Apply a Sophos Firewall license to a Sophos UTM device

You can convert an SG series UTM appliance from UTM Operating System (UTM OS) to Sophos Firewall Operating System (SFOS).

You must have an SG series UTM 9.x appliance or software appliance.

You must have a full UTM license. You can't convert a UTM trial license.

For migration to XG or XGS series Sophos Firewall appliances, contact your sales representative.

Converting your license won't migrate your existing configuration to SFOS. You need to reconfigure the required settings on the converted appliance.

If you want to trial SFOS with the option to roll back to your previous license, install a 30-day trial of FullGuard. You can convert your existing license to an SFOS license at any point during the 30-day trial period.

Requirements

Make sure you have access to your SG series UTM appliance, your MyUTM licensing portal and Sophos licensing portal accounts, and at least a 1GB USB drive, USB keyboard, and a VGA monitor. You must also have access to the internet.

1. Make a note of the serial number and license ID of your UTM appliance. You can find this on the UTM's web admin dashboard.

2. Sign in to MyUTM Licensing Portal and click License Management.

3. Click your license to see license details.

   

   Note

   If you don't have any active subscriptions, the base license is migrated.

   Note

   If you have a new or renewal license key that has yet to be applied, apply it first and wait at least one day for the key to synchronize in our records before migrating your license from UTM to SFOS.

4. Under Actions, click Download License File.

   Note

   Make sure that you download the license file for the same SG model that you'll convert. Converting the wrong license file will result in service disruption.

Convert an SG Appliance from UTM OS to SFOS

1. Download the Hardware Installers: Firewall OS for XG and XGS Series .iso file. You can do this in the following ways:

   • Go to the Sophos website, go to Support > Downloads & Updates, and click Firewall Installers. Next to Hardware Installers: Firewall OS for XG and XGS Series, click Download.

   • Sign in to Sophos Central, go to Devices > Installers. Under Firewall Protection, click Download installers. Next to Hardware Installers: Firewall OS for XG and XGS Series, click Download.

2. Copy the downloaded .iso file to a USB drive. For more information, see Sophos Firewall: Reimage the appliance.

3. Install the .iso file on the SG appliance by connecting the USB drive, a USB keyboard, and a VGA monitor and then restarting the SG appliance.

   The installer will start automatically. No input is required from you during installation, but you can watch the progress. The following message shows once the installation is complete: Firmware installed. Press y to reboot when done.

4. Remove the USB drive from the appliance, press Y, and press Enter.

   The SG appliance will run the SFOS firmware after the restart. A prompt will show requesting your UTM credentials.

5. Connect the USB drive to the SG appliance and restart it to start the installation automatically.

   Depending on your SG model, connect a VGA or HDMI monitor, keyboard, or serial terminal to the appliance to monitor installation progress. SG210 and later also show progress on the built-in LCD.

   The following message shows once the installation is complete: Firmware installed. Press y to reboot when done.

6. Remove the USB drive from the appliance, press Y, and press Enter.

   The SG appliance will run the SFOS firmware after the restart.

7. Connect a computer to the LAN port of the SG appliance.

8. Sign in with the following default credentials:

   • Username: admin
   • Password: admin

   Note

   You must change the credentials.

9. Select I would like to migrate my UTM 9 license now, click Browse, select your UTM license file, and click Continue.

10. On the License Migration & Renewals page, click Login.
11. Enter your credentials and click Sign In.
12. On the Important Information About Your License page, click Yes - Proceed with Registration.
13. Complete the CAPTCHA test and click Continue.
14. Verify the details and click Confirm Registration + Evaluation License.
15. On the Registration Successful page, click Initiate License Synchronization.
16. On the Basic Setup is Complete page, click Continue.
17. Use the network configuration assistant to configure your network settings.
18. Go to Administration > Licensing to review your license details.

You've successfully converted your SG appliance with UTM OS to an SG appliance with SFOS. Your Sophos UTM license is deactivated and is no longer valid.

If you have any issues, contact Sophos support.

Licenses and components

Software and virtual UTM upgrades

Virtual UTMs are licensed by the number of users or IPs. Software and virtual firewalls running SFOS are licensed by the maximum number of cores and the maximum amount of RAM that SFOS utilizes. The table below shows the comparison between UTM OS and SFOS.

License bundles

When you migrate to SFOS, you get a Base Firewall license in addition to your other licenses. Your support package will be Enhanced Support.

The available license bundles are as follows:

• EnterpriseGuard includes Base Firewall, Network, and Web.

• FullGuard includes Base Firewall, Network, Web, Email, and Web Server.

• FullGuard Plus includes Base Firewall, Network, Web, Email, Web Server, and Zero-Day Protection.

If you upgrade from BasicGuard to FullGuard, check the terms of your license, as these may have changed.

If you have a Sophos BasicGuard license, it'll be converted to a FullGuard license, and the remaining term will be halved in length compared to the time you had remaining on BasicGuard.

More resources

• Migration center
• Sophos Firewall: Startup help
• Deploy Sophos Firewall in gateway mode
• Deploy Sophos Firewall in bridge mode