Skip to content

Reimage Sophos Firewall

You can reimage hardware, virtual, and software appliances.


You use a bootable USB flash drive to reimage the firewall. You can reimage Sophos Firewall with any firmware version.


Reimaging deletes all the data on Sophos Firewall. Save a recent configuration backup.


  • When you reimage the firewall, it removes the secure storage master key.
  • After you reimage the firewall, enter the master key to restore or import the configurations.
  • If you create a new secure storage master key and roll back to the previous version, the firewall runs with the previous configuration. Configuration changes made before the rollback are lost.

Create a bootable USB flash drive

To create a bootable USB flash drive to reimage the firewall, do the following:

  1. Insert a USB flash drive into your endpoint device.
  2. Go to Firewall Installers.
  3. Scroll to the required hardware, virtual, or software installer. Click Download.

    Select the installer to download

  4. Download Win32DiskImager, a free tool to create a bootable USB flash drive.

  5. Run Win32DiskImager and maximize the window.

    Expand the Win32DiskImager window

  6. Click the blue folder icon. icon in context

  7. The Select a disk image window opens.

    image file

  8. Go to the image file and select it.

  9. Click Open. The filepath to the image file appears in the Image File text field. The USB drive appears in the Device text field, for example, "D:".

    image file path

  10. Click Write and confirm you want to overwrite the USB drive.

    Confirm overwrite

  11. When you see Write Successful, click OK.

  12. Go to the Win32 Disk Imager window. Click Exit.

Reimage Sophos Firewall

To reimage Sophos Firewall, do the following:

  1. Power off Sophos Firewall.
  2. Optional: Connect a monitor to the SVGA or HDMI port of Sophos Firewall to monitor the installation.


    Sophos XGS Series appliances don't have a monitor port. You can use the on-device LCD screen or status LED to monitor the reimaging process.

  3. Insert the bootable USB flash drive you created in Sophos Firewall.

  4. Power on Sophos Firewall.
  5. To enter the BIOS, press the Delete key when Sophos Firewall is starting. Make sure USB Key is the first boot option in the BIOS.

    BIOS screen with USB key option

  6. Save and exit the BIOS.

    The firewall restarts.

    Save and then exit BIOS

  7. Sophos Firmware Installer starts reimaging Sophos Firewall.

    Reimaging Sophos Firewall

  8. Monitor the installation. You can use the following methods:

    • A connected monitor:

      Monitor the installation

    • On-device LCD screen (XGS Series rack-mounted hardware):

      Monitor the installation

    • Status LED on the front of the device (XGS Series desktop hardware):

      Monitor the installation

      Status LED Meaning
      Blinking red Reimaging in progress
      Solid green Reimaging is successful
      Solid red Reimaging has failed
  9. After the firmware is installed, remove the USB flash disk and type y to restart Sophos Firewall.

    Enter y on the command line to restart Sophos Firewall

  10. Sophos Firewall restarts with the default configuration.

    Enter the password after Sophos Firewall restarts

  11. Sign in and restore the configuration you want.