Expired Subscriptions

morpheus27

I'm currently using XTM330 with fireware version 12.1. Our subscription will expire in early 2020 and I believe we can no longer renew the license. We must replace our XTM330 with a newer hardware + whatever subscription it comes with.

My question is, what will happen when our current subscription expires in 2020? Do I expect things to break (for example, unable to access the internet)?

greggmh123

All of the UTM services will stop working, but the box will function. Probably the biggest gotcha is if you have it set to Deny when WebBlocker is not available. That will stop Internet access, but you can change the setting prior to the expiration and not be interrupted.

Bruce_Briggs

Basic firewall functions will continue to work, but any security subscriptions will not.

What happens when security service subscriptions expire?
https://watchguardsupport.secure.force.com/publicKB?type=KBArticle&SFDCID=kA2A00000000FkzKAE&lang=en_US

EoL ,and thus no extensions on Security subscriptions for an XTM 330 is 07 Sep 2020.
https://www.watchguard.com/wgrd-resource-center/end-of-life-policy

morpheus27

Thanks, Gregg and Bruce.

So if I change the rule (for example) from "AV Scan (default)" to "Allow (default)", it should continue to work, correct?

Thanks also for the link (EoL Policy). It's weird that when I renewed the subscription earlier this year, the seller said that I can only renew for 1 year which will end in early 2020.

Bruce_Briggs

Yes on changing a policy to remove an AV scan. Do this just prior to the end of your subscription.

I'm not aware of how you can get a subscription extension for a part of a year.
You can contact Customer Care to see what your options are related to that, if any.

To contact Customer Care:
1) you can do this on the support portal - use the Support Center link above
2) by the following form
https://www.watchguard.com/wgrd-support/my-watchguard-assistance
3) or by phone
877.232.3531 option 1 or +1.206.613.0456 International

morpheus27

I've done that already. The reseller recommends a trade-up to Firebox M270. I may do that later this year or resort to changing firewall rules if management decides to keep the XTM330. Thanks again.

greggmh123

"So if I change the rule (for example) from "AV Scan (default)" to "Allow (default)", it should continue to work, correct?"

No. When it expires, you will have to remove the GAV settings altogether. What I tried(!) to refer to was the setting in Policy Manager for an HTTP proxy for WebBlocker. It's on the WebBlocker settings on the Advanced tab: set , and the "When the WebBlocker license expires, access to all sites is" and set that to Allowed.

Otherwise, it will stop all web browsing.

greggmh123

With the new features available that the XTM 330 cannot do, I recommend a trade-up!

Bruce_Briggs

Gregg said: When it expires, you will have to remove the GAV settings altogether.

To do this:
On a HTTP proxy action -> Gateway AV -> unselect "Enable Gateway Antivirus"

If you have multiple policies with GAV enabled, the easier way is to go to Subscription Services -> Gateway Antivirus -> Configure, and select each policy that is set to Enabled and click the Disable button.

morpheus27

Thanks again to you both for the help. I hope a trade-up to M270 will be approved but now I know what to do if I end up using XTM330.

One last question, will I be able to "migrate" the rules from XTM330 to M270?

Bruce_Briggs

Absolutely.

Move a Configuration to a New Firebox
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/basicadmin/config_file_use_new_model_wsm.html