Firmware upgrade FAQs and troubleshooting

Recommended checklist for all deployments:

1. Take a fresh backup.
2. Verify the available disk space.
3. Confirm the supported upgrade path.
4. Review the release notes.
5. Schedule a maintenance window.
6. Optionally, restart the firewall beforehand to clear the memory cache.

Verification checklist for HA:

1. The HA status must be healthy and synchronized.
2. Both nodes must be reachable.
3. Both nodes must meet disk space requirements.

Yes, SFOS 22.0 and later have the following requirements:

• Additional disk space is required.
• Partition-specific requirements for /var and /content exist.
• SSD firmware requirements exist for certain nodes.

Yes, both firewalls must meet the firmware requirements.

• Each firewall in the HA cluster is evaluated independently.
• If one node fails the requirements, this can block the upgrade.

The SSD firmware upgrade improves reliability and prevents hardware issues. Learn when it's required:

• It applies only to a subset of XGS models.
• SSD firmware upgrade may be mandatory before upgrading to SFOS 22.0 and later.
• A notification appears if action is required.

During the firmware upgrade process, the firewall does as follows:

1. Installs the new version.
2. Restarts.
3. Activates the new firmware.

The upgrade behavior depends on the deployment type.

• Standalone firewall: Full restart, resulting in temporary downtime.
• HA cluster: Upgrade is orchestrated across both nodes with failover to minimize disruption.

Yes, a maintenance window is always recommended.

• Standalone firewall: Required. Service interruption occurs.
• HA cluster: Recommended. Brief failover interruptions may occur.

The upgrade process is as follows:

• Upgrade is applied to the firewall.
• Firewall restarts, resulting in downtime.
• Traffic is interrupted until the restart is complete.

You must start the upgrade on the Primary device.

The HA cluster performs the upgrade as follows:

1. Upgrades the auxiliary device.
2. Fails over traffic to the auxiliary device.
3. Upgrades the former primary device.
4. Failback may occur after the upgrade, depending on the preferred primary device in the HA configuration.

Yes. You can do as follows in both standalone and HA deployments:

• Upgrade to a later version.
• Downgrade to an earlier compatible version.
• Install firmware manually in offline environments.

Related information:

• Move to a different firmware version

Sophos Firewall uses the following two partitions:

• Active firmware. The version currently running on the device.
• Previous firmware. The version that was running before the most recent upgrade.

Each partition contains its own configuration snapshot.

The configuration is retained as follows:

• Configuration is tied to the firmware version and remains in the partition.
• If you roll back firmware, the firewall automatically restores the previous configuration.

Automatic rollback is an important safety feature that can occur in SFOS 20.0 and later.

If an upgrade fails during configuration migration, the firewall automatically reverts to the previous version and configuration.

Previously, failed upgrades could result in the following behavior:

• Factory reset of the firewall.
• Loss of configuration.

Now, automatic rollback offers the following benefits:

• Reduces downtime.
• Preserves working configuration.

Possible causes are as follows:

• Connectivity issues.
• Update services are blocked or disconnected.

Related information:

• Firmware upgrade, pattern, and hotfix updates are not received

Insufficient disk space can block upgrades.

Disk resizing may be required before upgrading to later versions, such as SFOS 22.0 or later.

Related information:

• Resize the primary disk partition in virtual deployments for SFOS 22.0 upgrade

The common issues are as follows:

• Insufficient disk space.
• Unsupported upgrade path.
• HA synchronization issues.
• Configuration migration failures.

Related information:

• Getting ready for firmware updates
• Release notes - Upgrade information

If an upgrade fails, do as follows:

• Wait. Automatic rollback may restore the previous version.

• Verify the following parameters:

  • Disk space
  • System health

• Retry using a supported upgrade path.

• If needed, contact Sophos Support.

Related information:

• Troubleshoot firmware upgrades in HA
• Requirements and resolution to upgrade to SFOS 22.0 and later
• Firmware and installer download links
• Release notes - Upgrade information