CRA for Firewalls and IDS/IPS: What EN 304 636 Means for Network Security Infrastructure

Firewalls and intrusion detection/prevention systems guard the perimeter. Their compromise is catastrophic. EN 304 636 reflects this by classifying them as Important Class II — mandatory third-party assessment, no self-certification path.

Products in Scope

• Hardware firewalls (Palo Alto, Fortinet, Cisco ASA)
• Software firewalls (pfSense commercial, OPNsense Business)
• Next-Gen Firewalls (NGFW) with application-layer inspection
• Network IDS/IPS (Snort, Suricata commercial distributions)
• Web Application Firewalls (WAF) when sold as products
• Cloud-native firewalls and security groups — if sold as standalone products

EN 304 636 Key Requirements

• Default-deny policy — Firewalls must ship with a deny-all-except-explicitly-allowed configuration
• Rule integrity — Detection of unauthorized rule modifications with alerting
• Signature update security — IDS/IPS signature updates must be cryptographically verified
• Management interface security — Hardened admin interfaces with MFA, RBAC, and session management
• Logging completeness — All security-relevant events logged with tamper detection
• Failover behavior — Documented and configurable fail-open vs. fail-closed behavior

Impact on Enterprise Infrastructure Decisions

When selecting network security products, CRA conformity becomes a procurement requirement. Ask vendors:

• Have you completed EN 304 636 conformity assessment?
• What is your vulnerability reporting and patching SLA?
• How long is the security update support period?
• Can you provide the SBOM for your product?

If they can't answer these questions today, they won't be compliant by December 2027.