Every paid app trials free for 14 days. When the clock runs out, what keeps working, what switches off, and why the gateway never just stops.
New NG Firewall installs light up with possibility: every subscription app offers a 14-day free trial, and an enthusiastic admin can build a setup that silently depends on five of them. Day 15 then arrives like a small betrayal. It does not need to. Arista's model is plain once stated: the platform and a real core of apps are free permanently; the advanced apps are rented. This page lists both sides from Arista's published app model, so you can build on the free floor and trial the paid ceiling with your eyes open.
These apps are free with the platform, not demos: Firewall, Intrusion Prevention, Phish Blocker, Ad Blocker, Captive Portal, OpenVPN and Reports, plus lite monitoring versions of a few paid apps (Web Monitor watches web traffic without blocking; the lite virus and spam blockers cover basic scanning). A small office can run on the free floor indefinitely with real protection — a stateful firewall, exploit prevention, phishing defence and full visibility. What the free floor cannot do is enforce: no category blocking, no per-group policies, no HTTPS inspection, no multi-WAN tricks.
The subscription side is where enforcement and comfort live: Web Filter (category blocking), SSL Inspector, full Virus Blocker and Application Control, Policy Manager, Directory Connector, Bandwidth Control, WAN Balancer and WAN Failover, Threat Prevention, IPsec VPN and WireGuard VPN, plus vendor support. Subscriptions are sold per appliance and sized by the number of devices or users behind it; packaging and prices change over time, so check Arista's store for current figures rather than trusting any number quoted in a video or an old blog — including this one, which deliberately pins none.
When a trial ends, that app stops processing traffic. The behaviour is a graceful step down, not a shutdown: routing continues, free apps continue, and a web rule that existed only inside the expired Web Filter simply stops being enforced — which is why the planning rule matters: never let a trial app become load-bearing without a decision before day 14. The admin interface shows subscription and trial status; put the expiry date in your calendar on the day you start the trial, and hold the subscribe-or-drop decision while the app's own reports are in front of you.
Each step is justified by your own reports, which is the whole advantage of the trial model used honestly.
Watch the rack, the trial options and the configuration on a live install in the full setup video.
▶️ Watch Full VideoIt is a real firewall with intrusion prevention, phishing blocking and reporting, kept updated — a solid posture for a small network. What you give up is enforcement depth: category-based web blocking, per-group policies, HTTPS content inspection and multi-WAN features. For many home labs and tiny offices the free floor is the correct final answer, not a compromise.
Trials are started per app from the interface once the box is registered, so keep a note of what you switched on and when. The surprise only happens when someone trials an app, builds rules inside it, and forgets it. The 14-day trial of each app is generous enough to evaluate properly — use it one app at a time.
Subscriptions are packaged by appliance size and device count, sold through Arista and resellers, and revised over time. Any fixed figure in a third-party video or blog is a snapshot at best. The only current price is the one in Arista's store for your device band — that is why this page names the apps and the model, and no amounts.