SonicWall GMS just showed the problem: a console that manages your firewalls reaches end of life, new bugs show up, and there’s no patch. Here’s how I’d go about finding those boxes and boxing them in.
1. Build the list
- List every management plane you have: firewall managers, switch and wireless controllers, hypervisor managers, backup consoles, out-of-band cards
- Write down the version and the vendor’s end-of-support date for each. Check the vendor’s lifecycle page, not your memory
- Scan your management subnets for web admin ports you didn’t know about
2. Fence it off
- Nothing management-facing should be reachable from the internet or from user VLANs
- Put consoles on a dedicated management network and allow access only from a jump host or VPN with MFA
- Use ACLs or firewall rules that allow only the admin hosts and ports you actually need
3. Watch it, then replace it
- Send its logs somewhere central and alert on new admin logins
- Put the migration on the calendar with a date. “We’ll get to it” is how 10-year-old consoles happen
Change carefully: make access-list changes in a maintenance window and keep a console or out-of-band path so you don’t lock yourself out.
God Bless, and May the Source Be with You!
