Your Firewall Still Works. Is It Still Supported?

Connectivity is only one part of the job

Edge devices include routers, firewalls, and VPN gateways positioned at network boundaries. Their location makes their security especially consequential: they handle traffic between environments and may also expose remote access or management services. Joint agency guidance on edge-device security describes why attackers target these systems and why visibility into them can be limited.

A device can continue functioning after its vendor ends security support. New vulnerabilities may then remain without fixes for that product. A working internet connection tells you that packets are passing; it does not establish that the appliance is maintained, correctly configured, or free of compromise. Support status belongs in the asset record alongside model and version.

Make a small, usable inventory

For an office with several branches, we recommend starting with the equipment that actually provides connectivity at each location. Record its owner, role, software version, support date, and replacement responsibility. Include a spare device if staff might reconnect it during an outage. The inventory needs to help someone make a decision under pressure, not merely satisfy a documentation request.

Consider a branch where the internet provider, an IT contractor, and the office manager each believe someone else maintains the router. The first useful outcome is a named owner who can confirm support and authorize changes. The second is an agreed way to keep the office running if that equipment needs to be replaced.

Review administration, updates, and evidence

ASD's ACSC practitioner guidance covers device management, hardening, and monitoring. Apply supported security updates, restrict administration to approved access paths, remove unnecessary services, and protect management accounts. Send useful logs to a separate system so investigations do not depend entirely on records stored on the appliance itself.

Where support has ended, plan the replacement and document the temporary restrictions used during the transition. A setting that reduces exposure is not a substitute for ongoing security maintenance. Retain a usable configuration backup, and verify the important access and network rules after the replacement rather than assuming the migration preserved them.

Check what the new configuration actually allows

We recommend validating the result from the places people use the network: an employee laptop, a guest device, a remote worker's connection, and the administration path. Define the expected access for each before testing. A guest should not gain management access simply because a new router has a fresh password and current firmware.

A scan can contribute evidence, but it cannot resolve every configuration or ownership question. An on-site Wi-Fi and network assessment can combine the equipment review with controlled access checks and agreed hardening. For broader infrastructure, manual penetration testing can examine how exposed services and internal boundaries connect. Ask for a report that records what was observed, what changed, and what still needs a decision.