An end-of-life firewall no longer gets security fixes from its maker, yet it sits at the edge of your network and faces the internet. Every new flaw found in it stays open. The answer is to inventory edge devices, track support dates and replace each device before its support ends.
What does end of support mean?
CISA's BOD 26-02 defines end of support as hardware, firmware and software versions that no longer receive timely, supported updates from the original maker, including patches for CVEs, security updates, hotfixes and defect fixes. The directive covers federal civilian agencies, issued 5 February 2026. Its reasoning is useful to everyone.
It says campaigns by advanced threat actors target end-of-support edge devices, and that edge devices attract attackers because of "their extensive reach into an organization's network and integrations with identity management systems." The directive lists firewalls among edge devices, next to load balancers and similar boundary equipment.
Why is a firewall worse than an old laptop?
A laptop is one machine. A firewall is the gate for all the machines behind it. It often holds VPN keys, accounts and routing rules. A compromised firewall gives an attacker a place to watch traffic and a trusted position to move inward from.
The UK NCSC's guidance on obsolete products puts it plainly. Once out of date, technology should ideally not be used. If a product no longer gets security updates, attackers are more likely to learn of exploitable flaws, and older products lack the latest security measures. The NCSC states that its advice for managing such products "does not provide a risk-free way of continuing to use obsolete products", and that the sole fully effective fix is to stop using them.
What timeline does the federal directive use?
BOD 26-02 is a good template for a private plan. Agencies must update supported edge devices running end-of-support software, inventory devices from CISA's list within three months, decommission those already past support within twelve months, decommission all identified end-of-support edge devices within eighteen months, and within twenty-four months run continuous discovery and retire devices on or before their support end dates. The shape is: find, replace the worst, then make it routine.
What does a constructed case look like?
A regional accounting firm has a branch office firewall bought seven years ago. Support ended last year, and the maker's page says so. Nobody noticed because the firewall still passes traffic. The IT contractor adds the device to a spreadsheet, finds two more with the same problem, and schedules replacements in order of exposure: the one with a remote VPN first.
How do you replace one without an outage?
Run the new device in parallel where you can. Copy the rule set, but do not copy it blindly: old firewalls collect rules nobody remembers. Use the migration to review each one, remove what is dead and write a reason next to what remains. Cut over at a quiet time, keep the old unit powered but disconnected for a short rollback window, then wipe it. Remove stored credentials and VPN keys before disposal, since a retired firewall still holds secrets.
How to check or apply this
- List every firewall, VPN gateway, router and load balancer, with model, firmware and location.
- Look up each model's end-of-support date on the maker's site. Record it.
- Sort by exposure. Internet-facing devices and anything with remote access come first.
- Budget replacement a year before the date. Lead times and migration effort take time.
- If a device must stay, apply the NCSC's compensating steps: restrict access, isolate it, monitor it, and set a review date.
- Turn off unused services, and put the management interface behind an internal address.
- Make end-of-support dates part of your asset register, with an alert at twelve months.
Quick check
Is an end-of-life firewall still doing its job?
It still filters traffic, but new flaws will not be fixed. Its protection weakens over time as attackers learn how to get past it.
How early should you replace one?
Plan for it before the support end date. BOD 26-02 asks agencies to retire devices on or before that date, in the long term.
Sources
Last reviewed: 18 October 2026.
