Reference
Firewall license renewals, vendor by vendor
Each vendor handles expiration, grace periods, late renewals, and co-terming differently. These pages collect what the vendors themselves document, with the sources linked, so you can answer the question before the client asks it.
WatchGuard
Firebox
Basic vs Total Security Suite, what stops working the day a Firebox license expires, the six-month back-dating rule, reinstatement fees, co-terming, end-of-life dates for T-series and M-series, and where the expiration date lives.
Read the WatchGuard pageFortinet
FortiGate
ATP, UTP, and Enterprise bundles, what keeps working and what stops when FortiGuard expires, why web filtering drops all traffic by default, the six-month back-dating rule, co-term quotes, end-of-order dates for the F-series, and where the expiration date lives.
Read the Fortinet pageSonicWall
TZ and NSa
Essential, Advanced, and Managed Protection suites, what SonicWall actually documents about expiry (and the TZ80 exception), retroactive activation and the reinstatement fee, free co-termination in MySonicWall, the six-phase product lifecycle, and where the expiration date lives.
Read the SonicWall pageSophos
Sophos Firewall (XGS)
Xstream vs Standard Protection, what stops module by module when a Sophos Firewall subscription expires, the three-free-firmware rule, the Sophos Central requirement since March 2025, renewal start-date rules, XG and XGS lifecycle dates, and where the expiration date lives.
Read the Sophos pageCisco Meraki
MX, MR, and MS
Co-termination vs per-device licensing, the 30-day grace period and what shuts down after it, why late renewals get no back-dating, the co-term averaging math, MX edition differences, end-of-support dates, and the exact email warning schedule.
Read the Cisco Meraki pagePalo Alto Networks
PA-Series
Threat Prevention, Advanced URL Filtering, WildFire, DNS Security and the Core Security bundle, exactly what freezes and what keeps working when a PA-Series subscription expires, why support renewals never get a gap, co-term by quote date, end-of-life dates for the PA-220, PA-800, and PA-3200, and where the expiration date lives.
Read the Palo Alto Networks page
Any device with a renewal date can be tracked in MSP Renewals, including Dell, HPE, and Lenovo hardware support contracts. These reference pages cover the security-license vendors where expiration behavior is the most consequential.