Decommissioning NGFWs is a critical operational process that requires systematic planning and execution to maintain security integrity and proper asset management. When NGFWs reach end-of-life (EoL), undergo replacement, or are removed from service, administrators must follow specific procedures to protect sensitive configuration data, ensure secure data destruction, and properly update licensing and inventory systems.

The Customer Support Portal helps administrators determine which NGFW devices to decommission. For example, you can refer to the Enterprise Agreements dashboard. Select ProductsEnterprise AgreementsEA Consumption Details to get a consolidated view of your registered hardware and total estate cap. If you indicated at the time of purchase that you wish to decommission hardware, there is a 60-day reminder on this page to do so. Another way to identify devices to decommission is to view your EoL devices by selecting ProductsAssets. If you have an EoL device, an End-of-Life Alert is present on the page. From here, you can filter for all EoL devices and plan for their decommissioning.

Two primary decommissioning methods and available to accommodate different operational needs: Single Asset decommissioning for individual NGFW removals, which walks administrators through a step-by-step process for safely retiring a specific device; and Bulk Asset decommissioning for large-scale projects, allowing security teams to efficiently process multiple NGFWs simultaneously when performing data center migrations, hardware refresh cycles, or organizational restructuring. Both approaches ensure that sensitive data is securely erased, support entitlements are properly adjusted, and the NGFWs are completely removed from management systems like Panorama or Strata Cloud Manager, maintaining the integrity of the remaining security infrastructure while properly concluding the asset life cycle.