Keep your firewall on supported hardware and software, and complete any necessary replacement before security support ends. If only its current software release is retiring, an upgrade on supported hardware may be enough. If an ordinary support contract is expiring while the product remains supported, renewal may be the right action. The decision starts with identifying which deadline actually applies.
For an IT manager preparing a branch-network budget, treating every “end-of-life” notice as a hardware purchase can waste money. Treating every notice as a routine renewal can leave a security gateway without a supported future.
Separate the product timeline from the contract
End of life describes a lifecycle process, not one universally defined date. Read the manufacturer's notice for the exact model and software release, then match it to your service entitlement.
| Boundary | What to establish | Likely action |
|---|---|---|
| End of sale | New sales stop, but what security maintenance and support continue for installed equipment? | Plan the transition using the remaining support dates; do not infer immediate replacement from the sales date alone. |
| End of security maintenance for a software release | Can this hardware run a supported release with the features your network needs? | Validate an upgrade path, or replace the platform if no suitable supported path exists. |
| End of product support or your contract | Is the manufacturer ending support for the product, or is your own entitlement simply expiring? | Replace before product support ends; renew eligible coverage when the supported product still meets the requirement. |
For example, Cisco's published lifecycle policy distinguishes end of sale from the last date of support and notes that customers may need a newer software version to receive software support. These are Cisco policy examples, not Network Box USA lifecycle terms. Other manufacturers use different milestones and abbreviations.
Check security-fix availability, technical assistance, hardware replacement, and threat-intelligence subscriptions separately. A quote should explain which of those it extends and through what date. Do not assume that a subscription renewal extends the underlying hardware's support lifetime.
Work through one retailer's renewal decision
Consider a hypothetical retailer with two shops and an IT manager reviewing their firewall renewals. Both shops use their gateways for checkout traffic and a connection to the head office. The manager receives two different lifecycle notices.
Shop A: the installed software release is approaching the end of maintenance. The manufacturer confirms that the existing hardware supports a newer maintained release, with the required features. Subject to compatibility testing and valid support coverage, the useful project is a software upgrade. Replacing the appliance solely because that older release is retiring would skip the available supported path.
Shop B: the appliance is approaching its final support date, and the manufacturer identifies no supported software path beyond it. The retailer needs a replacement plan. Buying another service period without checking the covered dates would not solve that lifecycle problem.
The resulting budget has two different commitments: upgrade and maintain Shop A; procure and migrate Shop B. The manager records the supporting notices, supported target release or replacement platform, and the deadline for each. The appropriate path depends on the actual manufacturer notices and deployed requirements.
When evaluating a move to Network Box USA's Managed Unified Threat Management (UTM+), include that transition in the service discussion. UTM+ combines gateway controls with updates, monitoring, policy management, deployment validation, and an operational handoff. The benefit is a defined operating responsibility after installation. Confirm the proposed hardware, support lifecycle, migration work, and commercial terms; the public service description does not establish an included hardware-refresh entitlement or support for the retailer's incumbent appliances.
Work backward from the support deadline
For Shop B, the completion date is when the replacement can carry the required business traffic with the intended policy and monitoring. Ordering the appliance is an earlier milestone. Allow time for procurement, configuration, an approved change window, business testing, and resolving failed checks before the old platform loses support.
The retailer's acceptance work should cover checkout, the head-office connection, remote administration, and any required separation between guest and business devices. Confirm that expected events reach the agreed monitoring service. If the design includes redundant gateways, our firewall failover guide explains the separate question of what happens to established connections during a failure.
Choose the replacement against today's workload and planned changes. Our explanation of firewall connection rate, concurrent sessions, and throughput helps frame that capacity discussion. Reproducing the old model's label or buying by employee count alone does not describe the workload.
If support has already ended
Escalate the replacement decision promptly. The February 5, 2026 CISA, FBI, and NCSC fact sheet on unsupported edge devices recommends tracking support timelines and replacing unsupported equipment. Its referenced binding directive applies to US Federal Civilian Executive Branch agencies; the broader defensive guidance is useful to other organizations, without creating a universal private-sector deadline.
If immediate replacement is impossible, document the reason, accountable risk owner, interim restrictions, and retirement date. Review exposed management interfaces and unnecessary services with the authorized network operator. The NCSC's obsolete-product guidance treats reduced exposure and reduced access to sensitive systems as temporary risk reductions. They do not restore missing vendor fixes or make continued use risk-free.
Finish the migration by retiring the old appliance deliberately. The Canadian Cyber Centre's obsolete-product guidance addresses transferring required data, sanitizing storage, revoking credentials, and updating inventories. A disconnected device retained for rollback needs a recorded purpose and end date; an untracked spare should not quietly return to production.
Before approving the next firewall renewal, turn the notices into one explicit decision for each gateway: renew, upgrade, or replace, with a supported target and completion date. Contact our team with your current models, software versions, support deadlines, and critical traffic flows to discuss a managed UTM transition.