Is your Palo Alto firewall end of life?

From Palo Alto Networks' official hardware end-of-life page, which lists every retired series with its end-of-sale and end-of-life dates and the recommended replacement. We bake the dates into this tool when we refresh it rather than fetching live, and we link the official page under every result so you can double-check. Palo Alto announces dates per series, so we expand each series to the individual models people actually own.

End of sale is the last day the hardware can be bought new; the firewall usually keeps working and receiving updates for about five years afterwards. End of life is the one that matters for security: after that date there are no more PAN-OS releases, threat updates or Palo Alto support. Running a firewall past end of life means every newly discovered vulnerability stays open.

It will keep passing traffic, but it no longer receives PAN-OS or threat updates, and firewall vulnerabilities are among the most actively exploited on the internet. It's also a straight failure for Cyber Essentials, which requires unsupported devices to be removed or segregated. Planning the replacement on your timetable is far cheaper than doing it after an incident.

Honestly, it depends. Staying with Palo Alto keeps the strongest NGFW platform and your existing PAN-OS skills, at a premium price with annual subscriptions. FortiGate gives you a full next-generation firewall, usually at a lower price point, also subscription based. UniFi has no mandatory licences and covers routing, VLANs, VPN and IDS/IPS very well for most smaller businesses. We deploy and support all three, so we'll give you a straight comparison for your estate rather than a sales pitch for any of them.

This is the option we'd encourage you to look at seriously, and if you already run Palo Alto it's a particularly natural step. Prisma Access is Palo Alto's SASE: the same security stack delivered from the cloud to every user and every site, in the office or working from home, managed from the same ecosystem you already know. FortiSASE is the equivalent if you're considering a vendor change anyway. Instead of buying another edge box that will itself go end of life in a few years, the protection becomes a service. For hybrid-working, multi-site businesses a zero-trust SASE approach is usually our recommendation at refresh time.

An audit of the current config: interfaces, zones, security policies, NAT, VPNs and any Panorama management. Then a like-for-like design on the new platform, whether that's a current PA series, a FortiGate or UniFi. We stage the new firewall alongside the old one, migrate and test out of hours, and keep a tested rollback. Most single sites are done in an evening with no working-hours downtime.

Yes. We handle the audit, the recommendation, procurement, configuration, installation and the ongoing 24×7 monitoring and support afterwards, whether you stay with Palo Alto, switch to FortiGate or UniFi, or go to SASE. If you'd rather not deal with firewalls at all, that's what we're here for.