When should you replace your business router?

Routers do not wear out in a way anyone can see. One bought eight years ago will usually still pass traffic today, with the same lights blinking on the front. That is why they get left in place for so long. The real deadline is set by the manufacturer, and it has nothing to do with whether the box still works.

End of support is the date that matters

A router runs software called firmware. Flaws are found in firmware all the time, and the manufacturer fixes them with updates. At some point the manufacturer stops. This is end of support, sometimes called end of life.

The Australian Signals Directorate (ASD) describes what follows: the device may continue to function, but the risk of a cyber security incident is much higher, because known weaknesses stay unpatched and can be exploited. Its advice is that the best protection is to upgrade to a supported product.

A router is a worse place than most for this to happen. It is what ASD calls an edge device, one that connects the internal network to the internet. Being reachable from the internet is its job, so it cannot be hidden. ASD notes that edge devices are often targeted for that reason. The United States agency CISA is blunter. It says end of support edge devices are trivial for attackers to exploit, and urges every organisation to replace them.

ASD’s guidance includes a case from a small business. An architecture firm found every file on its server renamed, with a ransom note in each folder. The attacker had come in through an open port and a weakness in the server’s outdated firmware. The firmware in that story was on a server, but the lesson carries over to anything on the network that has stopped being updated.

How to find the date

1. Read the model number off the label underneath the router. Note the hardware version too, if one is printed. One model name can cover more than one version.
2. Search the manufacturer’s support site for that model and look for an end of support or end of life notice. ASD advises checking the manufacturer’s website, because every product has its own date.
3. Look at the date of the newest firmware on the download page. If the last release was years ago, treat the device as unsupported even without a notice.
4. Log in to the router and compare the installed firmware with the newest one. Check whether automatic updates are switched on.
5. If the router was supplied by your internet provider, ask the provider whether it is still being updated.

Write the date down where it will be seen again. CISA recommends keeping an inventory of edge devices with their end of support dates, and the first action in ASD’s guidance is to check when your devices will reach that date. With the date on record, the replacement can be planned ahead of the deadline. Do the same for switches, access points and the firewall, if it is a separate box.

Other reasons to replace it

A router can be inside its support period and still be the wrong router. These are fair reasons to move on:

• It cannot update itself. ASD recommends automatic updates wherever they are available. CISA has asked router manufacturers to make automatic updates the default.
• It cannot run a separate guest network. Guest Wi-Fi for visitors is one of ASD’s basic steps for a small business router.
• It does not offer WPA3. The Wi-Fi Alliance makes this security standard mandatory for the products it certifies, so a router without it is from an earlier period.
• Its settings page is exposed to the internet and cannot be closed off. ASD’s advice is that management pages should not be directly reachable from the internet.
• It can no longer keep up. nbn points out that old equipment may not meet what is now being asked of it. If a cabled speed test at the router is well below the plan you pay for, and the provider has ruled out the line, the router is the likely limit.

A new Wi-Fi generation is not on that list. A supported router that does what the business needs can stay.

If you cannot replace it this month

ASD’s tips for unsupported devices start with disconnecting them from the internet, which is the one thing a router cannot do. What remains is reducing what it exposes while the replacement is arranged:

• Turn off remote management from the internet.
• Turn off features and open ports that nobody can explain. ASD recommends reviewing these regularly on any edge device.
• Change the admin password, and make it one that is used nowhere else.
• Set a replacement date and tell someone who will hold you to it.

These steps lower the risk for a few weeks. The flaws in the firmware stay unpatched, so keep to the date.

Replacing it without a bad morning

1. Record the current settings: the internet login from your provider, any fixed addresses, port forwarding rules, VPN details and the Wi-Fi names and passwords.
2. Check what depends on the router. An internet phone system is the usual one. See Replacing an office phone system: what to check first.
3. Choose a replacement with a published support period and automatic updates. ASD advises choosing vendors that offer ongoing support and updates.
4. Swap it outside business hours. Change the default passwords before it is connected to the internet.
5. Keep the same Wi-Fi name and password if they are sound, so devices reconnect without anyone doing anything.
6. Reset the old router to factory settings before it is recycled. ASD recommends wiping business devices before disposal.

If you would like someone else to keep track of this, firmware updates and configuration backups are part of Firewall & Network Security, and recording warranty and support dates for every device is part of Procurement.