Backup and restore

You can take encrypted backups and restore the configurations.

Backups contain the entire configuration on Sophos Firewall and are encrypted. You can save backups on Sophos Firewall, use FTP to save them on a server, or email the backup. You can set up an automatic backup schedule, or take a backup manually.

You must enter a password to encrypt the backup. To restore the backup, you must reenter the password and the secure storage master key.

Secure storage master key

The secure storage master key provides extra protection for the account details stored on Sophos Firewall. The key encrypts sensitive information, such as passwords, secrets, and keys, preventing unauthorized access. The default administrator (username: admin) sets the secure storage master key.

The master key requirements for backup and restore are as follows:

• You must enter the secure storage master key when you restore a backup that has a master key. If you don't enter the master key, you can't restore these backups. You can restore backups taken before the master key was set without entering the master key.
• You must enter the master key and the backup encryption password.
• If you change to a new secure storage master key and need to restore a backup generated before creating the new key, you must use the old key to restore that backup.
• If you share a backup with Sophos Support, you must share the backup's encryption password and secure storage master key.
• You can't restore a backup if the secure storage master key that was used to create it is lost.
• Scheduled backup: Until you set the master key, Sophos Firewall continues to take scheduled backups, but the backups won't have the master key's extra protection.
• Manual backup: You must create the master key before taking a manual backup.

Best practices

When to take a backup:

• Schedule automatic backups.
• Take a manual backup before and after you make a considerable change to the configuration.
• Take a backup before upgrading the firmware.

How to keep the backup secure:

• If you save backups at a different location, make sure the location is secure.
• Make sure you set the secure storage master key to protect and restore sensitive information.

Compatible devices for restoring configuration

The following rules apply for restoring the backup configuration to a different Sophos Firewall device:

• Hardware models:

  • You can restore the configuration to a model with an equal or higher number of Ethernet ports.
  • You can't restore the configuration from hardware models with FleXi Port modules to virtual SFOS appliances or hardware models without FleXi Port modules. These modules allow you to add additional ports to the Sophos Firewall appliance. For more details, see Backup-restore compatibility check.
  • You can't restore the configuration if the number of configured gateways in the backup exceeds the number of gateways the firewall supports.

• Wireless models:

  • You can restore backups from non-wireless and wireless models to wireless models with an equal or higher number of Ethernet ports.
  • You can't restore backups from wireless to non-wireless models.

• Revisions: You can restore to a hardware model with a different revision if it has an equal or higher number of Ethernet ports.

• Firmware versions: You can restore to a device with the same or later firmware version.
• Pattern versions: You can restore to a device with the same or later pattern version. If it's of an earlier version, update the patterns, and then restore the configuration.

Sophos Central registration

Sophos Central registration is only retained when you restore a backup to the same firewall from which the backup was taken.

Restoring a backup to a different firewall or an HA cluster deregisters the firewalls from Sophos Central. You must register the firewalls to Sophos Central and reconfigure Sophos Central services such as Security Heartbeat and Sophos ZTNA again. See Backup-restore in HA.

Backup

Backup restore

When you restore a backup, the following changes take place:

• The restored backup replaces the current configuration. This also deletes the stored backup and restarts Sophos Firewall.
• The IP address assigned to the web admin console on the restored configuration becomes active. You must use this IP address to access the web admin console.