NG Firewall: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product
Owner: Arista Networks, Inc. (US, public); acquired Untangle during 2022 per Arista's FY2022 Form 10-K, date and price not disclosed; the product was renamed Arista NG Firewall within Edge Threat Management
Engine: GPL-2.0 core (untangle/ngfw_src on GitHub) on Debian with netfilter; the paid apps are proprietary
Licence: Core GPL-2.0; apps licensed per server in bands by active device count, on monthly, 1 year or 3 year terms; Lite Package apps are free without expiry; 30 day trial of paid apps, then NG Firewall Free basic features; no public price list (a third-party listing shows from $270 per year for up to 12 devices, unverified)
Latest release: 17.5.0 (GitHub tag 2026-07-17; a 17.5 beta was announced 2026-05-29 and GA status is not confirmed); 17.4.1 tagged 2026-01-29
Support lifecycle: No published support window or end-of-life dates found; in-place upgrades from the Upgrades page; 32-bit upgrades ended at 16.1
Next milestone: none published
Security record: 0 CISA KEV entries since 2023 (catalogue checked 2026-10-15; Arista's 2026 entries concern VeloCloud and EOS, not NG Firewall); no NG Firewall advisory page found; 17.5 patches CVE-2024-47175
Hypervisors: VMware OVA (ESXi 6.5 Update 3 or newer, promiscuous mode on the vSwitch) and an x86 ISO for any machine with two NICs; cloud appliances on AWS and Azure; Proxmox VE, KVM, Hyper-V, XCP-ng and GCP not documented; no ARM build
Tier: Small office and prosumer
Archetype: Slow follower
Evidence grade: C. The installation and VMware pages, the FAQ on licensing, the Dynamic Routing page, the GitHub repository and tags, Arista's FY2022 Form 10-K and the CISA catalogue were read from primary sources. The Arista release history article returned 403, the release highlights page is undated and stops at 17.0, and the 17.5 contents come from a search summary. Release dates for 15.0, 16.0 and 17.0 are therefore placed by year from the product history and flagged. Pricing, the support window, the API and the backup documentation were not verified.

Scorecard

Dimension	Score	Direction
Capability today	63.4 / 100	higher is better
Momentum since end of 2022	+0.0 points (2015 to 2022: +6.2)	higher is better
Credibility	11.0 / 25	higher is better
Commercial risk	12.0 / 25	lower is better
Technical lock-in	9.5 / 25	lower is better
Integrator fit	7.5 / 20	higher is better
AI leverage	0.5 / 20	higher is better
Ledger Index	46.4 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	2.5	2.5	3	3
Firewall and NAT core (12)	3.5	3.5	3.5	3.5
VPN and remote access (12)	3	3	3.5	3.5
Threat protection (12)	3.5	3.5	4	4
Network services (8)	3.5	3.5	3.5	3.5
Platform and hypervisor freedom (10)	2	2.5	2.5	2.5
High availability and performance (8)	1.5	1.5	1.5	1.5
Management, API and automation (10)	3	3.5	3.5	3.5
Observability (6)	3.5	3.5	4	4
Platform security and lifecycle (10)	2.5	2.5	2.5	2.5
Total / 100	57.2	59.2	63.4	63.4

Year by year: 2015: 57.2 · 2016: 57.2 · 2017: 58.2 · 2018: 58.2 · 2019: 59.2 · 2020: 62.2 · 2021: 62.2 · 2022: 63.4 · 2023: 63.4 · 2024: 63.4 · 2025: 63.4 · 2026: 63.4

What moved the score

Year	Domain	Change	Points	Trigger
2017	Management, API and automation	3 → 3.5	+1.0	Command Center, now ETM Dashboard: central management, policy templates and remote appliance deployment (launch year not sourced; placed at 2017); no Terraform or Ansible content; 17.5 reworks the Network and System admin screens
2019	Platform and hypervisor freedom	2 → 2.5	+1.0	AWS and Azure cloud appliances (introduction year not sourced; placed at 2019); UEFI support in 16.0; VMware remains the only documented hypervisor, Proxmox VE, KVM, Hyper-V and XCP-ng are absent from the installation pages
2020	Observability	3.5 → 4	+0.6	15.0: alert rules on report events (release year not sourced; placed at 2020); no NetFlow export or Grafana integration found
2020	Threat protection	3.5 → 4	+1.2	15.0: Threat Prevention app with Webroot BrightCloud reputation scores in the Complete bundle (release year not sourced; placed at 2020); 17.5 adds a Dynamic Blocklists app (GA unconfirmed); no sandboxing or file detonation
2020	VPN and remote access	3 → 3.5	+1.2	16.0: WireGuard VPN Connect app in the Complete bundle (release year not sourced; placed at 2020); 17.4 adds DNS per WireGuard roaming profile; no MFA on VPN logins, no ZTNA client
2022	Routing and WAN	2.5 → 3	+1.2	BGP and OSPF documented on the Dynamic Routing page (introduction release not stated, page last edited 2024-09-12; placed at 2022); no VRFs, no probe-based path selection beyond WAN failover tests

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2025-10	17.4: DNS per WireGuard roaming client profile (changelog page created 2025-10-21)	VPN	C
2026-01	17.4.1: GRUB installation fix on Protectli hardware	Platform	C
2026-05	17.5 beta announced with the Dynamic Blocklists app	Threat protection	C
2026-07	17.5.0 tagged: Dynamic Blocklists app (GA status unconfirmed)	Threat protection	C
2026-07	17.5: updated Network and System administration screens	Management and API	C
2026-07	17.5: UPnP removed; patch for CVE-2024-47175	Security and lifecycle	U
2026-07	17.5: OpenVPN cipher configuration changed	VPN	U

Centre of gravity: VPN (2), Threat protection (2), Platform (1)
Blind spots (no items): Routing, Firewall core, Network services, High availability, Observability, Packaging, Licensing, AI
Driver mix: Vision 0%, Customer need 71%, Market window 0%, Upstream 29%, Portfolio 0%
Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 11.0 / 25

Criterion	Score	Basis
Cadence	2	About two tagged releases a year on an irregular rhythm (17.4.1 on 2026-01-29, 17.5.0 on 2026-07-17); no schedule
Roadmap transparency	1.5	No roadmap; the release highlights page stops at 17.0 and the release history article is not publicly readable; the wiki is public
Say-do	2.5	Little is announced; the 17.5 beta of 2026-05-29 was tagged seven weeks later, though its GA status is not confirmed
Velocity	2.5	One substantive item per release (per-profile DNS in 17.4, Dynamic Blocklists in 17.5) plus maintenance
Lifecycle stability	2.5	In-place upgrades and a long version line; renamed after the 2022 acquisition, 32-bit dropped at 16.1, and no published support windows

Commercial risk: 12.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	No change documented since 2023; no public price list to track
Purchase constraints	2.5	Paid apps are subscription only, per server and per device band; the Lite apps and NG Firewall Free have no expiry
Channel and access	2.5	Direct and reseller sales; downloads through the ETM portal with an account; partner programme terms not found; the core source is public
Owner stability	2.5	Large public owner since 2022, but the product is a small line inside Arista and its public release page has not been updated since 17.0
Cost of staying supported	3	Paid apps stop working without a current subscription; platform upgrades are in place

Technical lock-in: 9.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	Configuration in a database exported as a backup file
Export path	3	Backup files restore only to NG Firewall; migration to another firewall is manual
Stack coupling	1	Runs alone; the ETM Dashboard is optional
Hardware / cloud coupling	1	Any x86 machine, VMware, AWS or Azure; paid apps check their licence online
Skills and tooling coupling	2	App-based web administration specific to the product on a Debian base

Integrator fit: 7.5 / 20

Criterion	Score	Basis
Partner programme openness	2.5	Reseller channel exists; programme terms were not found
Multi-tenancy and self-service	2.5	ETM Dashboard manages many appliances with templates (vendor claim); no multi-tenant separation documented
API and infrastructure-as-code	1	JSON-RPC API not verified; no Terraform or Ansible content
Skills and certification	1.5	Wiki documentation and forum; no certification track found

AI leverage: 0.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	0	0	0	2015: None; Threat Prevention uses a reputation feed that the vendor does not describe as AI
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	0.5	0.5	0.5	2015: A JSON-RPC administration API is reported but was not verified; no MCP server found

Year by year: 2015: 0.5 · 2016: 0.5 · 2017: 0.5 · 2018: 0.5 · 2019: 0.5 · 2020: 0.5 · 2021: 0.5 · 2022: 0.5 · 2023: 0.5 · 2024: 0.5 · 2025: 0.5 · 2026: 0.5

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items were announced from 2023 to 2026.

NG Firewall ships no AI features and announces none. Its threat scoring comes from a third-party reputation feed, and agent access depends on an API the research could not verify.

Reading

NG Firewall scores well on the things Untangle built a decade ago: layer 7 application control, identity-based rules, TLS inspection, a reputation feed and reports that most small office firewalls lack. It scores badly on everything that needs a public record, because Arista publishes no roadmap, no support windows, no advisory page and no readable release history, and the latest release highlights page still describes 17.0. The hypervisor story is the practical limit for this Ledger's readers: VMware is the only documented hypervisor and Proxmox VE, KVM and Hyper-V are not mentioned on the installation pages. The one thing a buyer should check is whether 17.5.0 is a general release or still a beta, and what the per-server subscription costs for their device count, since neither is published.

Open questions and items to re-score

Release dates for 15.0, 16.0, 17.0 and 17.4 were not found because the Arista release history article is not publicly readable; the 2017, 2019, 2020 and 2022 steps are placed by year and should be checked.
Whether 17.5.0 (tagged 2026-07-17) is a general release; a beta was announced on 2026-05-29.
Support window and end-of-life policy.
Public prices for the paid apps and the ETM Dashboard; the $270 per year figure comes from a third-party listing.
Whether a JSON-RPC API is documented and supported.
Configuration backup and restore documentation was not read from a fetched page.
Whether Proxmox VE, KVM or Hyper-V are supported in practice; only VMware, AWS and Azure are documented.
The introduction release of BGP and OSPF; the Dynamic Routing page does not say.
No release items were found for 2023 and 2024, so the direction list covers late 2025 and 2026 only.

	’17	’19	’20	’22
Routing and WAN				1
Firewall and NAT core
VPN and remote access			1
Threat protection			2
Network services
Platform and hypervisor freedom		1
High availability and performance
Management, API and automation	1
Observability			3
Platform security and lifecycle