When Should a Business Firewall Be Replaced? Seven Signs to Check

Replace a business firewall when its vendor has published an end-of-support date you are about to pass, when it can no longer run a supported firmware release, or when it cannot carry your traffic with the inspection features you rely on switched on. There is no fixed replacement age: Sophos and Fortinet publish lifecycle dates for each model, and those dates set your deadline, not the purchase date. Other warning signs, such as remote access without MFA, a rule base nobody can explain or logs that never leave the box, are configuration problems first and can often be fixed on the hardware you already have.

Below are the seven signs to check, which ones mean new hardware, and how to plan the change without an outage. For platform detail, our Sophos firewall and Fortinet FortiGate pages cover deployment and ongoing management of each.

Is there a set age at which a firewall should be replaced?

No. Neither Sophos nor Fortinet sets a replacement age counted from the day you bought the unit. Both publish lifecycle milestones per hardware model, so a firewall bought late in its model's sales life can reach end of support sooner than one bought at launch.

• Sophos usually gives partners up to 90 days' notice before a model's end-of-sale date. After that, hardware with a valid support or warranty contract stays supported until its end-of-life date. Sophos states that XGS Series hardware will be supported for at least five years after its end-of-sale date, and that the last date to extend hardware replacement, support and subscription contracts is 12 months before end of life.
• Fortinet records three dates for each hardware model: the End of Order date, the Last Service Extension date and the End of Support date, when Fortinet Customer Service and Support stops actively supporting it.

So the useful answer is a record, not a rule of thumb. For every firewall, write down the model, serial number, firmware version and the vendor's dates, and put the last renewal date in a calendar. A joint fact sheet from CISA, the FBI and the UK National Cyber Security Centre (NCSC) asks organisations to keep an inventory of all edge devices and their support timelines, and to review those dates regularly.

What actually changes when a firewall reaches end of support?

The firewall keeps passing traffic, which is exactly why the risk is easy to miss. What stops is the vendor's work on it.

• Fortinet says that once a FortiOS version reaches end of support, it stops releasing updates and providing support, leaving your network vulnerable and potentially non-compliant.
• Sophos makes pattern updates, which include antivirus, IPS, web categorisation and application control updates, available only on supported software releases. If the software on an appliance reaches end of life and its replacement does not support that model, Sophos requires an upgrade to a newer model.
• CISA, the FBI and the NCSC define an edge device as end of support when its manufacturer no longer monitors it for software or firmware defects and no longer patches it. They warn that nation-state actors exploit end-of-support firewalls, routers and VPN gateways to gain network access, keep a foothold and compromise data.

CISA's Binding Operational Directive 26-02 requires US federal civilian agencies to manage the lifecycle of their edge devices. It does not bind private companies, but the February 2026 fact sheet strongly encourages every organisation to follow it. The advice is to replace end-of-support edge devices promptly, and to keep them on the latest supported software until you can.

Which signs mean the firewall itself has to go?

Four of the seven signs point at the hardware rather than the configuration.

1. The end-of-support date falls inside your planning window. Sophos stops accepting support and subscription extensions 12 months before end of life, and Fortinet publishes a last service extension date for each model. After that date you can no longer extend support on the old unit, so plan the replacement before it.
2. It cannot run a supported firmware release. Sophos notes that a new feature release may no longer support older appliance models or revisions, which then need a hardware refresh. Sophos aims to support the last two maintenance releases of each maintained feature release, and a feature release is typically supported for 24 to 36 months. A firewall stuck on an unsupported release stops getting fixes, however far away its hardware date is.
3. Throughput collapses when inspection is on. The headline figure on a datasheet is not the one that matters. Fortinet's FortiGate 60F datasheet, for example, lists firewall throughput of up to 10 Gbps for large packets, but threat protection throughput of 700 Mbps, measured with firewall, IPS, application control and malware protection enabled, and SSL inspection throughput of 630 Mbps. If the internet slows down whenever IPS or SSL inspection is enabled, and someone switched them off to cope, the unit is undersized for the way you need to run it.
4. You have outgrown it. NIST's firewall guidelines, SP 800-41 Revision 1, ask what throughput, simultaneous connections, connections per second and latency the firewall must handle so that it is not a bottleneck, for current and future traffic. New sites, more remote staff, a second internet line or extra VPN tunnels can push an older unit past those limits.

Which warning signs can be fixed without new hardware?

The other three signs are configuration problems. Fix them on the current firewall if it runs supported firmware. If it cannot do what is needed on a supported release, that becomes a reason to replace it too.

5. Remote access without MFA. CISA's edge device guidance calls for phishing-resistant multifactor authentication and for removing management interfaces that are exposed to the internet. A VPN that accepts a password alone is the gap to close first. Our MFA rollout playbook covers the user side.
6. Rules nobody has reviewed. NIST says rulesets should be managed through formal change control, reviewed or tested periodically, and backed by a log of every policy decision and ruleset change, with a comment on each rule where practical. A rule base full of uncommented entries is very hard to check against your security policy. A firewall rule audit fixes that, and a planned migration is the natural time to do it.
7. No logging off the box. NIST says firewall logs and alerts should be monitored continuously, and CISA recommends collecting edge device logs in a security information and event management (SIEM) system. CISA also lists the clearing of logs as suspicious activity on an edge device, which is one more reason to keep a copy somewhere else.

How can you check your own firewall this month?

A short review answers most of the questions above. For each firewall:

• Note the model, serial number and firmware version, then look the model up in the vendor's list: the Sophos retirement calendar or the Fortinet Product Life Cycle.
• Check the firmware is on a supported release. For FortiGates registered to FortiCloud, the Software Lifecycle widget on the Asset Management dashboard lists units running end-of-support versions.
• Compare your peak traffic with the datasheet figure for the inspection profile you want to run, not the headline firewall figure.
• Confirm that every remote access account needs MFA, and that the management interface cannot be reached from the internet.
• Count the rules with no comment, no owner or no recent hits.
• Confirm where the logs go and how long they are kept.
• Check that a current backup of the configuration exists somewhere other than the firewall. NIST says firewall policies and rulesets should be backed up regularly, and CISA advises keeping backups of device configurations and firmware.

How do you plan a replacement without an outage?

• Start before the renewal window closes. Plan the project so the new unit is live before the last date you can extend support on the old one.
• Size on measured traffic. Use your real peak throughput, connection counts and VPN numbers, with the inspection you intend to run, and allow for growth.
• Clean the rules before moving them. Migrating an old rule base unchanged carries every old permission onto the new hardware.
• Write down the cutover and the way back. Agree a cutover window and a recovery plan, and list the business applications to test afterwards.
• Decide who runs it afterwards. NIST describes management as the longest-lasting phase of a firewall's life: patches, rule changes, performance monitoring and log review all continue after go-live.

Our FortiGate service sizes units against measured traffic with inspection enabled, and keeps firmware on a supported branch with subscription renewals tracked so nothing lapses silently. For the wider design questions of VPN, segmentation and intrusion prevention, see our network security guide. To talk through your current firewall, its lifecycle dates and its rule base, contact our team.