Sophos Firewall

These release notes are for Sophos Firewall (formerly known as Sophos XG Firewall).

Version 23.0 GA Build 371
Released on November 04, 2026

New features

This release introduces the new features and enhancements below. For more information, see Sophos Firewall help.

AI Defense

Generative AI

Sophos Firewall integrates with Sophos AI Defense to help you discover and manage AI usage across your organization.

Application list: The new Generative AI application category lets you detect and control AI traffic through application filter policies.
Web category: The new Generative AI web category lets you permit sanctioned tools, restrict unsanctioned ones, and help prevent sensitive data from being shared with AI services.

Firewall AI Assistant in Sophos Fusion

The new Firewall AI Assistant in Sophos Fusion (formerly Sophos Central) lets you interact with the firewall using natural language. In this initial phase, the assistant focuses on firewall rules, allowing you to retrieve existing rules and create new ones using prompts. Newly created rules are turned off by default and added to the bottom of the rule table. You must review, reposition, and turn them on manually. For more information, see the following resources:

Read AI assistant.
Watch AI assistant overview.

REST API for automation

The firewall now provides a modern REST API for integration with IT, security, and automation workflows. You can automate configuration deployment, policy updates, and incident response using secure API-key authentication. The REST API supports the OpenAPI 3.0 specification, enabling compatibility with standard development and orchestration tools.

The firewall's web admin console provides links from Administration > API access to the following information:

Comprehensive documentation, including REST API endpoints, schemas, and example payloads.
Downloadable OpenAPI specification for use with tools such as Swagger.

For more information, see the following resources:

Watch Get started with REST APIs.
Read Sophos Firewall API reference.

Quality-of-life enhancements

Redesigned firewall rule management

Firewall rule management has been redesigned with a cleaner, more flexible table layout, enabling faster day-to-day administration.

Rule groups are now shown in a dedicated column instead of the previous horizontal grouping.
Free-text search and filtering are available across all firewall rule data.
You can select, freeze, unfreeze, and resize columns using the gear icon.
Hover over features to see which ones are applied to the rule.

Top navigation

The top navigation now keeps the serial number visible at all times and adds a copy option for convenience. High availability (HA) is also shown, allowing you to view HA node roles and health from anywhere on the web admin console. The firewall model, serial number, and hostname are shown together for faster identification.

UI performance improvements

The web admin console now uses HTTP/2, improving responsiveness and page load times, particularly on higher-latency connections.

LAG members on Control center

The Control center shows LAG member information, providing quick visibility into link status and transmitted and received traffic.

Web exceptions

The web admin console now warns you about invalid or inefficient regular expressions in web exceptions. Overly broad, ambiguous, or poorly constructed regex patterns can result in inaccurate matches and unnecessary processing overhead. For more information, see the following resources:

Management from Sophos Fusion (formerly Sophos Central)

Firewall Management - Faster configuration sync: Sophos Fusion now pushes configuration changes immediately to firewalls running SFOS 23.0 or later. Previously, firewalls checked for pending changes every minute and then pulled the updates. The enhancement improves performance and ensures configuration changes reach your firewalls without delay.

Automated schedules for firmware upgrades: Sophos Fusion now supports recurring schedules for maintenance and major firmware upgrades. Staged rollout support and per-firewall overrides provide more control while reducing the effort required to keep large firewall estates up to date.

Secure by design

DNS Protection: DNS Protection now offers a simplified single-click setup for easier deployment and management.

DNS over HTTPS (DoH) and unencrypted DNS: When DNS Protection is unavailable, the firewall can fall back to DoH or unencrypted DNS. You can also use DoH or unencrypted DNS when DNS Protection isn't configured. DoH encrypts DNS queries using HTTPS, allowing secure connections to public DNS services and helping prevent interception and tampering.

DNS Security Extensions (DNSSEC) Protection: The firewall supports DNSSEC, which uses cryptographic signatures to authenticate DNS responses and verify DNS data integrity.

For more information, see the following resources:

Read Configure DNS servers.
Watch DNS enhancements.

Hotfix security updates

You can now view all applied hotfix security updates on the web admin console under Backup and firmware. Hotfixes allow the firewall to patch and protect the running system without requiring a firmware upgrade.

The page shows the CVE ID, description, severity, advisory link, and date applied. This information is also available in the Log viewer, email notifications, and Central Firewall Reporting. For more information, read Hotfix: Security updates.

Extended Active Threat Response events

Logs for NDR Essentials and NDR Active threat intelligence events now include endpoint device information for enhanced visibility and investigation.

Multi-factor authentication

QR codes can now be delivered securely by email, reducing the risk of unauthorized MFA enrollment through compromised user accounts during brute-force or credential-stuffing attacks. For new deployments, email-based onboarding is the default. Unused QR codes automatically expire after 24 hours.

High availability and resilience

Hardware-aware HA: High availability (HA) now monitors SSD health in addition to HA links and ports. The cluster can automatically fail over when SSD health deteriorates, helping prevent a degraded appliance from disrupting operations.

Faster failover detection: Accelerated keepalive reduces the HA failover detection window from 4 seconds to 300 milliseconds, letting the firewall detect peer failures 13 times faster.

Improved HA stability under heavy load: HA keepalive packets now use a prioritized processing path separate from data traffic, so HA heartbeats remain responsive even under heavy traffic and CPU load, helping prevent delays in failover detection.

Monitored ports: Increased the maximum number of monitored ports from 15 to 24.

Authentication and identity

OpenID Connect SSO

The firewall now supports single sign-on (SSO) for users and administrators through OpenID Connect (OIDC) identity providers. SFOS 23.0 supports the following identity providers (IdPs):

Google Workspace. Watch Set up Google Workspace as an IdP.
Microsoft Entra ID. Existing Microsoft Entra ID configurations migrate to SFOS 23.0, with migrated configurations available under the OpenID Connect server type. For more information, read When you upgrade to 23.0.

Microsoft Entra ID support for Synchronized Security

Microsoft Entra ID integration now supports Synchronized Security with Sophos Endpoints, allowing the firewall to authenticate users based on endpoint-reported user information and apply Microsoft Entra ID user and group policies. It also supports hybrid Microsoft Entra ID and on-premises Active Directory environments, enabling seamless authentication in many scenarios without requiring captive portal sign-in.

Sophos Chromebook User ID SSO

A new version of the Chromebook User ID extension is now available. It supports Manifest V3, the latest version of the Chrome extension platform. All users must uninstall the previous Sophos Chromebook User ID extension and install the new extension.

For more information, read Sophos Chromebook User ID SSO extension with Manifest V3 support is available.

Sophos Authentication for Thin Client (SATC) with XDR Sensor

A lightweight XDR Sensor mode in SATC adds user identity awareness to shared systems, such as RDP and terminal servers, enabling per-user web, application, and firewall rule enforcement in multi-user environments.

Active Directory SSO support for Windows Server

For Windows Server AD environments that enforce LDAP signing and channel binding, AD SSO continues to work without requiring any configuration changes in the firewall.

Routing enhancements

Routing engine upgrade: The firewall provides an upgraded routing engine, bringing a more secure, modern, and feature-rich routing platform.

Unified routing console: The upgrade introduces a unified routing console, making it easier to access and manage multiple routing protocols from a single interface. It also adds experimental support for Bidirectional Forwarding Detection (BFD) for BGP and static routes, letting you explore faster failure detection and improved routing resilience in standalone deployments.

For more information, see the following resources:

Scalability and networking

DHCP moves to the modern control plane

DHCP now runs on the modern control plane architecture, improving scalability, resilience, and service management. The updated service improves lease handling and logging performance, adds flood protection, supports more static bindings, streamlines DHCP options for RFC compliance, moves advanced DHCP settings into the web admin console, and improves lease retrieval through the REST API.

mDNS reflector

mDNS enables service discovery across isolated VLANs and subnets without removing network segmentation. It supports IPv4 and IPv6 and is particularly useful in campus and education environments where shared devices, such as printers, displays, and media devices, sit on separate networks. The feature is available on Network > mDNS on the web admin console.

For more information, read mDNS reflector.

IPv6 IPoE support

The firewall now supports IPv6 IPoE and 4in6 tunneling, including IPoE services in Japan, such as Xpass (CrossPass). Dynamic DNS integration is VNE-aware and automatically updates public IPv6 addresses. IPIP tunnel enhancements include interface-based source selection, FQDN-based remote endpoints, ToS inheritance, and MTU and MSS tuning.

Increased zones

Increased the maximum number of zones from 100 to 248.

Web Application Firewall (WAF)

WAF request redirection and per-path actions: WAF rules now support per-path actions, including Protect, Block, Redirect, and Passthrough, allowing requests to be redirected and different actions to be applied to different URL paths within the same domain. The Passthrough action replaces the WebSocket Passthrough setting previously applied at the rule level.

You can group multiple paths with the same action into a single route entry, reducing configuration complexity and simplifying rule management.

For more information, read Add a WAF rule.

WAF performance and scalability improvements: WAF now uses Apache Event Multi-Processing Module (MPM) architecture, improving throughput, scalability, and resilience under load by eliminating the fixed thread-per-request bottleneck of the previous model.

Platform support

IONOS Cloud platform

The SFOS virtual image is now supported on IONOS Cloud, extending cloud deployment options for organizations using the Bring Your Own Image (BYOI) model.

AWS S3 backup

Added the ability to run an on-demand backup with the Backup Now option and automatically upload the encrypted backup file to an Amazon S3 bucket on supported AWS deployments.

Graphical UEFI boot support

Software ISO deployments now support graphical UEFI boot, simplifying bare-metal installations on compatible hardware.

Expanded interface driver compatibility for software ISO deployments

The firewall now supports bnxt and tg3 drivers, improving compatibility with a wider range of Broadcom NetXtreme network adapters.

Version 22.0

For information about the previous version, see 22.0 release notes.

Resolved issues

Version 23.0 GA Build 371

Fixed issues, listed by ID, description, explanation and workaround.
Issue ID	Component	Description
NC-187231	Antivirus	The antivirus service failed to start.
NC-180066	Antivirus	SAVI and AVIRA pattern updates failed, causing the Antivirus service to stop.
NC-177519	Antivirus	"Unscannable" notifications were generated after upgrading to SFOS 22.0 while antivirus patterns were being updated.
NC-180414	ATP Framework	Previously blocked IP addresses continued to be detected as threats after being removed from the threat intelligence list.
NC-185491	Authentication	Filtering users by user group on the Users page failed in some cases.
NC-184278	Authentication	Users belonging to multiple OUs couldn't authenticate with the VPN Portal on their first attempt.
NC-182021	Authentication	UI filter for user groups didn't work.
NC-181942	Authentication	AD server configuration in the firewall didn't accept domain names with top-level domains longer than seven characters
NC-180824	Authentication	New Active Directory users who were members of a secondary AD group failed to sign in to the VPN portal.
NC-176806	Authentication	Microsoft Entra ID SSO failed due to missing intermediate CA certificates in the firewall.
NC-176367	Authentication	"null" entries appeared in the Live user list in an HA cluster after a firmware upgrade.
NC-176222	Authentication	STAS sign in was affected after an upgrade to SFOS 22.0 GA.
NC-176109	Authentication	Repeated XML API authentication with MFA turned on prevented administrator sign-ins to the web admin console and the API.
NC-172558	Authentication	User portal showed the Microsoft Entra ID SSO option when it wasn't configured for the portal and returned a 404 error when users selected it.
NC-171261	Authentication	SSL VPN SSO authentication failed after HA failover and failback.
NC-167549	Authentication	LDAP authentication accepted usernames with trailing spaces and created duplicate user entries.
NC-167173	Authentication	Captive portal sign-out settings didn't accurately describe Microsoft Entra ID SSO behavior.
NC-166341	Authentication	Microsoft Entra ID users were added to SSL VPN policies after VPN portal sign-in, even when their group was already assigned to the policy.
NC-162171	Authentication	L2TP VPN authentication using MS-CHAP or MS-CHAPv2 didn't include the configured NAS-Identifier.
NC-161118	Authentication	Users could access the internet with on-premises AD authentication but not with Microsoft Entra ID SSO.
NC-160157	Authentication	A user's last access time persisted after user deletion and was shown when the user signed in again.
NC-148705	Authentication	QoS policy wasn't applied to clientless users when their count exceeded 3,000.
NC-176113	Backup-Restore	Failed to restore a backup created on an HA device because of an interface mapping mismatch.
NC-181147	Bridge	DHCP leasing failed in bridge mode.
NC-175860	Certificates	A remote access IPsec connection failed after HA failover when Appliance Certificate was regenerated.
NC-182222	Clientless Access	Users with numerical usernames couldn't establish SSL VPN connections after upgrading to SFOS 22.0 MR1.
NC-183421	CM	Some Sophos Fusion transactions remained stuck in "In progress" after the firewall restarted.
NC-181175	CM	Group policy push from Sophos Fusion remained pending and wasn't applied to firewalls.
NC-180529	CM	Auxiliary HA device deregistered from Sophos Fusion.
NC-177526	CM	Firewall health check failed to load data.
NC-183013	Config Migration Framework	Upgrade from SFOS 22.0 MR1 to MR2 failed because of Lets_Encrypt CA.
NC-182765	CP 2.0 HA	Failed to assign port 6222 to Admin console HTTPS port.
NC-181687	CP 2.0 HA	SSL VPN policy creation failed with an internal server error.
NC-181331	CP 2.0 HA	The firewall entered failsafe mode due to a full configuration partition.
NC-187233	CSC	Creating an AP VXLAN was slower than expected in SFOS 22.0 MR2.
NC-180152	CSC	Interface updates took longer in SFOS 22.0 than in 21.5.
NC-188373	DNS	DNS Protection failed after an upgrade.
NC-186632	DNS	Test name resolution continued to use fallback DNS servers after fallback was turned off.
NC-180219	DDNS	DDNS with Cloudflare failed after an upgrade to SFOS 22.0 MR1.
NC-175885	DNS	The Name lookup tool limited hostnames to 40 characters.
NC-175952	DHCP	The `dhcpd` process remained in exiting status after restoring a partial DHCP server configuration.
NC-190566	Dynamic Routing (OSPF)	OSPF neighbor connections over route-based IPsec tunnels with an Any-Any SD-WAN route failed.
NC-183979	Email	An XGS appliance underwent an extended reboot during an upgrade to SFOS 22.0 MR2 due to a large mail spool.
NC-179341	Email	Some emails bounced after a firmware upgrade to SFOS 22.0 GA.
NC-177930	Email	Emails were stuck in mail spool due to a mailpoller crash.
NC-173014	Email	Emails containing reports failed smart host authentication.
NC-171602	Email	Firewall notification emails failed DKIM validation.
NC-184219	Firewall	An OSPF outage occurred after HA failover on SFOS 22.0 MR1.
NC-184117	Firewall	With STAS configured, users were prompted to sign in to the captive portal again after successful authentication.
NC-183728	Firewall	Web policies with user-group filters weren't applied to SATC traffic in active-active HA mode.
NC-183679	Firewall	Traffic counters for all firewall rules remained at zero.
NC-183447	Firewall	Auxiliary HA device experienced a kernel crash when processing IPv6 multicast traffic.
NC-182532	Firewall, SDWAN Routing	The policy route service stopped running.
NC-182441	Firewall	The firewall entered failsafe mode during a firmware upgrade.
NC-182434	Firewall	The firewall experienced a kernel crash when processing multicast traffic.
NC-181968	Firewall	Querying large IP sets resulted in an internal loop error.
NC-181741	Firewall	Unauthenticated user traffic was dropped every hour.
NC-181344	Firewall	First Alive NAT didn't fail back to the first server when it became available again.
NC-180974	Firewall	A kernel crash in `sdwan_profile` resulted in HA failover.
NC-180960	Firewall	The firewall entered failsafe mode after upgrading to SFOS 22.0 GA when an empty service group was configured in rules and policies.
NC-180464	Firewall	SMTP traffic configured with DNAT was incorrectly dropped after an upgrade to SFOS 22.0.
NC-178996	Firewall	Packet capture showed an incorrect gateway interface for traffic routed through an SD-WAN route.
NC-178903	Firewall	SATC users couldn't access the internet after an upgrade to SFOS 22.0 GA.
NC-178413	Firewall	An empty value in Services caused an ipset failure and the firewall to start in failsafe mode.
NC-178354	Firewall	A kernel crash occurred during SD-WAN rule matching.
NC-177934	Firewall	The firewall entered failsafe mode after an upgrade to SFOS 22.0 GA.
NC-177047	Firewall	ZTNA agentless applications behind WAF became inaccessible after upgrading the gateway firewall to SFOS 22.0 GA.
NC-176846	Firewall	Log Viewer showed "No Heartbeat" in firewall logs when the endpoint device's actual Security Heartbeat status was green.
NC-176836	Firewall	Failed to remove an SNAT rule for system-generated traffic.
NC-176582	Firewall	The firewall restarted automatically when processing malformed IPv6 neighbor solicitation or neighbor advertisement packets.
NC-176532	Firewall	Failed to ping external IP addresses from Diagnostics through a backup WAN after upgrading to SFOS 22.0 GA.
NC-175949	Firewall	Firewall rules created through the firewall API couldn't be deleted, and an incorrect message appeared stating that they were created by a Sophos Fusion administrator.
NC-175933	Firewall	The auxiliary firewall restarted repeatedly after an HA status change, causing a network outage.
NC-173054	Firewall	SSL VPN users were shown a CAPTCHA when accessing the web admin console even when CAPTCHA was disabled for the VPN zone.
NC-169537	Firewall	Packet capture process consumed high CPU when processing IPv6 traffic with ESP or AH headers.
NC-169452	Firewall	Export of firewall rules failed.
NC-170200	Firmware Management	Firmware upgrades failed when multiple upgrade attempts were made within a few minutes.
NC-188293	FW AI Assistant	REST API name filters didn't filter the returned objects as expected.
NC-182024	Gateway Management	Failed to update a WAN gateway failover rule when the gateway name and monitor object name didn't match.
NC-186809	HA	The web admin console and VPN portal were unreachable due to a certificate synchronization failure on the auxiliary appliance when some certificate filenames began with two consecutive periods.
NC-183680	HA	The auxiliary device entered failsafe mode during an HA status change.
NC-183651	HA	Endpoint devices with odd IP addresses couldn't access the internet through a VLAN on a bridge in active-active HA.
NC-181343	HA	The auxiliary device entered failsafe mode while HA was being established.
NC-177467	HA	The auxiliary device failed to start due to an excessive number of concurrent unauthenticated SSH connection requests.
NC-176051	HA	HA wasn't established after an abrupt power cycle.
NC-173031	HA	Application policies imported to an HA cluster didn't automatically synchronize to the auxiliary device.
NC-169390	HA	Failed to create firewall rules because of synchronization failure between HA devices.
NC-182263	Hotspot	The hotspot voucher export contained duplicate voucher codes when more than 20 vouchers were created in a single batch.
NC-191261	Interface Management	Couldn't add or update DHCP Option 43 for DHCPv4 servers.
NC-177599	Interface Management	The `mtr` command failed in SFOS 22.0 GA.
NC-183871	IPsec	`Create firewall rule` was automatically selected after being cleared when configuring a route-based IPsec connection.
NC-180433	IPsec	The firewall crashed repeatedly when multicast traffic was sent through a VPN tunnel.
NC-178704	IPsec	IPsec tunnels didn't reconnect automatically after a power outage.
NC-178305	IPsec	A WAN gateway remained down even when its health check succeeded.
NC-178121	IPsec	Site-to-site IPsec connections moved to incorrect positions within a failover group after drag-and-drop reordering in SFOS 22.0 GA.
NC-177635	IPsec	After an upgrade to SFOS 22.0 GA, incoming IPsec traffic between Sophos Firewall and certain third-party routers didn't work.
NC-171719	IPsec	An SD-WAN routing issue occurred with ESP traffic.
NC-177844	IPS Engine	The primary HA device temporarily changed to standalone status during an IPS restart, causing a brief internet outage.
NC-183859	IPS Ruleset Management	A virtual auxiliary device entered failsafe mode during startup due to a signature database timezone configuration error.
NC-176587	IPS Ruleset Management	An IPS policy created from a firewall rule didn't appear in the IPS policy list, and the firewall rule couldn't be saved or canceled.
NC-166726	IPS Ruleset Management	The auxiliary device entered failsafe mode after an HA failover following an upgrade from SFOS 20.0 MR1 to 21.5 MR1.
NC-161000	IPS Ruleset Management	IPS and application signature updates failed when there was no Network Protection license.
NC-184931	Logging Framework	Dynamic DNS update information wasn't shown in the web admin console.
NC-182435	Logging Framework	Control center showed incorrect bandwidth usage values.
NC-181730	Logging Framework	Executive Report failed to download as a PDF when the duration was set to one month.
NC-180110	Logging Framework	The primary HA device entered failsafe mode because the logging daemon failed to start.
NC-180082	Logging Framework	SD-WAN and SD-WAN SLA trend reports appeared blank in Central Firewall Reporting.
NC-178745	Logging Framework	An HA device restarted automatically due to out-of-memory condition.
NC-172912	Logging Framework	The system graph flickered.
NC-171847	Logging Framework	The firewall restarted unexpectedly.
NC-165769	Logging Framework	Resolved an issue related to KBps versus Kbps units under the system interface graph.
NC-160238	Logging Framework	High disk usage caused high system load and network interruption.
NC-152553	Logging Framework	Recovery mechanism failed for `active.db`.
NC-151296	Logging Framework	Web filter logs didn't appear when DPI was turned on.
NC-151089	Logging Framework	The executive report download failed when the date range was set to one day.
NC-185420	NDR intrusion detection	The firewall didn't respond to SNMP requests after an XGS 116 backup was restored to an XGS 118 appliance.
NC-178141	Netfilter Utils	Specific ICMP error messages were dropped by local ACL rules after upgrading to SFOS 22.0 GA.
NC-180933	NFP-Firewall	Administrators couldn't sign in to the web admin console.
NC-179604	NFP-Firewall	The firewall generated unnecessary tuple-related messages in the syslog when firewall acceleration was turned on.
NC-177769	NFP-Firewall	The eBPF service became unresponsive after a pattern update.
NC-176855	NFP-Firewall	IPv6 throughput issues occurred over a route-based IPsec VPN connection.
NC-177441	Postgres	After an upgrade to SFOS 22.0 GA, the initial primary device entered failsafe mode.
NC-180255	PPPoE	After the active device became faulty and HA failover occurred, it re-established its PPPoE connection, disrupting internet connectivity on the current active device.
NC-178197	QoS	Application traffic intermittently stopped when an application-based bandwidth policy was applied.
NC-181808	RED	Traffic was blocked after a RED device was reset and reprovisioned because stale `RED_DEVICE_DROP` entries weren't removed.
NC-178906	RED	The firewall entered failsafe mode with the error "Failed to start Red server service".
NC-184632	Reporting	The Events report showed numbers instead of "Notice" in the severity column for "New firmware is available for installation" events.
NC-180313	Reporting	Custom logos appeared at an incorrect resolution in scheduled reports sent over email.
NC-172020	Reporting	Firewalls without on-box reporting sent daily emails with an empty Traffic dashboard PDF report.
NC-169646	Reporting	On-demand PDF reports contained incorrect charts and tables when generated in Chrome.
NC-155252	Reporting	Heavy disk I/O operations caused CPU spikes, resulting in intermittent internet outages of up to one minute.
NC-186411	SDWAN Routing	After a firmware upgrade to SFOS 22.0 MR1, some SD-WAN routes incorrectly applied DSCP matching even though it was turned off on the web admin console.
NC-185846	SDWAN Routing	TFTP return traffic over a route-based IPsec tunnel was routed through the WAN interface instead of the tunnel interface, causing TFTP provisioning to fail.
NC-182935	SDWAN Routing, VPN	A network interruption occurred while a customer added a new site to the SD-WAN group.
NC-177603	SDWAN Routing, VPN	Adding a new site to an SD-WAN group temporarily disrupted network connectivity at other sites in the group.
NC-176012	SecurityHeartbeat	Missing heartbeat was reported when two endpoints shared the same docking station or USB interface.
NC-164973	Sentry framework	Stale Sentry mini-dump files from cstad caused the /var partition to fill, leading to high disk utilization.
NC-181904	SFOS-Central	Failed to release quarantine emails when the firewall was accessed through Sophos Fusion.
NC-183165	Snort-app	The firewall failed to start after a firmware upgrade because a missing signature database table prevented the Garner service from starting.
NC-180226	Spoofing	The web admin console didn't show an error when a duplicate MAC address was added under Spoof protection trusted MAC.
NC-182395	SSLVPN	SSL VPN split tunnels incorrectly routed traffic to FQDN hosts that weren't configured as permitted network resources.
NC-179224	SSLVPN	Communication through site-to-site SSL VPN stopped after an HA failover, even though the tunnel remained active.
NC-177903	SSLVPN	SSL VPN service restarted periodically with certain configurations.
NC-140332	SSLVPN	After seven to eight hours of SSL VPN tunnel connectivity, Linux endpoint devices encountered authentication failures when static IP addresses were configured.
NC-181299	Static Routing	The SFOS GeoIP database incorrectly mapped an IP address to United Kingdom instead of Germany.
NC-165730	Static Routing	Supernetting didn't work for `10.96.255.0/24` when the subnet was changed to `22` or lower.
NC-185225	Synchronized App Control	After a firmware upgrade, the firewall incorrectly reported insufficient storage while optimizing Synchronized Application Control data.
NC-182635	Synchronized App Control	Repeated application path updates triggered additional application filter refreshes, causing high CPU utilization.
NC-186948	UI Framework	Clicking the Cloud Applications widget on the Control center didn't open the Cloud Applications page.
NC-181575	UI Framework	The time field in Schedule appeared incorrectly.
NC-171424	UI Framework	Deleting the only exception on the last page caused the Web Exceptions page to appear empty instead of showing the previous page.
NC-189640	WAF	WAF became slow and eventually stopped working.
NC-188249	WAF	WAF failed to start when a web server rule used a hostname containing non-ASCII characters.
NC-180587	WAF	After successful form-based authentication, WAF redirected users to the site path instead of the originally requested URL.
NC-180200	WAF	WAF stopped during nightly license synchronization in Home Edition firewalls.
NC-179812	WAF	The Let's Encrypt certificate failed to renew automatically.
NC-177457	WAF	When WAF debugging was turned on, the password was visible in `reverseproxy.log`.
NC-177201	WAF	OTP code wasn't stripped from the password before it was forwarded to the backend.
NC-176796	WAF	An invalid Let's Encrypt certificate in a WAF rule caused all WAF connections to stop working.
NC-176788	WAF	The `ResponseFieldSize` value reverted to the default value when the certificate was changed in a WAF rule.
NC-181286	Web	Links opened from Google Workspace apps intermittently failed to load with an HTTP 400 error.
NC-177257	Web	The local TLS exclusion list couldn't be edited on XGS 88, causing Sophos Fusion synchronization to fail.
NC-176679	Web	Antivirus service stopped after an upgrade to SFOS 22.0 GA when TCP 9090 was already in use.
NC-175950	Web	Application filter logs weren't generated for some applications.
NC-174477	Web	`httplogd` sent corrupted data to garner when the bytes sent weren't a complete record.
NC-182336	WebInSnort	Temporary antivirus scanning files accumulated and caused the `/var` partition to reach 100% utilization.
NC-179938	WebInSnort	The IPS service stopped working and couldn't be restarted when web policy files became corrupted.
NC-167019	WebInSnort	High CPU utilization occurred due to Snort when VEEAM traffic didn't have an exception.
NC-182994	Wireless	The firewall incorrectly logged new firmware alerts for APX access points after a restart even when the firmware hadn't changed.
NC-180133	Wireless	APX access points lost their registration with the firewall during a firmware upgrade and became inactive.

Known issues

To see the known issues for the firewall, go to the Known issues list.

Set Choose your product to Sophos Firewall. Alternatively, enter a search term.

Upgrading firmware and restoring backups

Upgrading firmware

Form factors:
- SFOS 23.0 GA and later versions are available on all form factors.
- SFOS 23.0 GA and later versions don't support XG and SG Series hardware appliances.
FIPS: The following SFOS versions use FIPS-certified cryptographic modules.
- 22.0 GA and all its maintenance versions
- 21.5 GA and all its maintenance versions
- 21.0 GA and all its maintenance versions
- 20.0 MR1 and subsequent maintenance versions
LINCE: Versions 20.0 MR1 and MR2 are LINCE-compliant. For more information, read National Essential Security Certification (LINCE).

Compatible versions for firmware upgrade and backup-restore

We strongly recommend that you migrate only to the approved versions in the following table. If you try to migrate to other versions, Sophos Firewall shows an alert asking you to confirm the migration before it restarts. If you confirm the migration, Sophos Firewall restarts with the factory configuration, and you lose your current configuration.

You can only restore backups from versions for which configuration migration is supported.

You can migrate the configuration from all earlier versions to 23.0 GA.

Read How to upgrade.
Read XG to XGS migration.

Upgrading firmware
Upgrade from	Upgrade to 23.0 GA Build 371
22.0 MR3 Build 572
22.0 MR2 Build 546
22.0 MR1 Build 490
22.0 GA Build 411
22.0 GA Build 365
21.5 MR2 Build 323
21.5 MR1 Build 261
21.5 GA Build 171
21.0 MR2 Build 349
21.0 MR1 Build 277
21.0 MR1 Build 272
21.0 MR1 Build 237
21.0 GA Build 169
All 20.0 versions
All 19.5 versions
All 19.0 versions

Indicates the same version or an earlier version. The table only shows upgrade information.

Sophos Fusion: You can schedule firmware upgrades from Sophos Fusion (formerly Sophos Central).

Important points to know before you upgrade

SFOS 22.0 MR2 and later

Legacy CLI VLAN tagging on bridge interfaces

You can't upgrade to SFOS 22.0 MR2 and later versions if the firewall contains the legacy CLI VLAN tagging on bridge interfaes. You can't restore backups containing this configuration to SFOS 22.0 GA and later. For more information, read Legacy CLI VLAN tagging is deprecated and prevents upgrades to SFOS 22.0 MR2 and later.

SFOS 22.0 MR1 and later

Legacy remote access IPsec VPN is retired

You can't upgrade to SFOS 22.0 MR1 and later versions if the firewall contains the legacy remote access IPsec VPN configuration. For more information, read Remote access IPsec VPN configuration is retired in SFOS 22.0 MR1 and later.

SFOS 22.0 GA and later

SFOS 22.0 requires additional disk space

SFOS 22.0 and later versions require additional disk space to accommodate upcoming new features and enhanced functionality. Most appliances already meet these requirements; however, a subset of desktop, virtual, and software deployments may require manual intervention before they can upgrade.

Appliances that have sufficient disk space but require resizing take a slightly longer upgrade time, ranging from two to ten minutes, because the root partition is resized during the upgrade.

Watch Upgrade paths to SFOS 22.0.
If you see a Control center alert or firmware page notification about disk space requirements, read Requirements and resolution to upgrade to SFOS 22.0 and later.

Changes in policy-based IPsec VPN behavior

In SFOS 22.0 GA and later versions, the firewall's handling of policy‑based IPsec VPN traffic has changed. Read Sophos Firewall: Site-to-site policy-based IPsec VPN behavior change in SFOS 22.0 GA - Troubleshooting guide.

SFOS 21.5 GA and later

Interface names

In SFOS 21.5 GA and later versions, if any physical or logical interface has a name, hardware name, or branch name that ends in 10 or more numbers, you can't see the physical interfaces or expand them to see the logical interfaces on Network > Interfaces. For example, VLAN_1234567890. The functionality of the interfaces is not affected, and traffic is processed as usual. The issue only affects the web admin console.

Before you upgrade, make sure none of the firewall interfaces have names that end with 10 or more numbers. For more information, read Physical interfaces or expansion of logical interfaces in SFOS v21 not visible.

SSL VPN

Firewalls upgraded to 21.5 GA and later versions won't establish SSL VPN tunnels with UTM9 OS. We recommend that you migrate these to 20.0 MR1 or later maintenance versions. Alternatively, you can use site-to-site IPsec or RED tunnels.

End-of-life RED devices

21.5 GA and later versions don't support the following legacy RED devices: RED 15, 15w, and 50. They were declared end-of-life in 2023. Read Sophos RED: End-of-life of RED 15/15w and RED 50.

Backup-restore

Backups restored to 22.0 GA and later

You can restore backups to firewall models with fewer ports.

Backups from versions 19.5 MR4 and later: The backup-restore assistant appears when you restore backups from XG, SG running SFOS, and XGS to XGS Series firewalls, and cloud and virtual firewalls.
Backups from versions 19.5 MR3 and earlier: The backup-restore assistant doesn't appear, and the firewall automatically maps the interfaces.

Help links

Read Backup-restore Assistant.
Use the tool to check if you can restore backups between appliance models and platforms. Check compatible devices to restore backups.
Watch Backup-restore enhancements.
To restore backups from Gen.1 to Gen.2 Wi-Fi desktop models, see Wireless models in Key interface mapping concepts.

Supported platforms

Sophos Firewall is available in the following form factors:

XGS Series firewalls
Virtual and software appliances
Cloud platforms

Additional information

For all hardware lifecycle milestones, read Retirement calendar.
For more information about the supported firmware versions, licenses, and migration, read Firewall Licenses.

Supported firmware versions

Sophos Firewall supports the following firmware versions:

Wi-Fi firmware 11.0.021 and earlier
RED firmware 3.0.011 and earlier
Sophos Connect:
- For Windows: Version 2.5 MR1 and earlier
- For macOS: Version 2.1 and earlier

Support

You can find technical support for Sophos products in the following ways:

To ask or answer questions, subscribe to blogs, and see recommended reads, visit Sophos Community.
Find how-to, configuration, and troubleshooting videos at Sophos Techvids video hub.
Visit Sophos Support.

Legal notices

Copyright © Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Sophos Firewall

Version 23.0 GA Build 371 Released on November 04, 2026

New features

AI Defense

Generative AI

Firewall AI Assistant in Sophos Fusion

REST API for automation

Quality-of-life enhancements

Redesigned firewall rule management

Top navigation

UI performance improvements

LAG members on Control center

Web exceptions

Management from Sophos Fusion (formerly Sophos Central)

Secure by design

Hotfix security updates

Extended Active Threat Response events

Multi-factor authentication

High availability and resilience

Authentication and identity

OpenID Connect SSO

Microsoft Entra ID support for Synchronized Security

Sophos Chromebook User ID SSO

Sophos Authentication for Thin Client (SATC) with XDR Sensor

Active Directory SSO support for Windows Server

Routing enhancements

Scalability and networking

DHCP moves to the modern control plane

mDNS reflector

IPv6 IPoE support

Increased zones

Web Application Firewall (WAF)

Platform support

IONOS Cloud platform

AWS S3 backup

Graphical UEFI boot support

Expanded interface driver compatibility for software ISO deployments

Version 22.0

Resolved issues

Version 23.0 GA Build 371

Known issues

Upgrading firmware and restoring backups

Upgrading firmware

Compatible versions for firmware upgrade and backup-restore

Important points to know before you upgrade

SFOS 22.0 MR2 and later

Legacy CLI VLAN tagging on bridge interfaces

SFOS 22.0 MR1 and later

Legacy remote access IPsec VPN is retired

SFOS 22.0 GA and later

SFOS 22.0 requires additional disk space

Changes in policy-based IPsec VPN behavior

SFOS 21.5 GA and later

Interface names

SSL VPN

End-of-life RED devices

Backup-restore

Backups restored to 22.0 GA and later

Help links

Supported platforms

Additional information

Supported firmware versions

Support

Legal notices

Version 23.0 GA Build 371
Released on November 04, 2026