Risks of having equipment in EOL.

[Matlu]

Hello, team.

A technical question, based on your experiences.

What are the risks of having equipment that is at EOL (End of Life)?

I currently have a state customer, that due to bureaucratic issues, can not for the moment make a technological renovation to their equipment.

The client has Firewalls equipment that are Appliance 12200 model, which according to the Checkpoint portal, are already cataloged as EOL.

Is there a list of considerations that should be taken into account in these cases?

Thank you for your comments.

[Chris_Atkinson · Accepted solution]

My Top 3:

No new security features (old software)

No blade subscription update contracts

No RMA entitlements/garuntee for hardware failure.

Refer also:

https://www.checkpoint.com/support-services/support-life-cycle-policy/

[the_rock]

I would say Chris gave all the valid reasons, for sure. To also add to what he said, while appliance might be EOL, if software running on it is supported and the applince itself also has support, then you could technically open case and get TAC assistance. 12200 support had ended June of 2022, so the best case scenarion could be that either customer has valid support on it and case can be opened, or if they dont and they are on R80.40+, then possible your SE can help facilitate getting support.

Either way, Chris gave you perfect response.

[Bob_Zimmerman · Accepted solution]

Just keep in mind that if they don't schedule hardware replacement, the hardware will eventually schedule it for them as a fun surprise.

From a realistic standpoint, if the processors, RAM, and network cards haven't caused problems by now, they probably won't. The fans, spinning drives, and power supplies are the things which become faulty over time. Of those, the drives can be replaced with off-the-shelf units should the need arise. Just pull the old drive out of the rail, slap a new one in, insert it, and probe the SATA endpoints to force the new drive to be recognized.

I would feel fine running old hardware (e.g, to avoid spending money and time on a datacenter being decommissioned) as long as I had some spare fans and power supplies. If you don't have some spares on hand, get some now so you don't have to panic-buy them later after a failure. Save them from other decoms. Find some on eBay. Whatever. Once you have spare parts, test them. Plan a testing window, pull a part out of the standby member of the cluster, and swap in a spare. Make sure it works.

If you're okay taking on the responsibility of dealing with failed hardware, that just leaves the software. The 12k series refuses to install R81 or newer. This is ultimately another reason I can't stand Check Point's branded boxes. I can upgrade a much older IBM x3650 to R81.10 with no problem. Still, R80.40 can get software support for another year (until January 2024).

[PhoneBoy]

We typically will only support a given Open Server hardware for three years, FYI.
It is also possible to install R81+ on a 12000 series with some mucking about with a config file before FTW runs.
Of course none of these things make these releases officially supported on this hardware.

Regardless, make sure you are working with your Check Point SE on this.
We can extend support on certain EOL hardware/software combinations (albeit with extra cost).

[Bob_Zimmerman]

My point is mostly that I'm okay supporting the old hardware because I have spares. Now that my remaining x3650 cluster is finally off of R67 (upgraded to R77.30, then R80.40 in the span of about a month last year!), CPUSE will happily let me install new, supported software so any bugs I hit can still be fixed.

It's definitely not a good situation, by any means. That said, having the spare hardware on-hand and being able to get software support means it's not even one of my top ten problems right now.

[PhoneBoy]

Where the "unsupported" hardware might come into play is when it comes to fixing hardware-specific bugs (like for NIC drivers).
Assuming you don't run into these issues...