Skip to content

Getting started with firewall licenses

Find answers to common questions about getting started with firewall licenses.

What do I receive when I purchase an XGS Series firewall product?

In addition to the hardware you've purchased, you'll receive a license schedule, which is a PDF document. If you don't receive a license schedule, contact your reseller. This is an important document, and you should read it, action it, and keep it safe.

What is the new licensing process terminology?

If you previously managed your licenses in the legacy MySophos portal, you'll notice that some terminology changed when the licensing process was migrated to Sophos Central. The term "register" meant something different in MySophos than it does in Sophos Central.

Previously, you would register your firewall in MySophos to start licensing and warranty. You would also register your firewall in Sophos Central to enable Synchronized Security features, Firewall Management, and Firewall Reporting.

We now differentiate between those two processes as follows:

  • Claiming your firewall is the first mandatory step before a license can be applied.
  • Later, you can register the firewall in Sophos Central to use the additional features available through Sophos Central.

For more information, see Sophos Firewall Licensing and Management in Sophos Central.

When does my warranty start, and how do I extend cover?

The base warranty period for an XGS series hardware firewall is twelve months. This starts from the date Sophos processes the order from the associated channel partner. At the end of the standard warranty period, cover is extended as long as a valid support contract is in place.

The following rules apply:

  • Standard Warranty Start Date: Starts from the date Sophos processes the order from the channel partner.

  • Extended Cover (beyond standard warranty): Provided via a valid Enhanced or Enhanced Plus support contract.

  • Waiting Period: If the support contract for a product has expired, and the grace period has also ended before a renewal is purchased, a three-month waiting period applies before the customer can claim an RMA.

  • Reinstatement Fee: A one-time reinstatement fee can be paid to forego the waiting period. To get advanced RMA cover for Passive XGS Series hardware, you need Enhanced Plus Support on the firewall they're connected to.

  • If you skipped registration when you first set up your firewall, every time you sign in to the firewall's web admin console, you'll be prompted to register. After 30 days, you'll only be able to sign in after completing the registration.

How are virtual firewall products licensed?

Virtual firewall licenses are restricted based on the maximum number of cores and RAM that they'll use. For example, if you purchase an SF SW/Virtual Xstream Protection license, your virtual machine must have up to four cores and 6GB RAM. You must purchase the base license and any subscriptions you want. These can also be purchased as virtual firewall bundles, which include the base license and the subscriptions. The maximum amount of cores and RAM size of feature subscriptions must match the virtual firewall on which they run.

If you set up a virtual firewall using a 30-day free trial and want to purchase a license for it, make sure that the serial number is quoted on your order. If you don't do this, a new serial number will be generated, and the license will be attached to that. You must then transfer the purchased license to your free trial serial number.

Which high availability (HA) models are supported, and how are they licensed?

Sophos Firewall supports active-active (cluster) and active-passive (standby) modes.

  • Each active firewall requires its own licenses.
  • For active-active mode, each firewall must be running the same subscriptions, but the expiry date of those subscriptions doesn't need to match. The HA group will remain in place as long as the current active subscriptions match.
  • For active-passive hardware firewalls, each firewall must be registered. Only the active firewall needs to have subscriptions running on it, as it'll share the license with the passive firewall.
  • For active-passive virtual firewalls, you only need to purchase the active license.
  • For active-passive mode, if the active firewall has an Enhanced Support or Enhanced Plus Support subscription, you'll also get support for the passive firewall.
  • For active-passive mode, RMA replacement for the passive firewall under warranty will be provided if you have an Enhanced Plus subscription for the active firewall.
  • MSP Flex only: An Xstream Protection license is required for advanced hardware replacement on the passive firewall.
  • For active-passive mode on hardware firewalls, you must decide which firewall is the active firewall, as this is the firewall the licenses will apply to. For more information, see Sophos Firewall: HA operation.
Which portal must I use to register an appliance and activate my licenses?

You can do as follows from the firewall's web admin console:

  • Claim your firewalls
  • Activate your license keys


If you claim your firewall and activate your license keys directly from your firewall's web admin console, all changes are synchronized with Sophos Central immediately.

You can do as follows from Sophos Central:

  • Claim your firewalls


    If you're upgrading a Sophos SG series appliance, you must use the web admin console licensing screen to claim your firewall and migrate your license.

  • Activate your license keys

  • Transfer licenses between Sophos Central accounts
  • Transfer subscriptions between firewalls
How do I find out which licenses are running on my firewall?

In your firewall's web admin console, go to Administration > Licensing. Under Module subscription details, you'll see a list of your subscriptions, including the subscription status.

If you think a subscription is outdated, click Synchronize to make sure the license on your firewall is the same as the license on the Sophos licensing system.

If you have any further questions about getting started with firewall licenses, contact your local Sophos representative.