Sourcing network firewall appliances from China

Duty and classification for firewall appliances

Heading 8517 covers communications apparatus and its parts. A firewall appliance that receives, converts and transmits network data is a candidate for 8517 62 00 00. The other table rows cover conditional alternatives and separately imported parts, rather than interchangeable codes for a complete firewall. For the wider heading, see Ethernet network switches.

Read from the UK Trade Tariff on 8 December 2026, all supplied lines carry 0% duty for goods from China, with no listed anti-dumping or countervailing duties or suspensions. The table lines have no attached import controls. Elsewhere in the heading, 8517 14 00 00 has a supplementary-unit import entry; if a separately purchased wireless telephone falls there, confirm the declaration requirement with your customs broker. Import VAT is separate.

Give your broker the appliance's routing, filtering and radio functions, together with details of separately packed parts. Confirm the classification through finding your commodity code. The worked order is illustrative; its FOB value and freight are examples, not a quotation. See UK import duty and VAT for the calculation method.

Specify filtering performance and firmware support

Specify network interfaces, routing mode, filtering rules, encrypted tunnel compatibility, logging destinations and administrator access. Agree performance acceptance with the intended inspection features enabled and representative encrypted traffic. Record the processor, memory, storage, interface hardware and firmware build in the approved configuration.

Agree who supplies firmware updates, how updates are authenticated and how configuration backup and recovery work. Identify any subscriptions, feature licences or cloud accounts needed for filtering and management. Test operation when the internet connection or the supplier's cloud service is unavailable, and agree ownership of administrator credentials.

For wired appliances supplied in Great Britain, check the manufacturer's electromagnetic-compatibility conformity assessment and importer identification. The manufacturer must provide relevant instructions in English. For hazardous-substance compliance, confirm manufacturer compliance and retain the declaration of conformity. Match documents to the appliance and supplied adaptor; use testing and certification to arrange document review.

Radio-equipped versions need radio-equipment safety, electromagnetic-compatibility and spectrum checks. Assess whether a model falls within the consumer connectable product-security regime; confirm with the relevant authority whether products within scope require an accompanying statement of compliance. Commercial importers supplying electrical equipment to the UK market have producer responsibilities, including annual registration; confirm with the relevant authority how that producer definition applies when importing solely for your own use.

Worked duty example

Illustrative example, not a quote: Illustrative trial batch of boxed network firewall appliances for a business reseller under 8517 62 00 00, invoiced at £2,000 free on board, with £1,000 of freight and insurance to the UK. The customs value is £3,000. Duty at 0% is £0. Import VAT at 20% is charged on the customs value plus duty, £3,000, so it is £600. With no duty, the only import tax is the VAT, which a VAT-registered importer can usually reclaim. The import duty and VAT guide explains each step.

Inspection checklist

Identity: compare delivered hardware, firmware, serial identifiers, power adaptors and mounting accessories with the approved sample and purchase specification.

Filtering: check permitted and blocked traffic, rule persistence after restart, logging and encrypted tunnel compatibility under the agreed workload.

Recovery and access: check configuration export and restoration, administrator credential changes, firmware update and rollback arrangements, and recovery after power or connection loss.

Documents and construction: match conformity documents to the delivered model; inspect interface sockets, cooling, enclosure assembly and instructions. Record acceptance checks in a quality inspection brief.

What goes wrong

A headline throughput claim may describe basic forwarding with security inspection disabled. Enabling filtering, encrypted tunnels and logging can expose a configuration that fails the buyer's workload. Test these functions together and record the settings, traffic mix and firmware used for acceptance.

A substituted interface controller can disrupt software compatibility, while an expired licence can remove expected filtering features. Cloud-dependent management and inaccessible administrator accounts can prevent deployment. Require approval before component or firmware substitutions, and agree licence ownership, update access and recovery procedures before ordering.

Cambridge China Bridge sources these products for UK businesses, checking the factory and the documents before shipment. See factory verification. For components and parts, see sourcing for manufacturers.