summaries, change records and improvement actions
What remains your responsibility:
- Approving scope, design inputs and changes through your authorised technical contacts
- Supplying correct rules, NAT and routing needs, VPN peer details, certificates, addressing and ISP details
- Owning those items, plus your internal LAN, endpoints, cabling, ISP handoffs, local switching and applications, unless agreed separately
- Your overall compliance position and governance
Changes follow a controlled process. Only your authorised technical contacts can request and approve them. Standard moves, adds and changes within the agreed policy framework are part of the managed service. Emergency, after-hours and major design changes, such as new VPNs, SD-WAN topology changes or large policy refactors, need explicit approval and may be scoped separately.
Some work sits outside the standard service. Onsite hands-and-feet support is not included, and full network redesigns, security audits and penetration tests are scoped as separate work. With Sophos, incident response on your endpoints is out of scope unless you contract Sophos MDR, which can be added to a Sophos firewall on the same monthly bill for 24/7 detection.
Visibility is not the same as shared administration. Read-only access is available on request through Sophos Central or a read-only FortiManager ADOM profile, so your team and auditors can see configuration and logs. Write access to production is an exception that needs explicit approval, because it changes the managed-service operating model. If your team needs hands-on administration, raise it during contracting.
FirstNet gathers the inputs it needs during discovery:
- Users, devices, sites and expected growth over 12 to 36 months
- Peak inspected throughput and how much traffic needs SSL inspection
- ISP handoff, circuit, public IP and failover details
- Subnets, VLANs, routing, NAT and VPN peers
- Firewall policy needs, authorised contacts, approvers and maintenance windows
Getting these right up front is what lets FirstNet run the firewall cleanly from day one.
Source: FirstNet Hosted Firewall & Network Security service page →