What “DrayTek router replacement” should mean in a production network

Router replacement is not a port-for-port hardware swap. In a working business network the edge device is usually carrying several responsibilities at once: terminating an Etisalat by e& or du Internet circuit, maintaining static routes or policy routes, providing DHCP, translating internal addresses, publishing servers, prioritising voice, establishing IPsec tunnels, allowing remote users to connect, separating guest and corporate traffic, and sometimes acting as the first or only security boundary. Replacing the appliance without documenting those functions can create outages that appear unrelated to the router, including phones that register but have one-way audio, CCTV recorders that become unreachable, payment terminals that lose cloud access, branch applications that time out, or public services that work from outside but fail internally because NAT reflection changed.

FourTeck treats the project as an edge-network migration. The existing DrayTek configuration is converted into a functional requirement list, then the target platform is selected and configured against that list. The target may be a newer DrayTek platform where routing and VPN remain the main requirement, or it may be a next-generation firewall where the business needs stronger application control, threat prevention, identity-aware policy, SD-WAN, central logging or security subscriptions. For organisations already standardising on Fortinet, the FourTeck Fortinet UAE practice can align the replacement with FortiGate, switching, wireless and central management requirements. For broader infrastructure integration, FourTeck IT Services UAE supports network, server and endpoint dependencies that often sit behind the edge device.

The result should be a migration with a clear source-of-truth configuration, a rollback point, documented addressing and policies, validated business applications, and an architecture that has enough performance headroom for real traffic rather than laboratory headline throughput alone.

Common reasons UAE organisations replace an existing DrayTek router

The trigger is therefore less important than the baseline. Before recommending a replacement, FourTeck identifies what the current DrayTek actually does. That protects business continuity and prevents an apparently successful Internet test from masking missing functions.

Technical discovery: the baseline that drives correct replacement sizing

A production replacement starts with a configuration and traffic inventory. The existing model number is useful, but it is not enough. Two sites using the same DrayTek can have very different demands: one may be a simple broadband gateway with twenty clients, while another may carry multiple tagged VLANs, 150 phones and computers, two site-to-site VPNs, inbound services and policy-based routing. The same replacement model would not automatically be appropriate for both.

Traffic data adds another layer. We look for peak WAN utilisation, session count, upload-heavy applications, IPsec volume, packet loss, jitter, latency, high-availability expectations and growth. Sizing against the average can be misleading because edge devices must survive bursts, security inspection and failure conditions when traffic from one circuit shifts to another.

Understanding the DrayTek baseline before choosing the successor

DrayTek’s router portfolio spans home-office, small-business and higher-performance VPN concentrator use cases, so “replace a DrayTek” does not identify one performance class. Current and recent Vigor families illustrate the spread. A Vigor2866-class appliance combines DSL and Ethernet WAN options for smaller sites; a Vigor2962-class appliance moves into multi-gigabit routing with a 2.5GbE interface and higher VPN/session capacity; the Vigor3912 class is a substantially larger platform with 10GbE interfaces and hundreds of VPN tunnels. These figures are manufacturer maximums under defined test conditions and should be treated as reference points rather than guaranteed production throughput.

The practical lesson is that replacement is a workload-matching exercise. It is possible to replace a small DrayTek with a much more capable firewall, but it is also possible to accidentally downgrade a high-end Vigor deployment by choosing a security appliance whose inspected throughput, interface density or VPN limits are below the real requirement. FourTeck therefore separates port speed, routing throughput, VPN throughput, session capacity and security-services throughput during sizing.

Three replacement paths: refresh, security upgrade or edge redesign

There is no requirement to change vendor simply because a DrayTek is being replaced. The correct path depends on operational priorities. We normally frame the decision around three architectures, then select a specific platform only after the network has been measured.

Performance sizing: why interface speed is only the first number

A replacement appliance with a 1GbE, 2.5GbE or 10GbE port is not automatically capable of processing traffic at that rate with every service enabled. Interface bandwidth is a physical limit; processing throughput is a system limit. Router and firewall datasheets typically publish several performance figures because packet forwarding, stateful firewalling, IPsec encryption, intrusion prevention and full threat inspection impose different workloads. A credible design identifies the workload that matters, applies headroom, and then checks the relevant vendor test metric.

For a simple Internet edge, baseline routing/NAT throughput and session capacity may be the primary factors. For a site with branch VPN, IPsec throughput and tunnel limits matter. For an NGFW replacement, the relevant security profile should be modelled against threat-protection or enterprise-mix figures rather than raw firewall throughput. SSL/TLS inspection can be particularly demanding because the appliance must establish, decrypt, inspect and re-encrypt sessions. The exact impact depends on cipher suites, object sizes, session rates and feature profile.

FourTeck also distinguishes packets per second from megabits per second where relevant. A stream of large backup packets and a burst of many small voice, DNS or transactional packets can have similar bandwidth but very different processing characteristics. Large offices, hospitality, call centres and retail environments can therefore require more packet-processing headroom than a simple speed test suggests.

Packet-processing architecture: CPU, acceleration and security processors

Replacement platforms process traffic in different ways. Some rely mainly on a general-purpose or embedded multi-core CPU with software optimisation and hardware acceleration for selected forwarding tasks. Others use dedicated network, content or security processors to offload portions of packet forwarding, encryption or inspection. The architecture matters because the same nominal interface count can sit behind very different processing capability.

DrayTek publishes hardware-acceleration and software-acceleration information on selected models, which is a reminder that feature path matters. When a feature forces packets away from an accelerated path, real throughput may differ from the headline forwarding figure. Similarly, FortiGate platforms may use model-specific Security Processing Unit components and acceleration paths. The engineering task is not to choose a platform because it has an ASIC; it is to confirm that the traffic features required by this network can use the acceleration architecture and that the published security throughput is appropriate for the expected load.

For a DrayTek replacement proposal, FourTeck records whether the network needs straightforward NAT, heavy inter-VLAN routing, many IPsec tunnels, encrypted web inspection, IPS, traffic shaping or dynamic routing, then maps those functions to vendor sizing data. That avoids two common mistakes: overpaying for physical port speed that the security stack cannot sustain, and buying a low-cost appliance that reaches high raw throughput only when the very features driving the replacement are disabled.

Port mapping and physical handoff design

Every cable on the current router needs a destination on the replacement. A typical DrayTek edge may have one Ethernet WAN, an integrated DSL interface, a second WAN, several LAN ports, an SFP interface, a USB cellular modem or switch uplinks carrying multiple VLANs. The migration plan labels the physical connections and also documents their logical role. A port described only as “LAN 2” is not enough; we need to know whether it is an access port for a flat subnet, an 802.1Q trunk to a managed switch, a dedicated voice uplink, a DMZ segment or an isolated management connection.

Interface speed and media must also line up. A provider circuit handed off as copper Gigabit Ethernet can connect very differently from an SFP/SFP+ optical handoff. Multi-gigabit circuits may require 2.5GbE, 5GbE or 10GbE interfaces to avoid an artificial bottleneck. If the firewall has limited high-speed ports, we decide which should be allocated to WAN, core LAN, HA or switch aggregation before procurement. Transceiver type, fibre mode, connector, supported optics and provider demarcation need explicit validation.

Integrated DSL creates a special case. If the current DrayTek terminates VDSL/ADSL/G.fast directly, an NGFW replacement may need the carrier modem or an independent modem/bridge to convert the circuit to Ethernet. That changes the demarcation and possibly PPPoE ownership. The migration plan states where authentication, VLAN tagging and public addressing will terminate after the change so troubleshooting remains clear.

Dual WAN, failover and SD-WAN replacement design

DrayTek routers are widely used in dual-WAN environments because policy routing, load balancing and failover are practical SMB requirements. A replacement should preserve the business intent rather than merely recreate interface priorities. FourTeck documents which applications are allowed to use each circuit, how link health is tested, what should happen to existing sessions during failure, and whether inbound services must remain reachable when the primary WAN is unavailable.

Simple failover can monitor gateway reachability and switch the default route when a circuit fails. Better designs use multiple probes so the device can distinguish a local Ethernet link from real Internet reachability. A provider CPE can stay electrically up while upstream routing or DNS is broken; health checks should therefore test meaningful destinations and use thresholds that avoid flapping. For voice and transactional applications, packet loss, latency and jitter can be as important as binary up/down status.

SD-WAN adds application-aware path selection. Instead of assigning all traffic to one preferred uplink, policies can steer Microsoft 365, voice, ERP, web browsing or backup traffic based on path quality, cost and business priority. A branch with fibre and 5G can keep critical SaaS applications on the stable path while using the alternate circuit for lower-priority traffic. If the primary path degrades rather than fails completely, performance-based steering can move selected flows before users experience a full outage.

Inbound services need a separate plan. DNS, public IP allocation and NAT determine whether services can fail over. If each ISP provides a different public range, automatic outbound failover is easier than seamless inbound continuity. Site-to-site VPN peers may also need multiple gateways or dynamic discovery. These constraints are recorded during design so “dual WAN” is not presented as an automatic guarantee that every service survives every type of carrier failure.

Firewall policy conversion: preserve intent, remove obsolete access

A router migration is an opportunity to translate rules into a cleaner security policy. Direct conversion of every legacy object and port forward can reproduce years of technical debt. FourTeck maps rules to owners and applications, confirms what is still required, and removes entries that no longer have a business function. This is especially important for inbound NAT, remote management, old VPN services and “any-to-any” rules created during past troubleshooting.

Policy order also matters. Different platforms evaluate rules, address objects, service groups, zones and implicit denies in different ways. A rule that behaved correctly on a DrayTek may need a different representation on the successor. The conversion therefore starts with intent: source, destination, service, schedule, user or device identity where relevant, security profile and logging. After that intent is defined, it is expressed using the target platform’s policy model.

For an NGFW, security profiles can be attached selectively. Critical outbound web access may receive IPS, anti-malware, DNS or web filtering, while trusted infrastructure flows can use a narrower inspection profile where appropriate. East-west segmentation between VLANs can also be brought under firewall policy rather than relying on unrestricted router interfaces. This can reduce lateral movement risk between user, server, guest, IoT, CCTV and voice networks.

Remote administration deserves special treatment. Management access should be limited to trusted addresses, VPN, a dedicated management segment or central management service rather than exposed broadly to the Internet. Administrative authentication, role separation, logging, configuration backups and firmware governance are included in the replacement baseline so the new device improves operations as well as packet forwarding.

VPN migration: site-to-site, remote access and encryption policy

VPN is often the most sensitive part of a DrayTek replacement because both ends must agree on identity, selectors and cryptographic settings. A site-to-site tunnel can appear simple in the GUI but depend on IKE version, pre-shared key or certificates, phase-one encryption, hash or integrity algorithm, Diffie-Hellman group, lifetime, phase-two selectors, PFS, NAT traversal, dead-peer detection and routing. The migration worksheet captures those parameters for every peer before the old device is disconnected.

Where legacy algorithms are in use, the replacement project can upgrade the cryptographic profile if the remote peer supports it. This must be coordinated rather than changed unilaterally. Older third-party firewalls, industrial devices or managed provider endpoints may support only a limited proposal set. FourTeck separates “must preserve for compatibility” from “can modernise during migration” so security improvement does not become an uncontrolled interoperability risk.

Routing through the tunnel is equally important. Policy-based VPNs, route-based VPNs and overlapping subnets behave differently. We verify local and remote networks, static routes, dynamic routing where used, NAT exemptions and return paths. If the current environment has multiple WAN links, we also document how the tunnel should recover when the primary uplink fails and whether the remote side accepts a secondary public IP.

Remote-access users introduce identity and endpoint considerations. User accounts may be local to the router or tied to RADIUS, LDAP, Active Directory, MFA or a vendor cloud service. The new client software, authentication flow, DNS behaviour, split tunnelling and routes should be tested with representative users before broad deployment. If a new security platform is being adopted, remote access can be redesigned around MFA and least-privilege access instead of recreating a flat full-tunnel profile by default.

Capacity planning covers both tunnel count and encrypted throughput. A site may have only five tunnels but transfer hundreds of megabits of backup traffic, while another may have dozens of lightly used branch tunnels. The replacement is selected against the actual encryption workload and expected concurrency, with headroom for failover and growth.

VLANs, DHCP, routing and gateway migration

Moving a LAN gateway changes more than an IP address. Endpoints depend on DHCP scopes, option values, reservations, DNS servers, default gateways, relay agents and sometimes vendor-specific options for phones or access points. If the existing DrayTek is the default gateway for multiple VLANs, the successor needs equivalent subinterfaces and tagged VLAN IDs unless the design intentionally moves Layer-3 routing to a core switch.

FourTeck exports or records DHCP reservations and checks their purpose. Servers, printers, PBX systems, cameras, door controllers and network equipment frequently depend on fixed addressing even when the reservation is not obvious to users. Scope lease times may be temporarily reduced before cutover to speed gateway and DNS changes, then returned to normal after validation. Where a dedicated DHCP server exists, helper or relay settings must be reproduced.

Static routes and policy routes are reviewed separately. A static route describes reachability; a policy route can override normal routing based on source, destination, service or interface. Overlooking a policy route is a common reason that only one application breaks after migration. Dynamic routing such as OSPF or BGP requires additional planning around neighbour relationships, timers, route redistribution and administrative preference.

If the replacement includes a redesign, inter-VLAN routing can move to the firewall for stronger segmentation or to a Layer-3 core for higher east-west throughput. That decision should be made from security and performance requirements, not convenience. High-volume server traffic may be better switched locally, while sensitive user-to-server traffic may benefit from firewall inspection. The target architecture documents which device owns each gateway so troubleshooting remains deterministic.

VoIP, SIP and real-time traffic during router replacement

Voice systems often reveal subtle migration errors faster than ordinary web traffic. SIP signalling can succeed while RTP media fails because of NAT behaviour, asymmetric routing, firewall session handling or an unnecessary SIP ALG. A replacement plan therefore identifies the PBX or cloud voice provider, phone VLAN, SIP trunk addresses, RTP ranges, QoS markings and any existing port forwards before change night.

QoS should reflect the real WAN bottleneck. Marking DSCP on the LAN has limited value if the uplink queue is unmanaged or if the provider does not preserve markings. The edge can still prioritise voice before packets enter the constrained circuit, reserve bandwidth where appropriate and prevent bulk transfers from filling the upstream queue. On dual-WAN networks, path steering should avoid moving active voice sessions unnecessarily between links with different latency characteristics.

FourTeck validates call setup, inbound and outbound audio, hold/transfer, DTMF and representative external calls after migration. Where the router replacement is part of a wider voice refresh, the FourTeck IP Phone practice can help align phone endpoints, VLANs and QoS with the new edge architecture.

Wireless implications when the existing DrayTek includes Wi-Fi

Some Vigor models combine routing and wireless LAN in one appliance. Replacing such a unit with a wired firewall creates an architectural decision: add a standalone access point, use an existing managed wireless system, or select a replacement router with integrated wireless. The correct answer depends on coverage, user density, roaming, guest access, Wi-Fi generation, PoE availability and central management requirements.

For a small office with the router positioned centrally, integrated Wi-Fi can be convenient. In a larger UAE office, warehouse or villa-style workspace, placing the security gateway where the carrier circuit enters the building may be poor for radio coverage. Separating firewall and access points allows the APs to be installed where RF conditions are better while the gateway stays in the rack or telecom room.

The migration preserves SSIDs and authentication only when that makes sense. Guest and corporate wireless should map to intentional VLANs and policies, and IoT devices may warrant a separate segment. If SSIDs or keys are changed, the rollout plan accounts for scanners, printers, meeting-room equipment and embedded devices that may not have a convenient keyboard or display.

High availability and business continuity

A router replacement is a good point to ask whether one edge appliance is still acceptable. If Internet access is essential for cloud ERP, contact centre, payments, VPN, telephony or remote operations, a single firewall can become a larger risk than the ISP circuit. High-availability pairs can protect against device failure and maintenance events, although they do not remove every single point of failure by themselves.

Proper HA design considers two appliances, redundant power where the models support it, independent UPS feeds, dual switches or resilient switch paths, separate WAN circuits, redundant provider CPE where available, and diverse physical cabling. If both firewalls connect to one unmanaged switch or one power strip, the architecture can still fail from that shared component. The objective is to understand the failure domains rather than simply tick an HA box.

State synchronisation determines how gracefully sessions survive a failover. Platform capabilities differ, and some traffic may need to reconnect even in a configured cluster. VPN tunnels, dynamic routes, DHCP, link monitoring and security subscriptions should be considered in the HA model. Maintenance procedures also matter: administrators should know how to confirm primary/secondary health, perform a controlled failover and upgrade firmware without creating split-brain or policy inconsistency.

For small branches, a single well-sized appliance with a documented spare and 5G failover may be more practical than an HA pair. For headquarters, data rooms or operational sites, a redundant firewall pair may be justified. FourTeck bases the recommendation on outage impact and recovery requirements rather than assuming the most expensive architecture is always the best fit.

Monitoring, logs and operational visibility after migration

A replacement should make the network easier to operate. At minimum, the edge needs reliable time synchronisation, administrative logs, configuration backups, WAN health visibility and a method to identify high-bandwidth users or applications. For security-led deployments, event logs should also support investigation of denied traffic, IPS detections, malware events, DNS activity and remote-access authentication.

Log retention is a design choice. Local device storage may be sufficient for basic troubleshooting but can be limited for audit or long-term analysis. Central syslog, SIEM, vendor analytics or managed monitoring can preserve data beyond the appliance and correlate events across sites. The replacement proposal can therefore include central management and logging where operational scale warrants it.

Alerting should focus on actionable conditions: WAN loss, VPN tunnel down, HA member failure, high resource utilisation, configuration change, expired certificate or security event. Too many low-value alerts train operators to ignore the system. A concise set of thresholds tied to responsibility and escalation is more useful than enabling every notification available.

A controlled DrayTek replacement methodology

The rollback plan is written before cutover. It states which cables move back, which public IP or PPPoE settings must be restored, how long rollback should take and what condition triggers the decision. This avoids improvisation during an outage. A migration is not considered complete merely because a laptop can browse the web; the acceptance checklist is based on the services that actually make the site productive.

UAE deployment scenarios and how the design changes

FourTeck supports UAE network projects through FourTeck UAE, allowing router replacement to be coordinated with switching, wireless, server connectivity, structured cabling and security requirements rather than delivered as an isolated appliance change.

Licensing and total cost: compare the operating model, not just hardware price

A DrayTek-to-DrayTek refresh and an NGFW migration can have different licensing structures, so an accurate comparison looks beyond the appliance purchase price. Conventional routing, NAT, VPN and core firewall functions may be available without recurring security subscriptions on some platforms, while advanced threat prevention, web filtering, DNS security, sandboxing, cloud management, premium support or analytics may require subscriptions. The correct package is the one that supports the required controls; buying a security appliance without the licences needed for the intended security profile can defeat the reason for upgrading.

Total cost also includes implementation, transceivers, rack accessories, redundant power, HA peer, central manager or logger, support term, spare strategy, LTE/5G modem, access points and any required switching changes. A physically inexpensive firewall that forces an immediate switch upgrade because it lacks enough LAN interfaces can cost more overall than a better-matched platform.

FourTeck separates one-time and recurring components in the quotation. We also indicate the assumptions behind capacity and licences so the customer can understand which items are mandatory for the design, which are optional resilience upgrades, and which can be added later without replacing the appliance.

UAE procurement and deployment considerations

Router replacement in the UAE often involves more than selecting a model from a datasheet. Lead time, regional stock, power accessories, warranty route, support entitlement, firmware access and availability of compatible optics affect how quickly and safely a migration can be executed. A proposal should therefore distinguish confirmed design requirements from commercial availability. If a specific model is unavailable, the substitute should be revalidated against interfaces, VPN, sessions, security throughput and licensing rather than chosen because it looks adjacent in a product family.

Carrier coordination can also influence timing. Some circuits use provider-managed CPE, PPPoE credentials, static IP blocks or tagged handoffs. Replacing a router may require information from the ISP even when the physical circuit is unchanged. Where the old DrayTek terminates DSL directly, the target architecture may need a bridge or provider device. Where a public subnet is routed to the current WAN MAC or CPE, a change can require provider action or an ARP ageing period.

Change windows are planned around business operations. Retail sites may prefer after closing; offices may choose an evening or weekend; 24×7 environments need a shorter, rehearsed migration and stronger rollback. Remote branches may need local hands to move cables while an engineer performs configuration and validation. Documentation should identify who has authority to accept the cutover and who owns the ISP escalation path if the circuit itself is the problem.

The physical environment matters in UAE installations. Rack space, ventilation, UPS runtime, dust exposure, room temperature and cable management can affect reliability. Hardware should be mounted and powered in line with vendor environmental specifications, with power and WAN cables labelled clearly. For firewalls deployed in pairs, each member and HA link should be labelled so maintenance does not accidentally remove both paths at once.

Security upgrade opportunities during a DrayTek replacement

A hardware refresh can be completed with minimal policy change, but many organisations choose replacement because they want a stronger security boundary. The migration can then be used to reduce broad access, separate device classes and add detection controls. The most valuable improvements are usually architectural rather than cosmetic: enforce least privilege between VLANs, require MFA for remote administration and VPN, centralise logs, close obsolete inbound services, restrict management interfaces, and create a defined firmware and backup process.

Threat inspection should be deployed with operational understanding. IPS signatures, anti-malware, DNS controls and application policies can block malicious or prohibited traffic, but they also introduce processing load and potential false positives. FourTeck starts with policies aligned to the application environment, monitors events and adjusts exceptions deliberately. Critical servers and line-of-business applications are tested so the security stack does not unintentionally interrupt production.

TLS inspection is one of the more significant choices. Decrypting outbound HTTPS can improve visibility, but it requires certificate deployment, privacy and policy decisions, application compatibility testing and adequate hardware sizing. Some regulated, certificate-pinned or privacy-sensitive destinations may need bypass rules. We therefore treat TLS inspection as a design feature, not a default checkbox.

For customers moving from a router-centric edge to a firewall-centric architecture, Firewall Dubai by FourTeck can support platform selection, policy design and implementation. The key is to match the security controls to business risk and operating capability so the new platform remains maintainable after deployment.

Model selection checklist: data FourTeck uses before naming the exact replacement

Frequently asked questions about DrayTek router replacement in the UAE

Migration testing: proving the replacement works beyond a speed test

The acceptance test is built from the discovery inventory. Internet browsing is one item, but it is not enough. We test DNS resolution, every critical VLAN, DHCP, inter-VLAN access, site-to-site VPNs, remote access, public services, email and SaaS applications, voice calling, printing, CCTV or NVR access, management interfaces, WAN failover, monitoring and any branch-specific business system. Each test has an expected result and an owner who can confirm the application behaves normally.

For NAT and inbound services, testing must consider both external and internal clients. Some environments depend on hairpin or loopback NAT when internal users access a public hostname that resolves to the company’s public IP. If the replacement handles this differently, internal users may fail even though the service works correctly from mobile data. Split DNS may be a cleaner design, but that is an architectural choice rather than an emergency fix during cutover.

Failover testing intentionally disconnects or disables a WAN path so the team can measure detection time, route change, VPN recovery and application impact. Recovery is also tested because some designs fail over correctly but do not return cleanly to the preferred path. Where SD-WAN uses performance thresholds, controlled degradation tests can validate policy without waiting for a real carrier incident.

Finally, we review logs for denied or anomalous traffic that users did not notice. A migration can expose previously undocumented flows, including printers reaching old mail servers, devices using hard-coded DNS, monitoring systems polling by IP or controllers calling external services. Capturing these during the stabilisation period allows policy to be corrected without opening broad rules.

What not to do during a router replacement

Decision recap: selecting the right DrayTek replacement for UAE operations

The best replacement is the smallest architecture that satisfies the measured requirement with sensible resilience and growth headroom. If routing, dual WAN and modest VPN remain the core needs, a current DrayTek refresh may be entirely appropriate. If the business now requires strong threat prevention, application-aware control, central security management, SD-WAN and deeper logging, moving to a next-generation firewall can consolidate those functions. If the site is large or critical, separating edge routing, firewalling and core switching may provide better scale and fault isolation.

Whatever the path, five technical questions should be answered before purchase. First, can the platform sustain the required traffic with the features that will actually be enabled? Second, does it have the correct copper, optical and multi-gigabit interfaces for current and planned circuits? Third, can it reproduce or improve every required VPN, VLAN, DHCP, NAT and routing function? Fourth, does the availability design match the cost of an outage? Fifth, can the IT team operate, update, monitor and support the platform throughout its lifecycle?

FourTeck’s role is to turn those questions into a documented bill of materials and migration plan. This reduces guesswork and makes the quotation easier to compare because performance assumptions, licences, optics, redundancy and services are visible rather than hidden behind a single appliance model number.

Quotation input checklist

Providing the following information lets FourTeck narrow the replacement quickly and avoid over- or under-sizing. Partial information is acceptable; the engineering review can identify gaps that need confirmation before procurement.