Getting started with firewall licenses

In addition to the hardware you've purchased, you'll receive a license schedule, which is a PDF document. If you don't receive a license schedule, contact your reseller. This is an important document, and you should read it, action it, and keep it safe.

If you previously managed your licenses in the legacy MySophos portal, you'll notice that some terminology changed when the licensing process was migrated to Sophos Central. The term "register" meant something different in MySophos than it does in Sophos Central.

Previously, you would register your firewall in MySophos to start licensing and warranty. You would also register your firewall in Sophos Central to enable Synchronized Security features, Firewall Management, and Firewall Reporting.

We now differentiate between those two processes as follows:

• Claiming your firewall is the first mandatory step before a license can be applied.
• Later, you can register the firewall in Sophos Central to use the additional features available through Sophos Central.

For more information, see Sophos Firewall Licensing and Management in Sophos Central.

The base warranty period for an XGS series hardware firewall is twelve months. This starts from the date Sophos processes the order from the associated channel partner. At the end of the standard warranty period, cover is extended as long as a valid support contract is in place.

The following rules apply:

• Standard Warranty Start Date: Starts from the date Sophos processes the order from the channel partner.

• Extended Cover (beyond standard warranty): Provided via a valid Enhanced or Enhanced Plus support contract.

• Waiting Period: If the support contract for a product has expired, and the grace period has also ended before a renewal is purchased, a three-month waiting period applies before the customer can claim an RMA.

• Reinstatement Fee: A one-time reinstatement fee can be paid to forego the waiting period. To get advanced RMA cover for Passive XGS Series hardware, you need Enhanced Plus Support on the firewall they're connected to.

• If you skipped registration when you first set up your firewall, every time you sign in to the firewall's web admin console, you'll be prompted to register. After 30 days, you'll only be able to sign in after completing the registration.

Virtual firewall licenses are restricted based on the maximum number of cores and RAM that they'll use. For example, if you purchase an SF SW/Virtual Xstream Protection license, your virtual machine must have up to four cores and 6GB RAM. You must purchase the base license and any subscriptions you want. These can also be purchased as virtual firewall bundles, which include the base license and the subscriptions. The maximum amount of cores and RAM size of feature subscriptions must match the virtual firewall on which they run.

If you set up a virtual firewall using a 30-day free trial and want to purchase a license for it, make sure that the serial number is quoted on your order. If you don't do this, a new serial number will be generated, and the license will be attached to that. You must then transfer the purchased license to your free trial serial number.

Sophos Firewall supports active-active (cluster) and active-passive (standby) modes.

• Each active firewall requires its own licenses.
• For active-active mode, each firewall must be running the same subscriptions, but the expiry date of those subscriptions doesn't need to match. The HA group will remain in place as long as the current active subscriptions match.
• For active-passive hardware firewalls, each firewall must be registered. Only the active firewall needs to have subscriptions running on it, as it'll share the license with the passive firewall.
• For active-passive virtual firewalls, you only need to purchase the active license.
• For active-passive mode, if the active firewall has an Enhanced Support or Enhanced Plus Support subscription, you'll also get support for the passive firewall.
• For active-passive mode, RMA replacement for the passive firewall under warranty will be provided if you have an Enhanced Plus subscription for the active firewall.
• MSP Flex only: An Xstream Protection license is required for advanced hardware replacement on the passive firewall.
• For active-passive mode on hardware firewalls, you must decide which firewall is the active firewall, as this is the firewall the licenses will apply to. For more information, see Sophos Firewall: HA operation.

You can do as follows from the firewall's web admin console:

• Claim your firewalls
• Activate your license keys

You can do as follows from Sophos Central:

• Claim your firewalls

  Note

  If you're upgrading a Sophos SG series appliance, you must use the web admin console licensing screen to claim your firewall and migrate your license.

• Activate your license keys

• Transfer licenses between Sophos Central accounts
• Transfer subscriptions between firewalls

In your firewall's web admin console, go to Administration > Licensing. Under Module subscription details, you'll see a list of your subscriptions, including the subscription status.

If you think a subscription is outdated, click Synchronize to make sure the license on your firewall is the same as the license on the Sophos licensing system.