Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=firmware-reimage

Reimage the firewall using a USB flash drive

You can reimage the firewall using a bootable USB flash drive with any firmware version. You can reimage hardware, virtual, and software appliances.

Warning

Reimaging deletes all the data in the firewall, so take a backup first and make sure you copy the secure storage master key.

To restore the backup, you must enter the master key.

Create a bootable USB flash drive

To create a bootable USB flash drive to reimage the firewall, do as follows:

  1. Go to Firewall Installers and download the firmware for your product and platform.
  2. Download balenaEtcher, a free tool to create a bootable USB flash drive.

  3. Run balenaEtcher and accept the license agreement.

    Accept the balenaEtcher agreement to use its tool to create a flash drive.

  4. Insert a USB flash drive in your endpoint device. Select the firmware image you downloaded.

    Note

    The USB flash drive will be formatted. You'll lose all data on it.

    Select the firmware image.

  5. Click Flash to create a flash drive that can restart the firewall, then wait for the validation to complete.

    The balenaEtcher tool creates and validates a flash drive that can restart the firewall.

    Process continues for creating the flash drive.

    Validation process continues.

    Created a flash drive that can restart the firewall.

Reimage the firewall

To reimage the firewall, do as follows:

  1. Power off the firewall.

  2. (Optional) Connect a monitor to the firewall's SVGA or HDMI port to monitor the installation.

    Note

    Sophos XGS Series appliances don't have a monitor port. You can use the on-device LCD screen or status LED to monitor the reimaging process.

  3. Insert the bootable USB flash drive you created into the firewall.

  4. Power on the firewall.

    Sophos Firmware Installer starts reimaging the firewall.

    Reimaging Sophos Firewall.

    Note

    If the appliance can't detect the USB flash drive or install the firmware, see Troubleshooting firmware problems.

  5. Monitor the installation, using one of the following methods:

    • A connected monitor:

      Monitor the installation.

    • On-appliance screens:

      • XGS Series rack-mounted hardware. Monitor the LCD screen for the following statuses:

        • Installation in progress
        • Installation successful
        • Installation failed
        • Failsafe mode

        Example status:

        Installation successful.

      • XGS Series desktop hardware. Monitor the status LED on the appliance's front panel for the following statuses:

        LED status Description
        Blinking red Reimaging in progress
        Stable green Reimaging is successful
        Stable red Reimaging has failed

        Example status:

        Monitor the installation.

  6. After the firmware is installed, remove the USB flash disk and type y to restart the firewall.

    Enter y on the command line to restart Sophos Firewall.

  7. The firewall restarts with the default configuration.

    Enter the password after Sophos Firewall restarts.

  8. Sign in and restore the configuration you want.