Sophos Firewall licensing covers the Sophos Firewall operating system (SFOS) on XGS Series hardware appliances and on virtual, software and cloud platforms. Every hardware and virtual firewall needs a base licence. Features are added as subscriptions, sold individually or in bundles. Some bundles include the hardware or virtual appliance, and others are subscriptions only.[2] The Licensing Guidelines license firewall subscriptions per hardware appliance when bought on Sophos hardware, and per virtual Computer for Sophos Firewall Virtual Software. The virtual Base License is perpetual.[1] Licences are held against the firewall’s serial number and managed in Sophos Fusion (formerly Sophos Central). A connected firewall synchronises its licences with Sophos Fusion every 24 hours.[3]
Editions
Sophos Firewall is sold as two bundles or as individual subscriptions on top of the Base License.[3]
| Licence | Contents (Sophos Firewall help) |
|---|---|
| Base License | Stateful firewall, VPN, wireless, high availability, Firewall RED[3] |
| Xstream Protection | Network Protection, Web Protection, Zero-Day Protection, Central Orchestration, DNS Protection, Enhanced Support; also MDR, NDR Essentials and third-party threat feeds[3] |
| Standard Protection | Network Protection, Web Protection, Enhanced Support[3] |
| Network Protection | IPS, Sophos X-Ops threat feeds, SD-RED device management, Security Heartbeat[3] |
| Web Protection | Web security and control, application control, web malware protection[3] |
| Zero-Day Protection | Machine learning, sandboxing file analysis, threat intelligence; formerly Sandstorm Protection[3][2] |
| Central Orchestration | SD-WAN VPN orchestration, Central Firewall Reporting Advanced[3] |
| Email Protection; Webserver Protection | Anti-spam, antivirus, DLP, encryption; web application firewall[3] |
Hardware is sold with a bundle as the Xstream Appliance Bundle or the Standard Appliance Bundle.[3] Some features exist only in bundles. Active threat response is part of Xstream Protection only, and Sophos Central Firewall Management needs a paid subscription or support licence, not just the Base License.[3] Legacy UTM appliances use FullGuard, Basic Guard, Wireless Protection and Sandstorm subscriptions per hardware appliance.[1] Terms longer than one year are available through partners.[2] Sophos publishes no part numbers or prices for these licences on the cited pages.
Metrics
- Hardware appliance. Every subscription on an XGS appliance is licensed per hardware appliance.[1] The unit is the serial number: renewal orders must include the serial number of the firewall the subscription runs on.[6]
- Virtual Computer. Virtual Software is licensed per virtual Computer, and licences can be chosen by number of CPU cores and amount of memory.[1] Virtual licences are limited by the maximum number of CPU cores the firewall will use.[5]
- UTM Virtual Software User. UTM Virtual Software counts the IP address of every User who communicates with or through the gateway. IP addresses unused for seven days are removed.[1] Catalog: UTM Virtual Software counts IP addresses seen in the last seven days.
- GB storage. Fusion Firewall Reporting Advanced is licensed by GB of storage capacity per appliance or virtual Computer. It also caps the number of reports per month, for example 2000 reports covering the last 24 hours.[1]
Counting / floors
Base License first. A Base Firewall licence must be applied before any subscription takes effect.[4] Catalog: Every firewall needs a Base Firewall licence before subscriptions work.
DNS query limits. Xstream Protection includes DNS Protection with a daily query limit that depends on the model. It ranges from 310,000 queries (XGS88 and XGS87, Virtual Firewall 1C4) to 120,000,000 (XGS8500). DNS is not included in any consumption-based licensing.[1] Catalog: Xstream Protection DNS queries limited per firewall model.
High availability. Each active firewall needs its own licences.[5]
- Active-active: both devices must run the same subscriptions, although expiry dates may differ.[5] If the licences have not matched for more than three days, HA is disabled. Virtual active-active pairs need a Base Firewall licence on each device.[7]
- Active-passive: only the active hardware firewall carries subscriptions, which it shares with the passive one. Both must be registered. For virtual pairs only the active licence is bought.[5] Licences are activated on the initial primary. If that device cannot synchronise with the licensing server at least once in 90 days, licence protection is deactivated.[7]
Catalog: HA: each active firewall is licensed; the passive unit shares the active licence.
Virtualization & partitioning
Virtual, software and cloud (BYOL) firewalls are sized by CPU cores. From 2025-03-01 Sophos removed the RAM limits from these licences. They are now restricted only by CPU core count, but licence names such as “SFV4C6” (4 cores and 6 GB) did not change.[12] The Licensing Guidelines still list virtual licence sizes 1C4, 2C4, 4C6, 6C8, 8C16 and Unlimited in the DNS query table.[1] A termed virtual licence cannot be resized unless it is an MSP termed licence, because the size is tied to the base licence.[6] A licence bought for a virtual firewall that started on a free trial gets a new serial number and must be transferred to the trial serial number.[5] Catalog: Virtual firewall licences limited by CPU cores only. See virtualization and partitioning.
Cloud / BYOL
Cloud instances use the same core-based licences as virtual and software firewalls.[12] On cloud, virtual and software appliances the Base Firewall licence does not expire. On hardware it expires when the device reaches end of life.[4] Air-gapped firewalls use an air gap licence that is valid for 180 days. If it is not updated, only the Base Firewall licence stays active.[4]
Programs
Enhanced and Enhanced Plus Support. Bundles include Enhanced Support. Anyone buying individual subscriptions needs a separate support subscription to reach the support team.[2] Without support, Sophos cannot provide RMA or technical support. The firewall gets three free firmware upgrades, and later ones need a valid support subscription.[4] Catalog: Without support a firewall gets three free firmware upgrades.
Hardware warranty. The base warranty lasts 12 months from the date Sophos processed the order from its channel partner.[10] After that, cover continues only while a valid Enhanced or Enhanced Plus contract is in place.[5] If an XG or XGS support contract is bought more than 30 days after the warranty or previous contract expired, there is a three-month Waiting Period with no replacement hardware. A reinstatement fee waives it.[10] In active-passive HA, Enhanced Plus on the primary firewall gives advance replacement for the auxiliary firewall.[7] Catalog: Lapsed XG/XGS support triggers a three-month RMA Waiting Period.
Trials and loaned hardware. Firewall modules can be evaluated for 30 days without a key. A module can be evaluated again in the next major version.[3] Loaned evaluation hardware may be kept for no more than 60 days and used only outside production.[11]
Renewals, upgrades and transfers
- Renewal. Renewals must quote the serial number. An XGS appliance bought with the Xstream Protection bundle must be renewed with Xstream Protection. A renewal starts the day after the current subscription expires. If the subscription had already expired, it normally starts on activation instead.[6] Catalog: Xstream appliance customers renew Xstream Protection against the serial number.
- Legacy bundles. Legacy XG Protect bundles were migrated to the new scheme. Keeping the same features can take several products; for example TotalProtect Plus maps to Xstream Protection plus Email Protection and Web Server Protection.[6]
- Mid-term changes. Upgrades are quoted with an allowance for the unused part of the current subscription and start immediately. Downgrades mid-term are not possible.[6] Catalog: Firewall subscriptions can be upgraded but not downgraded mid-term.
- Transfers. Subscriptions can move only between the same or equivalent models, for example SG125 and XG125. Evaluation subscriptions and HWaaS subscriptions cannot be transferred.[8] Catalog: Firewall subscriptions transfer only between equivalent models.
- XG to XGS. For early renewals from XG onto XGS, the XGS licence starts when Sophos processes the order, so both appliances can run in parallel until the XG licence expires.[9] Catalog: Early XG to XGS renewals start when the order is processed.
Expiry behaviour
When a subscription expires the configuration is kept, but features stop being enforced. After the Base Firewall licence expires, firewall rules are not processed and the firewall acts as a router. When Network Protection expires, IPS signatures are no longer loaded. When Web Protection expires, web policies and malware scanning stop. In its support section, the same page adds that licences must be renewed within 90 days of expiry, after which firewall protection for the device stops.[4] A firewall whose registration was deferred can run for 30 days. After that it must be registered, and all licences except the Base Firewall licence expire.[4]
Hardware ownership
The Hardware Terms allow Sophos appliances to be used only with the Software pre-installed or downloadable for them. Owning the appliance gives the owner no rights to the Software.[11] A second-hand appliance therefore needs its own Base Firewall licence and subscriptions. Sophos may discontinue hardware and publishes planned dates on its Retirement Calendar. It gives no refund for discontinuation unless the law requires one.[11] Catalog: Owning the appliance gives no rights to the Software.
Out of scope
- Prices and part numbers, which are not on the cited pages.
- Sophos RED, SD-RED, APX access points and switches, apart from their warranty periods in the Hardware Warranty Policy.
- Detailed feature behaviour of each subscription beyond licensing.
- Legacy SG UTM hardware licensing, apart from the unit table in the Licensing Guidelines.