We decided we must have a firewall expert at each of our bases to manage them individually. Along with security, Genovese worries about customizability, which he says is a key factor in his decision to administer each firewall individually. There's no way to upload an entire policy to each firewall because it's unique and specific to that base, depending on its network topology. If you have five ways of managing, you have five vulnerabilities. The key is strong, consistent policy.
Vendors offer two ways to manage firewalls remotely.
First, a batch process lets administrators push out access-control policies common to all firewalls in the organization. A second, more granular method, lets firewall administrators telnet into each firewall to add custom configurations, updates, and other changes. Reports and alarms from each firewall then feed into a central management console. Large installations with strong security requirements, large numbers of users per firewall, and diverse policy requirements per firewall lean toward human management at each firewall. They are also likely to administer them with less-skilled staff.