That's the exact boat I'm in, coming from SaaS and now trying to learn this infra stuff. You're not alone!
Everyone's talking about the central console for managing multiple sites. That's got me thinking, how bad is the setup for that initial config? Like, if I'm starting from scratch with five firewalls, is one of them way more painful to get to that consistent baseline state?
I'm also a little scared about the log thing now. I know PCI needs logs, but I figured the firewall would just... save them. Shows what I know! What does a "separate pipeline" even look like for a setup this size? Is it just a syslog server somewhere?
I felt exactly the same way about the logs! I was so sure the firewall just kept them, too. For the pipeline, yes, it's usually a syslog server, but you have to make sure it's secure and the logs can't be tampered with. I'm looking at a small commercial syslog appliance now that promises to handle the PCI retention part.
About the initial config, I found the baseline setup for the first firewall was okay, but replicating it perfectly to the other four was the tricky bit. I ended up building a checklist for every single setting I changed on that first device, which helped a lot. Did you run into any specific snags when you were trying to copy settings between sites?
Welcome to the deep end, you picked a great pair of starters. Coming from a similar background, I totally get the jump from SaaS to on-prem hardware feeling big.
For that five-store setup, Sophos Central was easier for me to wrap my head around initially. The interface is more like the dashboards you're used to, and pushing a uniform policy feels less like building five separate configs from scratch. The traffic between stores was solid once the site-to-site VPNs were dialed in.
But, echoing what others said, the firewall is just the bouncer. The real work is the log pipeline. For PCI, you can't just trust the firewall's local storage. Plan for a dedicated, secure syslog server from day one - that's where you'll pull your evidence for audits. It adds cost, but skipping it makes compliance way harder later.
Keep it simple.