Managed Cybersecurity
Managed Firewall Services for Dealerships: Redundant, Monitored and Kept Current
A redundant pair of firewalls, patched on a schedule and replaced before support ends, so a single failed box doesn’t take the store offline.
Managed firewall services keep a dealership’s firewalls redundant, patched and replaced before their makers stop supporting them, with every change planned and reversible. Helion Technologies manages firewalls for car and heavy truck dealers as part of its cybersecurity and network work.
Last updated: November 10, 2026
The Box Every Department Runs Through
Credit applications, lender portals, email, a cloud phone system and a hosted DMS all reach the internet through the firewall. If the store has only one, every department is counting on a single piece of hardware that’s easy to forget about until the morning it stops. Then the whole store finds out together.
We run the firewall as part of our cybersecurity services for dealerships, the same way at every rooftop. The circuits and the backup internet line behind it are on our network management page. This page is about the firewall itself: the pair, the updates, the rules and who’s watching.
A firewall nobody manages still works, right up until it doesn’t. Then nothing in the store that needs the internet does.
One box or two
What Happens When a Dealership’s Only Firewall Fails?
Everything behind it loses the internet at the same moment, in every department. Picture a Saturday morning with the showroom full. Here’s how that morning goes at a store with a single firewall, and at a store with a redundant pair.
Erik Nachbahr, Founder and President
“Most of the time, we find dealers don’t have a second firewall. So if that hardware goes down, your lifeline is completely down.”
| The moment | One firewall | A redundant pair |
|---|---|---|
| The firewall fails | The store drops off the internet, all of it at once. | The second unit picks up the traffic and the store keeps running. |
| The sales desk | Credit applications, lender portals and email stop in the middle of a deal. | Deals keep moving. |
| The service lane | With a hosted DMS, advisors can’t open repair orders or look up parts, and a vehicle software download in the shop can stop partway. | The lane keeps writing tickets. |
| Phones and the DMS | A cloud phone system and a hosted DMS go quiet with everything else. | Calls ring through and the DMS stays open. |
| Who notices first | Whoever tries to work next, maybe with a customer sitting across the desk. | The pair logs the failover. The floor may not notice at all. |
| Getting back to normal | Someone finds, ships and sets up a replacement while the store waits. | The failed unit is replaced and the pair is whole again. |
The firewall isn’t the only thing that can cut a store off. A dead internet circuit does it too, which is why our network build adds a second line from a different carrier. Both belong in a business continuity plan.
Why Attackers Go After the Firewall First
A firewall sits on the edge of the network, facing the internet, which makes it the first thing an attacker can reach. Once a firewall flaw is made public, every unit that hasn’t been patched is exposed to it. An unpatched firewall at a dealership doesn’t just fail to protect the DMS and the customer records behind it. It can turn into the way in.
So we treat it as a managed device with a schedule, the same as the computers on the sales floor. It isn’t an appliance that gets installed once and forgotten. A federal agency, a breach report and a standards body all point the same way, on the right.
Facing the internet means facing attackers first.
CISA
CISA’s Binding Operational Directive 26-02 (February 2026) lists firewalls among the edge devices federal agencies must inventory and replace when they reach end of support, and says these devices are “especially vulnerable to cyber exploits targeting newly discovered, unpatched vulnerabilities.” Read the directive.
An unsupported firewall is a target.
Verizon
Verizon’s 2025 Data Breach Investigations Report names exploitation of vulnerabilities (20%) as one of the two leading ways attackers first got in, after a 34% increase “with a significant focus on zero-day exploits targeting perimeter devices and VPNs.” See Verizon’s summary.
Firewalls and VPNs sit on that perimeter.
NIST
NIST’s guide to firewalls, SP 800-41 Revision 1, treats the firewall as something you run, not just buy, with “recommendations for establishing firewall policies and for selecting, configuring, testing, deploying, and managing firewall solutions.” Read the NIST guide.
Buying it is only the start.
One Team Behind 2,000+ Dealerships
All of our clients are on the same roadmap, so the firewall setup at your store isn’t an experiment. Erik Nachbahr, our founder, describes our vetted firewall, wireless and PC configuration as “deployed tens of thousands of times.” One franchised dealership came to us after a cybersecurity incident, running old unmanaged network gear and paying internet providers for services it didn’t have. We put in resilient firewalls and a managed network, cut the internet down to two broadband lines, and the monthly bills went down.
The coverage
What Do Managed Firewall Services Cover at a Dealership?
They cover six things: a redundant pair, firmware and security updates, replacement before end of support, remote access, the rules that keep the store’s networks apart, and the security monitoring behind it all. Changes to any of it follow the four steps further down.
Managed firewall services Six parts of the job
Pair Two firewalls, one standing by
A redundant pair is two matching firewalls set up to work as one. One carries the traffic. The other keeps a synchronized copy of its settings and takes over if the first one fails, without anybody at the store touching a cable. A single firewall is a single point of failure for sales, service, parts and the phones at the same time. We recommend a pair for every store, and resilient firewalls were part of the rebuild at the dealership described above. A second unit is a known cost. A dark Saturday isn’t.
Two boxes, one lifeline.
Firmware Security fixes, on a planned schedule
Firewall makers keep releasing security fixes, and the moment a flaw goes public, attackers can start hunting for units nobody has patched yet. At Helion that work belongs to our Proactive Managed Services team, who handle firewall firmware as planned work inside a window the store has already agreed to. And with a pair in place, one unit can take the update while the other keeps carrying the traffic.
Behind on firmware means behind on security.
Lifecycle Replaced before its maker stops supporting it
Every firewall model eventually reaches end of support. Past that date the unit still runs and still passes traffic, but its maker stops sending security fixes for it. We record each unit’s end-of-support date as the maker publishes it, and the replacement goes into the client’s five-year budget ahead of time, the way our IT asset management page describes, so a CFO doesn’t find three firewall purchases landing in the same quarter.
We know the date. You see it in the budget.
Remote access VPN logins that end when the job does
Remote access is the other door. Sales managers check numbers at home, a controller closes the month from the sister store, and a vendor logs in to patch the system they sold you. The Safeguards Rule requires multi-factor authentication for anyone accessing any information system, unless the Qualified Individual approves an equivalent control in writing. That works best when each person has a VPN login of their own, vendor access opens for the job and closes after, and remote access comes off as part of every employee’s exit.
One person, one login.
Rules Guest Wi-Fi, the shop and the office kept apart
Which network can reach which is the firewall’s call. Showroom guests get Wi-Fi to the internet and nothing else. The shop runs on its own network. The DMS and the customer records sit on the business network, behind rules of their own. That split is where our network management page starts, and the firewall is where it’s enforced. Every rule should have a reason someone can explain, and one nobody can explain is worth a second look.
Guests get the internet. Nothing else.
Monitoring The security monitoring behind it
A firewall is one layer, not the whole defense. Security support runs 24/7: live, US-based analysts monitor your systems and step in the moment they see signs of an attack. That team doesn’t wait for anyone to call. How that works is on our managed detection and response page.
One layer of several.
How Managed Firewall Changes Get Made
-
1
Write the change down
Write down what’s changing and why, which store it’s at, who signs off and what else it might affect. A temporary rule for a vendor gets an end date before it goes in.
-
2
Save what works
Before anyone touches the firewall, take a current backup of its configuration, so there’s a clear undo.
-
3
Make it at a set time
Make the change in a window the store has agreed to, outside its busiest hours and the month-end close, one rooftop at a time.
-
4
Test it, or roll it back
Confirm it did what it was meant to while people are there to check, and that nothing else broke. If something did, put the saved configuration back.
The FTC Safeguards Rule requires covered dealers to “adopt procedures for change management” in section 314.4(c)(7) of the rule. These four steps follow the process Rex Marchant, our VP of Service, lays out in the post on dealership IT maintenance windows, and our FTC Safeguards checklist covers the rest.
Common Questions
What’s in your closet?
Our complimentary IT and cybersecurity assessment checks whether your firewalls are actually configured correctly and puts today’s IT bills next to what one accountable team would cost. Already know what you need? Get a price quote.
Does the FTC Safeguards Rule require a firewall?
When should a dealership replace its firewall?
How much do managed firewall services cost?
Does a dealership really need two firewalls?
How often should firewall firmware be updated?
What are managed firewall services?
Find out what’s guarding your store. Then let’s make it two.
Request a Complimentary Assessment →