Firewall Subscription Expired? What Stops Working and What to Do

Every autumn the same line shows up in the budget sheet: firewall subscription renewal. The appliance is running, the internet works, nobody is complaining. So someone asks, “What happens if we skip it this year?”

Short answer: nothing. Until something does.

Does the firewall switch off when the license ends?

No, and that is exactly the problem. On most vendors the appliance keeps passing traffic. Rules, NAT and VPN carry on. A warning appears in the admin console and that is about it. The protection layers just start to age.

According to Fortinet’s own documentation, an expired FortiGuard license leaves the unit working as a firewall, signature-based services keep scanning with the last signatures they received, and category-based web and DNS filtering stops entirely. Sophos splits it by module: when Network Protection lapses, IPS signatures are no longer loaded and IPS policies are not applied; when Web Protection lapses, application signatures and antivirus scanning stop working. If the base license itself expires, the firewall behaves like a router and masquerades outbound traffic without processing firewall rules.

From the outside everything looks the same. Inside, you are running on frozen protection.

What stops, and when?

Layer	After the license ends
Basic firewall rules, NAT	Usually keeps working (except a lapsed Sophos base license)
IPS	Runs on old signatures (Fortinet) or signatures stop loading (Sophos)
Web / DNS filtering	Category lookups stop; traffic may be dropped depending on policy
Antivirus, sandbox	Updates stop; some vendors disable them outright
Firmware updates	Limited without a support subscription
Hardware replacement (RMA)	Gone once support lapses

People skip the last two rows. A firewall that cannot receive security patches becomes part of the attack surface itself. Sophos documents that after a set number of free firmware upgrades, further upgrades need a support subscription.

What a late renewal costs

The common thinking is “I’ll renew next month, I just lose a month.” With Fortinet it is harsher: because the services are designed to be continuous, a gap means coverage is back-dated to the original expiry date. You pay for the months you had no protection. Other vendors differ, so get the rule in writing from your distributor before you postpone anything.

We see two things in practice. First, the renewal date is in nobody’s calendar. The person who installed the box left, and the license email goes to their old address. Second, the problem only surfaces when something breaks: the web filter cannot reach its category service and one morning half the sites will not open.

Renew or replace?

Don’t start with “how old is the box.” Ask three things:

1. Has the vendor declared the model end of life? Renewing an end-of-life model makes little sense, since the software updates are not coming anyway.
2. Has your line speed outgrown the appliance? If you moved to fiber and CPU sits near 80 percent with IPS and web filtering on, the datasheet “firewall throughput” tells you nothing. Look at the figure measured with threat protection enabled.
3. How big is the gap between a renewal and a new box? The yearly cost gap between renewing the old unit for one year and a new unit with a three or five year license can be smaller than you expect; do not decide before you see the numbers. Ask for two quotes: renewal, and new appliance plus license.

If all three answers are no, renew, and take a long term. Multi-year terms usually lower the unit price and remove the calendar problem.

This week

• Put every firewall into one table: device, model, expiry date, owner.
• Set a reminder 90 days before expiry, addressed to a group, not a person.
• Look your model up on the vendor’s end-of-life list.
• Open the license page in the console and screenshot which services are active.
• If you run a backup line or a second appliance, check its license too. That one is usually forgotten.

FAQ

Can I keep running a firewall with an expired license? Technically yes, but the value of signature and filtering services shrinks every day. It can be a conscious, short-term choice. It cannot be an open-ended one.

Will the internet go down when the license ends? Usually not. The exceptions are web or DNS filtering that drops traffic by default when it cannot rate it, and a lapsed Sophos base license where rules are not enforced. Either can turn into an “internet is down” call one morning.

Who handles the renewal? It goes through a distributor or partner. With a managed IT service the provider should track expiry dates, so check that “license tracking” is actually written into the contract.

Should I move to a cloud security service instead of renewing? For a small office whose applications already live in the cloud, possibly. If you still have on-premises servers, printers and branch VPNs, you still need the appliance. It is not something to answer without looking at users and application layout.

If you want to inventory your firewalls before the budget meeting, get in touch and we will go through expiry dates and model status together.