Hi everyone. I wanted to share a recent move our team made that’s had a huge impact on our budget and, surprisingly, on our operational clarity.
We were running a pair of Sophos XG 230 appliances in HA for our main office edge and site-to-site VPNs. The hardware was fine, but the annual support/licensing renewal was painful—over $12k. We're a mid-sized shop, and that's a significant line item. After a feature audit, we realized we were barely using 20% of the "next-gen" features (mostly basic firewall rules, IPSec VPNs, and some basic traffic shaping). The web filtering and advanced threat modules weren't being used due to performance hits and complexity.
So, we took a leap. We replaced them with two custom-built boxes (standard 1U servers with Intel NICs) running a hardened Linux distro and `iptables` (yes, we know about `nftables`—we have a migration plan). We paired it with `strongSwan` for IPSec and some custom scripts for monitoring and failover. The total upfront hardware cost was under $4k for *both* units, and our ongoing costs are now just electricity and a fraction of a sysadmin's time.
The result? An 80% reduction in annual firewall costs. More importantly, we now have:
* Complete transparency into every rule and connection.
* No more guessing about "datasheet vs. reality" throughput—we can profile and scale each component independently.
* Scriptable configurations that integrate with our existing CI/CD pipeline for network changes.
Has anyone else gone through a similar "decommercialization" for edge firewalls? I'm particularly curious about:
* Your experience with long-term maintenance overhead vs. a vendor support contract.
* Real-world HA failover performance with a roll-your-own setup.
* Whether you reintroduced any specific UTM features (like a standalone web filter) later on.
We're compiling a case study for our internal finance team, and anecdotal benchmarks from this community would be invaluable.
Best, Julie