Practical guidance from A2NY IT WORKS. Adapt the checklist to your environment and document the decisions that matter.
Understand the traffic
Map the trusted networks, guest or IoT segments, remote-access paths, and internet-facing services. A rule review is easier when the intended traffic is written down first.
Review administration access
Check who can administer the router, how remote administration is restricted, and whether unused accounts or services have been removed. Record the approved management path.
Read the rules in order
Look for broad rules, shadowed entries, unclear comments, and exceptions that no longer match the environment. Each rule should have an owner or a reason that can be explained.
Leave evidence of change
Record the review date, changes made, testing performed, and rollback considerations. Keep a current export or configuration record according to the organization’s access policy.