Network Equipment End-of-Life & End-of-Support Management

The milestones and what each one means

The terminology varies between vendors and the intervals between milestones vary too, which is part of why estates drift past these dates unnoticed. The practical point is the same everywhere: after end of software maintenance, every vulnerability disclosed against that platform stays open on your network forever.

• End of Sale (EOS/EoS) — the vendor stops selling the product. Support continues, but you can no longer buy additional units through normal channels, which matters for expansion and for maintaining a spares pool.
• End of Software Maintenance — the vendor stops releasing software updates for the platform. Bug fixes cease and, critically, security fixes cease. The device continues to work; it simply stops improving and stops being defended.
• End of Support / End of Life — the vendor stops all support. No TAC cases, no RMA, no software, no advisories addressed. From this point the device is entirely your risk.
• Last Date of Support — the final date on which any support obligation exists, after which the platform is fully retired from the vendor's perspective.

Why this becomes a compliance problem, not just a technical one

Running unsupported infrastructure is increasingly something you have to declare rather than merely manage. Customer security questionnaires ask about it. Cyber insurance applications ask about it. Sector regulators — RBI guidance in BFSI being the clearest example in India — expect supported infrastructure and will treat unsupported devices carrying production traffic as a finding. Certification frameworks including ISO 27001 and PCI DSS require that systems receive security updates, which an end-of-support device by definition does not.

The result is that end-of-support hardware creates exposure on two fronts simultaneously: the technical risk of unpatched vulnerabilities, and the commercial risk of failing an audit, a customer review or an insurance renewal. Both are avoidable with enough notice, which is the entire argument for tracking lifecycle position continuously rather than discovering it during a questionnaire.

How we manage lifecycle position

1. InventoryAccurate device inventory including model, part number, hardware revision and serial where available — precision matters, because lifecycle dates are frequently model-variant specific.
2. MapEach device matched against published vendor lifecycle milestones to establish its exact position and the dates ahead of it.
3. Assess riskLifecycle position weighted by business criticality and exposure, so a past-EOS internet-facing firewall ranks above a past-EOS access switch in a meeting room.
4. PlanA refresh roadmap phased across budget cycles, with the highest-risk devices addressed first and dependencies between devices respected.
5. RecommendReplacement options with indicative commercials, covering both like-for-like refresh and the alternatives worth considering at a refresh point.
6. ExecuteMigration and deployment of the replacement estate, with configuration translation and staged cutover.

Frequently asked questions

What is the difference between EOL, EOS and end of software maintenance?

End of sale means you can no longer buy it. End of software maintenance means it stops receiving software and security updates. End of support or end of life means all vendor support ceases, including hardware replacement. The security-relevant date is end of software maintenance, because that is when new vulnerabilities stop being fixed — and it frequently arrives well before the date most people have in mind.

How risky is it to run past end-of-support?

It depends entirely on the device's exposure. A past-EOS internet-facing firewall is a serious and immediate risk, because it accumulates every published vulnerability with no fix available. A past-EOS access switch in a controlled internal environment is a lower technical risk, though it still carries spares and audit implications. The right response is proportionate, which requires assessing each device rather than treating the estate uniformly.

Can you tell me the EOL status of my equipment?

Yes — that is the core of this service. Provide an inventory and we return each device's lifecycle position against published vendor milestones. For Fortinet specifically, our FortiGate EOL checker is publicly available if you want an immediate answer for those platforms.

Should I replace or migrate to a different vendor?

A refresh point is the natural moment to ask that question, since the switching cost is lowest when you are replacing the hardware regardless. The honest answer depends on whether the current platform still fits your requirements, what your team is trained on, and what the commercial difference is over the full lifecycle rather than at purchase. We work across all major vendors, so we have no structural reason to push you either way.

How far ahead should we plan a refresh?

Twelve to eighteen months before end of support is a comfortable planning horizon — enough time to budget properly, run a procurement process, and phase the migration without compressing it into an emergency. Estates that start planning at six months usually end up paying more, both in procurement terms and in the operational cost of a rushed cutover.

Related services

• Network Device Health Check
• Migration Services
• FortiGate EOL Checker
• Vulnerability Remediation
• Network & Security Lifecycle Management