Kerio Control NG720: Support, Renewal and Replacement Planning

Is Kerio Control NG720 still the right appliance to operate?

GFI's current Kerio Control hardware guide identifies the newer NG120, NG320, NG520, NG521 and NG700 appliances. It also continues to document NG720 in support material for installed hardware. That distinction matters: an existing NG720 can require support, renewal and lifecycle planning, but a buyer should not assume that an old model name represents a currently orderable appliance or that there is an automatic like-for-like replacement.

Start with facts from the deployed system: serial number, installed Kerio Control version, current licence and expiry, interface use, WAN design, VLANs, connected users and any high-availability peer. Those details make it possible to separate a routine entitlement renewal from a refresh project that needs port, topology and cutover planning.

• Record the exact appliance model, serial number and software version
• Export and protect the current configuration before a hardware change
• Document physical ports, VLANs, WAN links, DHCP scopes and static routes
• Confirm user-band, Web Filter, antivirus and high-availability requirements

Renew the entitlement before treating the issue as hardware-only

Kerio Control licensing is tied to the deployment and entitlement rather than to a generic firewall search. GFI explains that the base server licence includes an administrator account and ten user accounts, with additional users licensed in groups of five. Review the active user requirement and optional services before selecting a renewal term or expansion.

For an installed NG720, supply the licence number, registered organisation, prior invoice where available, appliance details and expiry date with a renewal request. That gives the supplier enough information to verify whether the requirement is a renewal, a user-band change, a service adjustment or part of a wider migration. The <a href="/guides/kerio-control-license-renewal-guide">Kerio Control licence renewal guide</a> explains the documented registration and offline-update paths.

• Match the renewal to the existing licence and deployment type
• Check user band and optional security services rather than relying on a short SKU title
• Confirm the renewed entitlement in Configuration Assistant after purchase
• Keep the licence record, invoice and renew-before date with the appliance documentation

Plan power recovery as part of appliance resilience

GFI's support guidance includes NG720 among the appliances that can automatically restart when AC power returns, provided the appliance was on when power was lost. It also identifies a different risk with very short interruptions: residual charge can prevent a complete shutdown even though services have become unresponsive. This is a resilience and site-power design issue, not an argument for an untested restart procedure.

For critical sites, use a suitably sized UPS and test the intended recovery procedure during an approved maintenance window. Where a UPS is not practical, GFI documents a managed PDU with an outlet-delay policy as an alternative for short-glitch environments. Record the result of the test and make sure the firewall, upstream handoff and management access all return as expected.

• Protect the appliance with an appropriate UPS where continuity matters
• Test recovery during a planned window, including WAN and remote-management checks
• Do not rely on a brief mains interruption as a routine restart method
• Keep a documented out-of-band or on-site recovery path

Treat replacement as a migration, not a model-name swap

GFI's hardware transition guidance stresses that port layouts can change between appliance generations. A safe refresh therefore starts with the network design: enumerate every physical interface and VLAN, identify which addresses are static or DHCP-assigned, capture routes and policy dependencies, and decide how services will be tested at cutover. A new appliance may need a topology redesign even where the security policy remains broadly the same.

Do not promise a direct successor from the model name alone. The current GFI guide presents NG700 as an enterprise hardware option but does not state that it is the direct successor to NG720. A correct recommendation needs the site's throughput, interface, user, VPN, high-availability and maintenance-window requirements, followed by validation against current manufacturer and distributor availability.

• Capture interfaces, IP addressing, VLANs, routes, DHCP and traffic rules
• Confirm licence-transfer constraints before a hardware purchase
• Stage and test the configuration before the production cutover
• Validate the final hardware choice against current supplier availability and support terms

Get an NG720 renewal or migration request checked by FUSE

FUSE can help turn an NG720 support request into a documented renewal or migration brief. Include the appliance model, licence number, expiry, user count, required security services, port inventory, WAN design, high-availability status and the permitted maintenance window. That prevents a generic product search from becoming an incompatible entitlement or an under-scoped replacement.

For wider security-platform selection, review the <a href="/guides/firewall-buying-guide-eu-smb">EU SMB firewall buying guide</a>. If the immediate task is a licence update rather than a hardware project, start with the <a href="/guides/kerio-control-license-renewal-guide">renewal and activation guide</a>.