What the work does to an office network
Most office networks we see have doors open to the internet and one network for everything, so the TV and a visitor's laptop have a path to the server. Here is what the fixes do to that.
Example
- A configuration backup is taken before each step.
- The doors open to the internet are closed, or paused where something might still depend on them.
- The guest devices move behind a wall onto their own network, and their path to the server is cut.
- The devices that need one settle on a fixed address.
The gear we work on
- UniFi
- pfSense
- Meraki
- Cisco
- Fortinet
- SonicWall
- Barracuda
- TP-Link Omada
- ISP-supplied routers
Matano IT has extensive hands-on experience with Barracuda. Not every router can do everything below, and an ISP-supplied router usually does the least; the evaluation says which of the fixes your gear supports.
On UniFi, the jobs and their prices are published: UniFi network security.
Start with a read-only evaluation
The evaluation is how we find out what your network is doing today, without changing any of it.
Your gear, read-onlyThrough a read-only account on your gear wherever it has one.
Your public address, from outsideA scan of it the way anyone on the internet sees it.
$250, credited in full against remediation services bought within 30 days
Then the fixes, quoted by the work needed
You can take one or both, in whatever order the report suggests, and only where your gear supports them.
-
Close the internet-facing doors and harden the firewall
- Port forwards closed, or paused where something might still depend on them.
- Existing VPN configurations are reviewed.
- Intrusion prevention turned on and set to block, where the firewall has it.
- Inbound traffic limited by region, where the firewall can.
- Guest devices kept off the main network.
- Ready for DNS filtering at the router, set up as part of Matano Guard.
-
Wi-Fi and switch tune-up
A Wi-Fi cleanup: channels split, bands set and settings tidied, so devices aren't crowded onto one channel.
- Channels split across your access points.
- Devices that need one get a fixed address.
- Resources that don't require internal access are moved to a guest network (we can help set one up if needed).
- A device list by network and address, delivered as a spreadsheet and a PDF.
Optional: Matano Guard
If you want us to keep the filtering running, Matano Guard is an optional add-on: $250 setup, then $49 a month per location; the evaluation and the fixes stand on their own without it.
-
Matano Guard
$250 setup, then $49 a month per location
- Matano Guard keeps it running: blocking that works on its own around the clock, policy changes by email, text or ticket, with no ticket fee, configuration backups and a change log available to you on request, and an automated alert we act on if filtering ever stops. Month to month, cancel any time, no contract; annual contract discounts available.
Usually quoted alongside
These come up in most evaluations and are quoted separately, once we know what you have:
- Email domain protection, the DMARC, SPF and DKIM records that stop somebody sending as you. How we set up email domain protection.
- We can set up a VPN for remote access if you need one.
- Endpoint protection on the computers themselves.
How the work happens
Changing a network that an office runs on is only worth doing if the office keeps running. This is how we make sure it does.
Before the window
- You stay in control of access. Read-only access for the evaluation, and admin access only for the agreed window, which you take back after.
In the window
- Remote, in a window we agree with you. Nobody needs to be on site, and you know in advance when it happens.
- A configuration backup before every single step, kept in your folder, so any step can be put back exactly as it was.
- No Wi-Fi password is ever changed. Nobody in the office has to reconnect a device afterwards.
- Paused, not deleted. Anything a test might still need is paused rather than removed, until a follow-up check with someone in the office.
After
- A written record the same day. A summary of what changed, and the device-by-device address list.
- If a change causes a problem, it comes back out.
One office, before and after
An example from a real deployment
A six-operatory dental practice in Mercer County, on UniFi. The practice isn't named, and neither is the doctor.
- Services reachable from the internet
- Before3After0
- Intrusion prevention categories on
- BeforePartlyAfter35 of 35
- Web categories blocked
- BeforeNoneAfter19
- Devices with reserved addresses
- Before6After67
Guest devices were isolated from the practice network, and the office never went offline during the window. See the full before and after.
Questions
Which routers and firewalls do you work on?
UniFi, pfSense, Meraki, Cisco, Fortinet, SonicWall, Barracuda, TP-Link Omada and ISP-supplied routers. The evaluation says which of the fixes your gear supports.
Will the office go offline?
The work happens remotely, in a window we agree with you, with a configuration backup taken before every step, so any step can be put back.
Do you change our Wi-Fi passwords?
No. No Wi-Fi password is ever changed, so nobody has to reconnect a device afterwards.
What access do you need and for how long?
For the evaluation, read-only access through a read-only account wherever your gear has one. For the work itself, admin access only for the agreed window, which you take back after.
Is the $250 evaluation really credited?
Yes. The $250 is credited in full against remediation services when you buy within 30 days of the evaluation.
What does the $49 a month cover?
That is Matano Guard, which keeps the DNS filtering at your router running: blocking that works on its own around the clock, policy changes by email, text or ticket, with no ticket fee, configuration backups and a change log available to you on request, and an automated alert we act on if filtering ever stops. Setup is $250, then it is per location. Month to month, cancel any time, no contract; annual contract discounts available.