If you’re a Metaswitch operator, you’re probably familiar with CommPortal—the web-based interface that allows your customers to manage their phone settings, voicemail, and other communications features. It’s a great tool, providing a user-friendly way for subscribers to take control of their services – and the same web interface is also used by individual phone endpoints to pick up their configuration, so it’s really a critical piece of infrastructure for a hosted PBX business deployment.
But here’s the catch: CommPortal is a public-facing web server sitting inside your core network. It’s protected by your on-premise firewall, but as cyber threats evolve, that’s not always enough.
The reality is that traditional firewalls are great at blocking unauthorized access at the network level, but they don’t inspect or filter web traffic at the application layer. And that’s where a Web Application Firewall (WAF) comes in.
What Is a Web Application Firewall (WAF)?
A Web Application Firewall (WAF) is a security device or service that analyzes and filters HTTP traffic between users and your web-based applications—in this case, CommPortal. Unlike a traditional firewall that focuses on blocking IPs and ports, a WAF is designed to detect and prevent more sophisticated threats that could slip through your standard perimeter defenses.
A WAF can help protect your network against:
- SQL Injection – Attackers inserting malicious SQL queries to gain access to sensitive data.
- Cross-Site Scripting (XSS) – Malicious scripts executed in users’ browsers, often leading to session hijacking.
- DDoS Attacks – Flooding your web service with traffic to take it offline.
- Credential Stuffing – Attackers using leaked username/password pairs to gain unauthorized access.
- Zero-Day Exploits – Newly discovered vulnerabilities that a WAF can block using behavioral analysis and machine learning.
In short, a WAF acts as a security checkpoint, filtering out bad traffic before it ever reaches your CommPortal server.
Why Should You Care?
If an attacker gains access to your CommPortal, they could:
- Extract customer data or compromise accounts.
- Exploit your subscriber accounts for toll-fraud.
- Disrupt service availability by overwhelming the platform with traffic.
And let’s be honest—telecom networks are becoming prime targets for hackers. Even if your network hasn’t been attacked yet, it’s only a matter of time before someone tries. A WAF gives you an additional layer of protection, ensuring that CommPortal remains secure and available to your customers.
Choosing the Right WAF for Your Network
There are multiple WAF solutions available, and the right one for your network depends on factors like cost, deployment model, compliance needs, and security requirements. Below, we’ll break down some of the best WAF options currently on the market.
On-Premises WAFs: Maximum Control, Maximum Security
If you need full control over your security policies and prefer to keep everything inside your own infrastructure, an on-premises WAF might be the right choice. These solutions are best suited for organizations with strict compliance or data residency requirements—or for those who simply want to avoid relying on a third-party cloud service.
1. F5 Advanced WAF
✅ Best for: Large-scale service providers with enterprise-grade security needs.
- Offers advanced bot protection and application-layer encryption to defend against sophisticated threats.
- High-performance, available as hardware appliances or virtual instances.
- Strong analytics and AI-powered security to detect emerging attacks.
2. Barracuda Web Application Firewall
✅ Best for: Providers looking for a balance of security and ease of use.
- Protects against OWASP Top 10 threats (including SQL injection and XSS attacks).
- Simple to deploy, with an intuitive web-based management interface.
- Provides SSL offloading and load balancing, improving performance.
3. Fortinet FortiWeb
✅ Best for: Providers already using Fortinet products or looking for machine-learning security.
- Uses AI-based threat detection to block attacks proactively.
- Supports API security, ensuring protection for web-based services.
- Integrates seamlessly with Fortinet’s Security Fabric, offering end-to-end network protection.
4. Sophos XG Firewall (with WAF Module)
✅ Best for: Small to mid-sized service providers looking for a cost-effective solution.
- Simple WAF module included with Sophos XG Firewalls.
- Easy integration with Sophos’ synchronized security ecosystem.
- Not as feature-rich as dedicated WAFs, but a good entry-level solution.
Cloud-Based WAFs: Simplicity and Scalability
If you don’t want to manage another on-premises device—or if you want protection that extends beyond your own data center—a cloud-based WAF might be a better option. These services provide scalable protection, are easy to deploy, and are maintained by security experts.
Some notable cloud-based WAF providers include:
AWS Web Application Firewall
- Integrates with Amazon CloudFront for low-latency security filtering.
- Custom rulesets for DDoS mitigation and bot protection.
- Best for providers already using AWS for hosting or applications.
Cloudflare WAF
- Protects against zero-day threats and emerging attacks.
- Global network of edge servers for fast traffic inspection.
- Includes DDoS protection and bot management.
Imperva WAF
- Uses AI-powered threat intelligence to block attacks in real-time.
- Available as a cloud service or on-premises appliance.
- Advanced API security and bot mitigation capabilities.
Final Thoughts: Securing CommPortal for the Long Haul
CommPortal is a critical service for your customers, but like any public-facing web application, it’s a potential target for cyberattacks. A Web Application Firewall (WAF) is a smart investment, providing an extra layer of defense that goes beyond a standard firewall.
Whether you choose an on-premises WAF for maximum control or a cloud-based WAF for ease of deployment, adding this layer of protection will help you:
✔ Reduce the risk of security breaches.
✔ Protect customer accounts and sensitive data.
✔ Ensure high availability and reliability of CommPortal.
If you need help evaluating WAF solutions or securing your Metaswitch environment, we’re here to help. Let’s make sure your network stays secure, resilient, and ready for the future.
