Network equipment has a talent for being invisible. A switch that has moved packets faithfully for nine years earns a kind of tenure — nobody wants to touch it, nobody budgets to replace it, and everybody assumes it will keep going. Then it doesn't, at 9 a.m. on invoicing day, and the discovery process begins: the model went end-of-sale six years ago, the replacement doesn't take the same modules, and the config exists nowhere but on the dead box. A deliberate network hardware refresh cycle exists to make sure that morning never happens. Here's what realistic lifespans look like, why the security clock matters more than the hardware clock, and how to plan replacement as a budget line instead of an emergency.

The Two Clocks on Every Device

Every piece of network gear runs on two clocks, and the one people watch is the wrong one.

The hardware clock is physical: capacitors age, fans wear, power supplies drift. Enterprise-grade gear is genuinely durable — switches routinely run a decade-plus — which is exactly what lulls businesses into ignoring the second clock.

The support clock is contractual: the day the vendor stops shipping firmware and security fixes. Vendors publish this openly — end-of-sale, then end of software maintenance, then last day of support (Cisco's policy, for example, typically ends software maintenance a few years after end-of-sale). Past that line, every newly discovered vulnerability in that device is permanent. A firewall that no longer receives security patches isn't a security device anymore; it's a security liability with the right logo. The support clock, not the hardware clock, should drive the refresh schedule — especially for anything that touches the internet.

Realistic Refresh Timelines by Device

Firewalls and security appliances: 4–6 years

The shortest cycle, for two reasons. First, they're the security perimeter — running one past its patch window is the classic unforced error. Second, inspection workloads keep growing: a firewall sized five years ago often can't do deep inspection at today's line rates, so it either becomes the bottleneck or gets its security features quietly turned off, which is worse.

Switches: 6–8 years (with honest exceptions)

Core and distribution switches carrying the whole building deserve the 6–8 year discipline, both for support status and because port speeds move (the 1 Gb access layer that was fine before wireless got fast becomes the ceiling on everything). A dumb access switch serving a warehouse corner can reasonably run longer — if it still gets firmware and someone consciously decided to keep it.

Wireless access points: 4–6 years

Wireless ages fastest because both sides of the link evolve: standards advance (Wi-Fi 6 to Wi-Fi 7), client devices multiply, and density expectations climb. Five-year-old APs are usually the explanation for "the Wi-Fi is slow" long before the internet circuit is.

UPS units: batteries every 3–5 years, chassis ~8–10

The most neglected device in the rack. UPS batteries are consumables — past year three or four, the runtime you think you have and the runtime you actually have are different numbers, discovered during an outage. Put battery replacement on the calendar, not the wish list.

What Sweating Old Gear Actually Costs

Deferring replacement feels free because the costs are diffuse:

  • Unpatchable vulnerabilities on perimeter and management interfaces — the finding that turns audits and insurance questionnaires awkward, and attackers' favorite way in.
  • Performance ceilings that get misdiagnosed for months — the old core switch quietly capping the new internet circuit, the aged APs blamed on the ISP.
  • Emergency-replacement premiums: overnight shipping, rush labor, downtime, and whatever model is in stock rather than the one that fits the design.
  • Knowledge decay: the device nobody dares touch is also the one whose configuration nobody documented. Fragility compounds.

Run the comparison honestly and the planned refresh is almost always cheaper than the unplanned one — before counting the outage itself.

Making It a Cycle Instead of a Crisis

  • Inventory with dates. Every network device, its purchase date, firmware status, and the vendor's published end-of-support date. This is a spreadsheet afternoon (or a report from your monitoring platform) that transforms the conversation from guesswork to schedule.
  • Stagger by risk. Perimeter first, core second, access layer third. A rolling quarter-by-quarter plan replaces a quarter of the estate per year on a 4–8 year cadence — no single-year budget spike.
  • Standardize as you go. Each refresh wave is the chance to converge on fewer models and a common management plane, which cuts both spare-parts complexity and configuration drift.
  • Document at install. Config backup, photos, port maps — captured on day one, when it's trivial, not during the outage, when it's archaeology.
  • Consider the subscription model. For businesses that prefer opex, hardware-as-a-service bakes the refresh cycle into a monthly fee — the discipline arrives built-in.

One more planning signal worth using: support-contract renewal quotes. When the annual maintenance renewal on an aging device starts approaching a meaningful fraction of its replacement cost — a pattern vendors engineer deliberately — the market is telling you the refresh window has opened. Treat that quote as data, not just a bill.

Decommission the Old Gear Properly

Retirement is part of the cycle too. Network devices leave the building full of secrets: configurations with credentials and SNMP strings, VPN pre-shared keys, certificates, and a map of your internal addressing. Wipe configurations and factory-reset before anything leaves your control, revoke any certificates or keys the device held, update the inventory and monitoring so the ghost doesn't linger, and use a reputable e-waste or buyback channel. A firewall config on a secondhand market is a breach you paid someone to haul away.

The Bottom Line

Network gear doesn't announce its retirement; it just stops getting patches, then stops keeping up, then stops. Watch the support clock rather than waiting on the hardware clock, refresh the perimeter fastest, stagger the rest into a rolling budget line, and document as you install. If you'd like your network inventoried against vendor support dates and a refresh plan you can actually budget, our network engineering team builds exactly that. Get in touch before the nine-year-old switch picks its morning.