I was recently visiting a remote office in Hong Kong. Their ISP has provided a Juniper Firewall which was installed at the ingress/egress point for the internet. I have requested a copy of the config to see what it is actually doing. We have our own firewalls after the ISP's firewall.

I'm struggling to think of a reason as to why an ISP would require a firewall appliance on a customers site. Although I'm not familiar with how ISPs in Hong Kong operate.

Has anyone had any experience of this, and could there be a need for an ISP to provide a their own firewall appliance?

  • Do they have a separate POP device or is it also serving as the POP? They could also be using it to enfore basic network etiquette like preventing IP spoofing.
    – billc.cn
    Commented Sep 29, 2016 at 14:17
  • There are no other devices attached by the ISP - it could be enforcing network etiquette, at least that's something to look for when I get a copy of the config. thanks Commented Sep 30, 2016 at 8:11

1 Answer 1


It certainly isn't common though not entirely unheard of.

In the UK for example, there is a specialist health WAN where the ISP provides pre-configured router/firewall infrastructure that meets the set requirements of the network's code of connection. However, the COCO is set by a central body not the ISP.

You would need to look at the contract.

In general, you would never really trust such a setup unless you have direct access to the configuration and any logs. You would also want alerting for any changes and probably would want to audit the configuration at least annually.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .