Router and Firewall Handoff: What to Check

01 / The service boundary

What is the handoff?

It is the agreed connection point between the provider’s service and the customer’s network. It might be an Ethernet copper or optical interface, depending on the order. The provider should confirm its location, interface, service rate, and any required settings.

For a broader explanation, see understanding the Internet handoff. Ask which equipment the provider supplies, who owns each component, and where monitoring and support responsibilities begin and end. If a managed service is included, review its specific scope.

02 / Physical connection

Match the port and optics.

• Confirm the handoff location and physical port speed, as well as the ordered service rate. A port’s maximum speed and the service rate are not necessarily the same.
• For fiber, confirm compatible optics, wavelength, connector, fiber type, and who supplies each transceiver and patch cable. For copper, confirm the interface and cabling requirements.
• Agree on speed, negotiation, and any required forward error correction (FEC) or link aggregation settings for the particular interfaces. Supported options vary by equipment.
• Check link state and interface errors or discards on both sides. Note whether counters increase during testing; historical totals alone do not prove a current fault.
• Confirm any VLAN tagging and maximum transmission unit (MTU) requirements with the provider and your network team.

03 / Throughput

A fast port is only the start.

A firewall with a 10 Gbps interface may not forward every workload at 10 Gbps. Capacity depends on the model, packet sizes, connection count, enabled inspection, encryption, logging, and the traffic itself.

For test methods and limitations, see how to run and interpret a speed test. Cisco’s guidance on firewall inspection performance illustrates why the enabled features and traffic mix matter.

04 / IP & routing

Confirm how traffic will flow.

For each service, obtain the provider’s agreed addressing and routing details. Confirm IPv4 and IPv6 separately when both are in use.

• WAN interface address and prefix, peer or next-hop address, and any separately routed customer address blocks.
• Whether routing is static or uses BGP, and the agreed parameters if BGP is required.
• Any VLAN, MTU, or link aggregation requirements and how they apply to the handoff.
• Where network address translation (NAT) is used, and whether public addresses are routed to equipment behind the firewall.
• DNS resolvers or other service details the customer intends to use. DNS failure and circuit failure are different conditions.

Use the actual service design and security policy rather than assuming a default route, NAT rule, or firewall policy is appropriate for every deployment. Coordinate public IP changes, redundancy, and failover with the teams responsible.

05 / Security

Agree on who manages what.

Stealth protects and monitors its infrastructure. Customers are responsible for securing their own firewalls, network equipment, and systems unless a separate agreement assigns a specific function to another party.

Before connecting, review administrative access, security updates, policy, logging, and recovery with the team managing the equipment. Preserve management access and a tested rollback path when making changes. Never send passwords, API keys, or private configuration secrets in a support email.

06 / Platform references

Working with common firewalls.

These are starting points for common platforms, not a ranking or a configuration recipe. Verify the documentation for your model, software release, management system, and deployment mode. Menu names and capabilities can change.

07 / Acceptance

Test the service and record the result.

1. 01

   Confirm link and configuration

   Check link state, agreed interface settings, addressing, and routing. Compare counter changes before and after testing.

2. 02

   Test an agreed path

   Coordinate a suitable test with capable endpoints. Record the time, direction, destination, method, and any relevant counter changes.

3. 03

   Document the handoff

   Keep the service and circuit reference, contacts, interface, addressing, and any unresolved items in a secure location.

08 / Planning checklist

Questions before installation.

• What are the handoff location, physical interface, port speed, and ordered service rate?
• Who supplies the optics and cable, and what specifications must match?
• Are VLAN tagging, MTU, negotiation, FEC, or link aggregation required?
• What addressing and routing details apply for IPv4 and IPv6?
• Can our firewall handle the expected traffic with its intended features enabled?
• Who manages each device, security policy, and support escalation?
• How will acceptance testing be performed and documented?

For help planning a Stealth handoff, contact sales@stealth.net. For existing service, call +1 212 232 2020 or email support@stealth.net.

Reference

Terms to know

• API: Application programming interface, a way for software to communicate with a service.
• BGP: Border Gateway Protocol, used by networks to exchange routing information.
• CPU: Central processing unit, a processor that executes instructions.
• DNS: Domain Name System, which translates names to addresses and other records.
• FEC: Forward error correction, a way to detect and correct certain transmission errors.
• Gbps: Gigabits per second, a measure of data rate.
• IP, IPv4 and IPv6: Internet Protocol and its two widely used addressing versions.
• MTU: Maximum transmission unit, the largest IP packet an interface is configured to transmit without fragmentation.
• NAT: Network address translation, a method of translating addresses as traffic passes through a device.
• VLAN: Virtual local area network, a way to distinguish Ethernet traffic using a logical network identifier.
• WAN: Wide area network, a network connecting locations over a larger area.