Skip to content


You can see the device registration information and the subscription status. You can activate or evaluate subscription modules.


All modules remain unsubscribed when you deploy the device for the first time.

You can migrate your existing UTM 9 licenses to Sophos Firewall OS (SFOS) installed on SG appliances. You can't migrate these licenses to SFOS on Sophos Firewall appliances.

See Licensing guide for Sophos Firewall.

Basic information

The device offers two types of modules:

  • Basic module: Includes Firewall, VPN, Wireless.
  • Subscription modules:
    • Base Firewall: Includes Firewall, VPN, Wireless, site-to-site RED.
    • Network Protection: Includes intrusion prevention system, RED appliances, advanced threat protection.
    • Web Protection: Includes web categorization, antivirus, application control.
    • Email Protection: Includes anti-spam, antivirus, email encryption, DLP.
    • Webserver Protection: Includes WAF, antivirus, reverse proxy.
    • Sandstorm: Includes the Sandstorm service and all related settings.
    • Enhanced Support: 8 x 5 (8 hours a day, within business hours).
    • Enhanced Plus Support: 24 x 7 (24 hours a day, 7 days a week).

You can subscribe to the license modules as follows:

  • Without a license key for a free 30-day trial subscription.
  • Without a license key for a free 90-day trial subscription (software only).
  • With a license key.

Sophos Firewall registration details

The firewall fetches the following registration details from your Sophos Licensing Portal account:

Model: Sophos Firewall model number which is registered and its device key.

Company name: Name of the company under which the device is registered.

Contact person: Name of the contact person in the company.

Registered email address: Email address used for device registration.

Activate subscription: You can subscribe to individual modules using the license key.


Activate subscription will be enabled after you migrate existing licenses to SFOS.

Module subscription details

Module subscription detail Description
Synchronize Click to synchronize licenses with your account.
Activate evaluations Individual modules can be evaluated for the duration of 30 days.

Activate evaluations will be enabled after you migrate existing licenses to SFOS. See License upgrade.
Module Name of the module.
Status A module can have the following statuses:
  • Subscribed
  • Evaluating
  • Unsubscribed
  • Expired
Expiration date Module subscription expiry date.


You can start an evaluation for each major Sophos Firewall firmware version. For example, you can start a Sandstorm trial for 30 days in version 17.5 and then start another 30 days in version 18.

License synchronization

If your appliance is connected to the internet, it synchronizes with Sophos Licensing Portal automatically every 24 hours. This means your licenses are automatically updated.

If your appliance is on an air gap network, you must update your licenses manually.

Air gap

For air gap (physically isolated) deployments, you can update licenses manually if your Sophos Firewall has been approved for air gap deployment.


Your Sophos account manager must approve air gap deployment for your Sophos Firewall hardware. You can request air gap access with your account manager at the time of purchase.

Upload license file

Sign in to your Sophos Licensing Portal account and download the license file. On your appliance, select the license file and click Update license.

License upgrade

You can migrate a UTM 9 license to an SFOS license after you register the SG Series firewall.


This option is only available if you upgrade to an SFOS license on SG Series firewalls.

We then transfer your UTM 9 license to an equivalent SFOS license. The migration is irreversible, and you can't use the UTM 9 license any longer.

High availability

For active-passive HA cluster, you must activate the licenses on the device you've configured as the initial primary. Don't activate them on the auxiliary device. The cluster then uses the licenses of the primary device.

For active-active HA cluster, both Sophos Firewall devices need the licenses. The licenses must be the same for both devices. See HA licensing FAQs.

License transfer

You must transfer your license in the following cases:

  • Active-passive HA: You've activated the licenses on the auxiliary device and must transfer them to the primary.
  • Replacement: You're replacing your current Sophos Firewall device with a different one.
  • License purchase after trial: You've purchased the licenses after a trial evaluation.

See License transfer for Sophos Firewall.

Back to top