Firewall Licences Explained: What You Pay for Each Year

A firewall is bought in two parts: the hardware, once, and a subscription that keeps its protection current. The subscription is where most of the cost over five years sits, so it is worth understanding.

What the hardware does on its own

Without a subscription, a firewall still controls which traffic may pass, translates addresses and, on most brands, runs VPNs. What it cannot do is recognise new threats, because nothing is telling it what they look like.

What the subscription adds

• Intrusion prevention signatures, updated as new attacks appear
• Anti-malware scanning and, in larger bundles, sandboxing of unknown files
• Web filtering by category
• Firmware updates and security fixes
• Manufacturer support and replacement of failed hardware

Bundles

Each manufacturer groups these services into bundles: Fortinet's FortiGuard bundles, Sophos Standard and Xstream Protection, SonicWall's security suites, and individual subscriptions from Palo Alto Networks and Juniper. A larger bundle costs more and adds services such as sandboxing or data-loss prevention.

Terms

Subscriptions are sold for one, three or five years. Longer terms cost less per year and remove the risk of a lapse. A term should not run past the date the manufacturer stops supporting the hardware.

When it expires

The firewall keeps passing traffic, which is why lapses go unnoticed. But signatures stop updating, firmware fixes stop, and if the unit fails there is no replacement. Within months it is noticeably less effective than the day it was bought.

Common questions