Replacing an end-of-life industrial firewall is a decision best made on deployment model, protocol coverage, policy-creation method, certifications, and licensing terms, not on brand name alone. These five factors determine whether a replacement preserves the network architecture already in place, protects the specific industrial devices running, and fits the compliance and budget requirements of the environment. A vendor's suggested successor is a reasonable starting point for research, not a substitute for running it through this checklist.
Key Takeaways
- Deployment model determines how much of the network you have to redesign. A transparent, inline firewall with no IP address preserves existing addressing; a routed firewall changes it.
- Protocol support has to match your environment, not a vendor's master list. Some vendors gate specific protocol families behind separate, mutually exclusive licensing tiers, so confirm exactly which SKU is being quoted.
- How policy gets created matters as much as what the firewall blocks. A firewall that can observe live traffic and draft a policy baseline using machine learning, avoids the common failure mode of rules written against an outdated network diagram.
- Certifications vary by specific model, not just by vendor. A vendor's flagship certifications, such as IEC 61850-3 for substations, do not automatically apply to every hardware model in that vendor's lineup.
- "Supports compliance" and "is certified" are different claims. Most industrial firewalls are not independently certified under frameworks like IEC 62443 or NERC CIP as a device; they support the segmentation and logging those frameworks require. Treat a device-certification claim for either framework as a red flag worth verifying directly.
Start with Deployment Model, Not Brand Name
An industrial firewall deploys one of two ways, and the choice affects how much of the existing network has to change. A transparent, inline device sits in the traffic path with no IP address of its own, which preserves the addressing and routing already in place. A routed device has its own IP address and participates in the network layer directly, which can add capability but also adds redesign work.
Neither model is universally better. A transparent deployment minimizes the migration footprint, which matters most when replacing a firewall that has been in place for years, such as a Belden's Tofino Xenon. A routed deployment can offer more flexibility for new-build environments where the network is being designed around the firewall rather than the other way around.
Match Protocol Coverage to Your Actual Environment
Deep packet inspection for industrial protocols, such as Modbus, DNP3, EtherNet/IP, and IEC 61850, is what separates an industrial firewall from a generic network firewall applied to an OT network. The relevant question is not how many protocols a vendor lists, but whether the specific protocols running in the environment are covered under the SKU being quoted.
- Ask for the protocol list by SKU, not by product family. Some vendors license protocol families, such as a general-purpose set versus a vendor-specific set like GE protocols, as separate, mutually exclusive options enforced in firmware.
- Confirm whether inspection extends to encrypted tunnels. If the environment uses IPsec or OpenVPN for vendor access or multi-site connectivity, ask specifically whether protocol inspection applies inside those tunnels or only to unencrypted traffic. Get this in writing rather than assuming it from a feature list.
Evaluate How Security Policy Gets Created and Maintained
The most common reason industrial firewalls end up in monitor-only mode indefinitely is that nobody has a confident, current picture of what legitimate traffic looks like. Two approaches solve this differently.
- Manual policy authoring requires someone to write firewall rules against a network diagram, which is accurate on the day it's written and drifts from reality afterward.
- Learning or behavioral-baseline modes observe live traffic over a defined window and draft policy from what is running, then flag deviations from that baseline going forward. This shortens the path from installation to active enforcement.
Confirm Certifications Against Your Specific Vertical and Model
Certifications are earned per hardware model, not inherited across a vendor's entire lineup. A vendor's highest-end model may carry a certification, such as IEC 61850-3 or IEEE 1613 for substation and electric utility environments, that a smaller or lower-port-count model in the same family does not. Always check the datasheet for the exact model under consideration.
Vertical / Requirement | Certification to Confirm | Why It Matters |
Electric utility substations | IEC 61850-3, IEEE 1613 | Governs electromagnetic compatibility and environmental tolerance for substation equipment |
Hazardous or classified locations | C1D2 | Required for deployment in environments with combustible gas or dust risk |
General hardware certifications | CE, FCC | Baseline reliability expectations for uncontrolled industrial environments |
Industrial Cybersecurity | IEC 62443-4-2 (SL2, SL3) | Independently verifies the firewall's security capabilities and the vendor's secure development process rather than relying on self-declaration |
"Supports Compliance" Is Not the Same Claim as "Is Certified"
Frameworks such as IEC 62443 and NERC CIP govern organizational programs and system architecture, not a single device in isolation, so most industrial firewalls are not independently certified under either framework as a standalone product. A firewall can support the segmentation, access control, and audit logging these frameworks require without being itself "IEC 62443 certified" or "NERC CIP certified." If a vendor makes that specific certification claim for the device itself, ask what body issued it and for what scope.
Understand the Licensing and Ownership Model
Industrial firewalls are sold under multiple licensing structures: perpetual appliances (one-time hardware cost), subscription renewals (recurring fees), feature-based (protocol or capability add-ons), throughput-based (bandwidth tiers), protocol-based (per-protocol licensing), and central management licensing (multi-site visibility platforms). Each model affects total cost of ownership differently over the device's service life. Switching from perpetual to subscription, or layering in feature, throughput, or management licensing, introduces ongoing budget obligations that are worth understanding explicitly during evaluation rather than discovering during implementation or renewal.
Plan for Centralized Management Across Multiple Sites
A replacement that requires logging into each device individually does not scale past a handful of sites. Centralized management, whether hosted on-premises or in the cloud, should be able to distribute policy, collect status, and support reporting across every deployed unit from one place.
Ask for a Contained Pilot Before an Estate-Wide Commitment
A single-zone pilot, run in monitor mode before enforcement, with defined success criteria agreed in advance, reduces the risk of an architecture change causing unplanned downtime. Estate-wide replacement is a second conversation, not the first one.
A Replacement Evaluation Checklist
- Deployment model: transparent/inline or routed, and which one preserves your existing network architecture
- Protocol coverage: confirmed against your actual environment and the specific SKU being quoted, not a general product-family list
- Policy-creation method: manual rule authoring or a learning/behavioral baseline
- Certifications: verified for the exact model under consideration, not assumed from the vendor's flagship product
- Compliance language: "supports" a framework's requirements versus an unverified device-certification claim
- Licensing model: perpetual appliance or subscription, and the total cost of ownership each implies
- Centralized management: policy distribution and reporting across every site from one place
- Pilot scope: a single-zone, monitor-mode proof of concept with agreed success criteria before any estate-wide decision
How MetaDefender Industrial Firewall Applies to This Checklist
MetaDefender Industrial Firewall™ is OPSWAT's industrial firewall for OT networks, built for operational technology and cyber-physical systems rather than adapted from an IT product. Against the checklist above: it supports both transparent, inline deployment and routed deployment; its Learning Mode drafts security policy from observed traffic rather than requiring a manual rule set; it is available in four-port and eight-port hardware, with the eight-port model carrying IEC 61850-3 and IEEE 1613 for substation and electric utility use; and it integrates with My OPSWAT™ Central Management for policy and reporting across multiple sites. It supports network segmentation aligned with IEC 62443 and NERC CIP requirements, consistent with the compliance distinction above: that is a support claim, not a device-certification claim. And is C1D2 certified for harsh environments.
Run your own replacement evaluation against this checklist, then see how MetaDefender Industrial Firewall maps to it for your specific environment.
Frequently Asked Questions
What's the difference between a transparent and a routed industrial firewall deployment?
A transparent, inline firewall is essentially a Layer 2 bridge that has no IP address and sits directly in the traffic path, which preserves existing network addressing. A routed firewall operates as a Layer 3 device. It has its own IP address and participates in the network layer, which can add capability but requires more network redesign to deploy.
Does an industrial firewall need to be IEC 62443 or NERC CIP certified?
Most industrial firewalls are not independently certified under either framework as a standalone device, because both frameworks govern organizational programs and system architecture rather than a single product. Look for a firewall that supports the segmentation and audit requirements those frameworks call for and treat an unqualified device-certification claim as something to verify directly.
Why does it matter how an industrial firewall creates its security policy?
A firewall that requires rules to be written manually against a network diagram is only as accurate as that diagram, which tends to go stale. A firewall that can observe live traffic and draft a policy baseline shortens the path from installation to active enforcement and reflects what is running.
Why do certifications vary between models from the same vendor?
Certifications such as IEC 61850-3 or IEEE 1613 are earned and published per hardware model, not inherited across an entire product family. A vendor's highest-end model may carry a certification that a smaller or lower-port-count model in the same lineup does not, so the specific model under consideration needs to be checked against its own datasheet.
How long should a pilot deployment run before a full rollout?
Long enough to observe a representative range of normal operations, run in monitor mode with defined success criteria agreed in advance, confined to a single zone. The goal is confidence in the policy baseline before enforcement, not a fixed number of days.
Does the licensing model affect total cost of ownership?
Yes. A perpetual appliance is a one-time hardware cost with optional support renewals, while a subscription model bundles licensing into recurring payments. Neither is inherently cheaper; the right comparison depends on the device's expected service life and how the organization budgets for capital versus recurring expense.
