UTM firewall replacement: end-of-support checks, feature mapping and migration plan

A UTM that has reached end of support does not fail on the day. It keeps routing traffic, so it is easy to forget. The risk grows quietly.

1. No new signatures. IPS, antivirus and web-category databases stop updating. The box cannot see threats that appeared after its last update.
2. No security fixes. Flaws found in the firmware after end of support stay open. Edge devices are a common entry point for attackers.
3. No repair path. A failed unit has no RMA. Replacement becomes an emergency purchase at the worst time.
4. Hard to defend in an audit. Auditors ask for supported, patched edge devices and for logs you can produce.

For banks, RBI's 2026 Directions for commercial banks tell banks to avoid outdated and unsupported hardware (Para 37), to refresh it before end of support (Para 38) and to review firewall configurations and patch levels periodically (Para 67) (RBI). See our RBI Directions guide and firewalls for banks. For entities covered by CERT-In's 2022 Directions, you also need 180 days of ICT logs within India. See CERT-In log retention.

1. Record the model and serial number from the label or the admin console of every unit.
2. Check the subscription end date in the console's licence page.
3. Ask your vendor or channel partner for the end-of-life notice for that exact model. It lists the end-of-sale, last-renewal and end-of-support dates.
4. Note what still works. Some notices allow support until the current subscription ends; others stop firewall functions entirely on a set date.
5. Flag the risky sites. Any site where the UTM is the only firewall and support has ended goes to the top of your migration list.

Plan to move before the subscription lapses, not on the last date of support.

Old UTM sites often run a separate router and, at bigger sites, a VPN or SD-WAN box. A replacement is the moment to cut that stack down.

• One device per site. Nexapp NGFW runs on the same edge as Nexapp SD-WAN: firewall, VPN, QoS and link steering in one box, under one policy.
• Central policy. Security profiles are defined once in the Nexapp Controller and pushed to every site, with config snapshots, diff and rollback.
• Any link. Fibre, broadband, MPLS and 4G/5G, with SLA-based steering and sub-second failover. Instaroute routers cover small sites and kiosks.
• Quantum-safe VPN. IPsec IKEv2 with hybrid classical + ML-KEM key exchange (NIST FIPS 203) and ML-DSA authentication. See post-quantum cryptography.
• Management and logs in India. Nexapp-hosted in India, or self-hosted in your own data centre.

The left column lists features found on most UTM appliances. The right column lists only what Nexapp documents on this site. Features without a documented equivalent are listed in the next section, not hidden.

Some UTM functions are not documented by Nexapp on this site. If you use them, raise them in your design review so nothing is lost at cutover.

• User-based firewall rules and directory single sign-on. Nexapp SSE applies identity- and device-posture-based access. Map your user groups and confirm the design.
• IP/MAC binding and an internal user database. Check how you use these today and agree the replacement control.
• Web application firewall. If you publish web applications through your UTM, plan a separate WAF.
• Mail protocol scanning and attachment control. Most businesses now use cloud mail with its own filtering. Check where your mail flows.
• Safe-search and time-based web rules. List them so they can be rebuilt in web-filtering or SWG policy.
• Active-active HA. Nexapp documents VRRP device HA. Confirm the HA design with us if you run active-active today.
• On-box reports. Nexapp exports logs to your SIEM or collector rather than storing reports on the box. Plan where logs will live.
• Throughput per model. Ask for sizing against your measured peak traffic with all security features on.

• Indian OEM. Nexapp designs Instaroute routers and builds NexappOS and its management platforms in India. It has been in production since 2014.
• Class-I local supplier under the PPP-MII Order, with a local-content declaration and certificate for each bid. That matters for GeM and PSU buyers. See certifications and government and PSU.
• Converged SD-WAN and NGFW. One edge, one console and one policy for routing, steering and threat prevention, with SSE/ZTNA for users under the same vendor.
• Scale and support. 75,000+ devices deployed for 400+ enterprise and banking customers, with a 24×7 NOC in Pune. See customers.
• Run it or rent it. Buy the edge, or take the whole site as a service under network as a service or managed services.

• SMBs, schools and colleges that bought a UTM years ago and never replaced it. See education.
• Multi-branch businesses that want firewall and SD-WAN together. See retail and manufacturing.
• Banks, NBFCs and co-operative banks with legacy branch appliances. See BFSI.
• Government and PSU offices replacing boxes through GeM. See government and PSU.