No more security updates
Every network device runs software, called firmware, that the manufacturer updates to fix bugs and security flaws. When a model reaches end of support, those updates stop. From then on, any new flaw stays open permanently. Firewalls and VPN appliances are the most serious case, because they face the internet directly and attackers actively look for unpatched models.
Check the manufacturer's website for end-of-life and end-of-support dates for each device you own. Your network documentation should record these. If a firewall or VPN device is past end of support, treat its replacement as urgent rather than optional. Some vendors give a year or more of warning, which is plenty of time to budget and plan if someone is watching for the notice. Others announce it quietly on a support page.
It cannot keep up anymore
Equipment bought for a five-person office on an entry-level connection may struggle with twenty staff on fast fibre. Signs include a firewall that runs near full capacity during the day, internet speeds that are fine when the firewall is bypassed but slow through it, switches with only 100 megabit ports and Wi-Fi access points that drop clients when meeting rooms fill up.
Older Wi-Fi standards are another limit. Access points from several generations back cannot take advantage of the faster wireless in modern laptops, and they handle crowded spaces poorly. Upgrading them often gives the most noticeable improvement staff will feel day to day. They also tend to lack the newer security settings that current devices expect.
Failures and odd behaviour
Devices that need regular restarts to keep working, ports that stop responding, fans that are noisy or failing, and units that run hot are all signs of age. Capacitors and power supplies wear out over time, especially in warm comms cupboards. Intermittent faults that come and go are particularly costly because they waste staff time and are hard to pin down.
If a technician has visited more than a couple of times in a year for the same device, compare the cost of those visits and the lost time with the cost of replacement. Often the numbers favour replacing it well before it fails completely. Add the cost of downtime for staff who could not work while it was down.
Features you now need
Your needs change even when the equipment does not. You may now need VLANs to separate guests and cameras, PoE to power new access points and phones, a second internet port for failover, a modern VPN or zero trust support, better logging for cyber insurance questions or cloud management to handle a second site. Older devices may not support these at all.
Requirements from insurers, larger customers or industry bodies can also drive change. If a questionnaire asks about your firewall's threat protection or logging, and the honest answer is that the device is unsupported, that is a clear signal. Government and health sector contracts often carry their own security expectations as well, and an unsupported firewall can count against you in a tender or audit.
Planning the replacement
Replacing network gear is a good moment to tidy up. Review the design, consolidate small switches, standardise on one brand where sensible, add VLANs and update documentation. Plan the change for a quiet time, with configuration prepared in advance so the cutover takes an hour or two rather than a day.
Spreading the cost can help. Firewalls facing the internet are usually the priority, followed by core switches and Wi-Fi. Hardware is quoted in writing first, so you can schedule replacements over a year or two in line with your budget while dealing with the riskiest items first. Leasing is another option some businesses use to smooth the cost.
Keeping the new gear healthy
Once replaced, keep firmware current, monitor the devices, back up configurations and record end-of-support dates so the next refresh is planned rather than forced by a failure. Keep the comms cupboard cool and the UPS healthy, both of which extend equipment life. Register the new devices with the manufacturer so warranty claims and support requests are straightforward.
A short annual review of every network device, checking support status, capacity and reliability, takes the surprise out of replacements. It also means you can budget for them in advance rather than finding the money in a hurry after an outage. Combine it with the review of your documentation and labelling so everything stays in step.
In short
- Replace any internet-facing device that no longer gets security updates.
- Watch for gear that cannot keep up with your speed or staff numbers.
- Repeated restarts, failing fans and intermittent faults mean age is showing.
- Missing features such as VLANs, PoE or failover are a reason to upgrade.
- Record end-of-support dates and review all network gear yearly.