Firewall for banks in India: RBI requirements and GeM buying checklist
A firewall for banks in India has to support what RBI now writes into its Directions of 31 July 2026. Those Directions ask for multi-layered boundary defences with firewalls, DMZs and network IPS/IDS, real-time filtering of inbound and outbound traffic, and periodic review of firewall configurations and patch levels. They also ask for MFA for privileged users, strong cryptography and incident reports on DAKSH within 6 hours. RBI does not name or approve products. If you buy on GeM, the bid adds its own gates: Make in India local-content class, OEM authorisation, turnover and past-performance rules, and a specification that must match the datasheet line by line.
Key facts
| Governing RBI text (commercial banks) | Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, RBI/DoS/2026-27/410, 31 July 2026 (RBI) |
| The firewall paragraph | Para 77: multi-layered boundary defences with firewalls, proxies, DMZ and network IPS/IDS, plus real-time filtering of inbound and outbound traffic |
| Review duty | Para 67: periodically review firewalls, switches and security devices, including configurations and patch levels |
| End-of-support | Para 37: avoid outdated and unsupported hardware; Para 38: refresh before end of support |
| Testing | Para 151: VA every 6 months and PT every 12 months for critical and customer-facing DMZ systems |
| Reporting | Para 182: cyber incidents on DAKSH within 6 hours of detection |
| Logs | RBI leaves retention to the bank; CERT-In requires 180 days of ICT logs within India (CERT-In) |
| GeM local content | Class-I local supplier: at least 50% local content; Class-II: at least 20% (as stated in GeM bid documents) |
Paragraph numbers are from the commercial-bank version. RBI issued seven versions, one per type of regulated entity, so check the one that applies to you. Our RBI Directions guide covers the network paragraphs in more depth.
What RBI's 2026 Directions ask of a bank firewall
The Directions are technology-neutral. They say what the bank must achieve, not which box to buy. These are the paragraphs a firewall helps you meet, read from the Directions text.
| RBI requirement (Para) | What it means for the firewall | Capability to ask for | Nexapp NGFW |
|---|---|---|---|
| Multi-layered boundary defences with firewalls, proxies, DMZ and network IPS/IDS; real-time filtering of inbound and outbound traffic (77) | A perimeter firewall is not enough on its own; layer IPS, web filtering and egress control | Stateful firewall, IPS, web filtering, outbound policy, DMZ zone | Zone firewall, IPS, gateway antivirus, web filtering, anti-spam, DPI application control, InstaShield IP reputation blocking |
| Review firewall configurations and patch levels periodically, including at DCs and third-party sites (67); review configurations at inter-VLAN nodes, LAN/WAN interfaces and third-party interconnections (103) | Every branch and DC firewall needs a known configuration and patch state | Central management, config history, firmware inventory | Nexapp Controller with config snapshots, diff and rollback; mass firmware upgrade |
| Baseline secure configuration for network and security devices (66) | Apply a hardened template to every firewall | Templates pushed from one console | Security profiles defined once and pushed per site group |
| Up-to-date inventory of network devices (47, 70) | List every firewall with site, firmware and criticality | Exportable device inventory | Every edge admitted and tracked by serial number in the Controller; REST API (OpenAPI) for export |
| Avoid outdated and unsupported hardware; refresh before end of support (37, 38) | Replace end-of-life firewalls on a plan | Published support life; vendor still issuing updates | Signed NexappOS firmware updates; see our legacy firewall replacement guide |
| Two-factor or MFA for privileged users of critical systems (110) | Firewall admins sign in with MFA | TACACS+/RADIUS, role-based access, 2FA | TACACS+ with per-command authorisation, RADIUS, role-based permissions, TOTP two-factor sign-in |
| Strong, non-deprecated cryptography (140) | Retire weak IPsec and TLS settings | Modern IPsec suites, TLS 1.3 on management | IPsec IKEv2 with AES-GCM, SHA-2, DH groups 14–16 and hybrid ML-KEM; post-quantum TLS 1.3 on the console |
| IPv6 on public-facing infrastructure (78) | Internet edges must handle IPv6 | Dual-stack at the edge | IPv4/IPv6 dual-stack on Instaroute (NexappOS) edges |
| VA/PT of critical and DMZ systems (150, 151) | Internet-facing firewalls go into the test plan | Vendor fixes for findings | Signed firmware with canary rollout and rollback |
| Audit logs, scope and storage set by the bank (93–97); report within 6 hours on DAKSH (182) | Firewall events must reach your SOC quickly | Syslog/SIEM export, alerting | Syslog, webhook and email export to your SIEM; logs in India or in your DC |
A note on ATMs: where a bank uses a third-party ATM switch service provider, Para 138 asks the bank to write baseline controls into the contract. They include firewall rules that block unidentified outbound connections and reverse TCP shells, and adequate network segregation. Your ATM network design should support the same rules. See VSAT to 4G for ATMs.
What RBI does not require
- RBI does not approve firewall vendors or products. Any claim of an "RBI-approved firewall" is wrong. The obligation sits with the bank.
- RBI does not name a firewall type. Nothing in the text says NGFW, UTM or cloud firewall. Para 77 describes layered defences, not a product.
- RBI does not set a log-retention period in these Directions. The bank decides scope and storage (Paras 93–97). CERT-In's 180-day in-India rule applies separately.
- Payment data stays in India. RBI's 2018 rule on storage of payment system data (RBI FAQ) makes the location of firewall management and logs a design question, not just a feature.
Where firewalls sit in a bank network
| Location | Typical job | What to look for |
|---|---|---|
| Data centre and DR perimeter | Internet edge, DMZ, partner links | High throughput, HA, IPS, DMZ zones |
| Branch | Local internet breakout, CCTV and guest isolation, VPN to DC | Firewall and SD-WAN in one box, central policy, 4G backup |
| ATM and kiosk | Encrypted tunnel to the switch, lockdown of the site LAN | Industrial router with zone firewall and IPsec, managed centrally |
| Remote users and vendors | Access to named applications only | ZTNA with MFA and device posture instead of broad VPN |
At branches, Nexapp NGFW runs on the same edge as SD-WAN. Instaroute routers cover ATMs, and Nexapp SSE/ZTNA covers remote access. See BFSI.
Buying a firewall on GeM
GeM has standard categories for firewalls, including "Firewall (V4)" and "Next Generation Firewall Software". Bid conditions often decide the outcome as much as the specification.
A real example shows the pattern. GeM bid GEM/2023/B/2947103 (Central University of Jharkhand, 5 January 2023) for a firewall licence renewal (bid document) set:
- Minimum average annual turnover of Rs 40 lakh for both bidder and OEM over three years, and three years' past experience.
- Past performance: supply of 80% of the bid quantity in one of the last three financial years.
- EMD of Rs 50,000, with MSE exemptions under the GeM terms.
- MII purchase preference, with "Minimum 50% and 20% Local Content required for qualifying as Class 1 and Class 2 Local Supplier respectively".
- Only Class-I and Class-II local suppliers eligible, under the Public Procurement (Preference to Make in India) Order dated 4 June 2020.
- An OEM certificate of local-content percentage and the locations of value addition. Above Rs 10 crore, a statutory or cost auditor must certify it.
- MSE purchase preference for MSE sellers within L1 + 15%.
- GeM GTC clause 26: a bidder from a country sharing a land border with India may bid only if registered with the competent authority.
Bid values differ, but these clauses recur. MeitY has also issued a separate Make in India order for cyber security products, so check which local-content rule your bid cites. Government buyers can also refer to the site's government and PSU page for how Nexapp supports tender documents.
GeM firewall bid checklist
Use this list whether you are the buyer writing the bid or the bidder answering it.
| # | Check | Why it matters |
|---|---|---|
| 1 | Pick the right category: Firewall (V4) for appliances, or the NGFW software category | The wrong category drops qualified bidders |
| 2 | State throughput with test conditions (for example, the IETF method in RFC 9411, which replaced RFC 3511) | "Up to" numbers from different vendors are not comparable |
| 3 | Size on threat-protection or NGFW throughput with all features on, not raw firewall throughput | Real traffic runs with IPS, antivirus and web filtering on |
| 4 | List security features you will actually use: IPS, antivirus, web filtering, application control, SSL inspection, sandbox | Unused features raise cost and narrow the field |
| 5 | Ask for central management, config history and syslog export to your SIEM | Supports RBI Paras 67, 93–97 and 182 |
| 6 | Ask for TACACS+/RADIUS and MFA for admins | Supports RBI Para 110 |
| 7 | Specify IPsec and TLS suites, not just "VPN" | Supports RBI Para 140 |
| 8 | Ask for IPv6 on internet-facing interfaces | Supports RBI Para 78 |
| 9 | Ask where management and logs are hosted | CERT-In 180-day in-India logs; RBI payment data storage |
| 10 | Set local-content class and require the OEM local-content certificate with value-addition locations | Class-I and Class-II rules under the PPP-MII Order |
| 11 | Require OEM authorisation (MAF) for resellers and integrators | Confirms warranty and support come from the OEM |
| 12 | State warranty, support term and minimum remaining product life | Supports RBI Paras 37 and 38 on end of support |
| 13 | Keep turnover and experience criteria proportionate | Very high thresholds shut out MSEs and Indian OEMs |
| 14 | Include the land-border declaration | GeM GTC clause 26 |
| 15 | Match every BoQ line to a datasheet line before bid submission | Mismatches are a common reason for technical rejection |
Where Nexapp fits
Nexapp is an Indian OEM in Pune, in production since 2014, with 75,000+ devices deployed for 400+ enterprise and banking customers. BFSI customers include NABARD, India1 ATM, Aadhar Housing Finance and Sarvatra. For GeM and bank bids, we provide:
- A specification in GeM Firewall (V4) format. Model-wise throughput is shared on the datasheet, with test conditions.
- Class-I local supplier under the PPP-MII Order, with the OEM local-content certificate for each bid.
- Manufacturer authorisation forms for partners.
- Management and logs Nexapp-hosted in India or self-hosted in your DC and DR.
- Hybrid post-quantum IPsec (ML-KEM, NIST FIPS 203) on every tunnel. See post-quantum cryptography.
The compliance obligation stays with your bank. See our Trust page for how we handle security.
Frequently asked questions
Does RBI mandate a next-generation firewall for banks?
No. RBI's 2026 Directions do not name a product type.
Para 77 asks for multi-layered boundary defences with firewalls, proxies, DMZ and network IPS/IDS, and real-time filtering of inbound and outbound traffic. An NGFW is one common way to meet that.
Is there an RBI-approved firewall list?
No. RBI does not approve network or security vendors.
The bank is responsible for its controls, and vendors supply capability and evidence.
How often must a bank review its firewall configuration?
Para 67 requires periodic review of firewalls and other security devices, including configurations and patch levels, but does not fix a frequency.
Internet-facing and customer-facing DMZ systems need VA every 6 months and PT every 12 months (Para 151).
Can a bank keep using an end-of-life firewall?
Para 37 tells banks to avoid outdated and unsupported hardware and to track end-of-support dates, and Para 38 asks for a refresh plan before end of support.
An end-of-life firewall is hard to justify under both.
What is a Class-I local supplier for a GeM firewall bid?
Under the PPP-MII Order as applied in GeM bids, a Class-I local supplier offers goods with at least 50% local content, and Class-II at least 20%.
The OEM must certify the percentage and the locations of value addition. Above Rs 10 crore, an auditor must certify it.
What is Firewall (V4) on GeM?
It is GeM's standard product category for firewall appliances.
Buyers fill in its attributes, such as throughput and features, and add bid conditions. The "V4" suffix marks the version of the category.
Is Nexapp a Class-I local supplier on GeM?
Yes. Nexapp is a Class-I local supplier: an Indian OEM building on its own NexappOS operating system, with the local-content certificate provided for each bid.
Ask us for the certificate and current GeM availability for your bid.
Writing or answering a firewall bid? Get a spec sheet in GeM format and a clause-by-clause RBI mapping.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.