Overview

This knowledge base article answers the frequently asked questions on High Availability (HA) licensing.

The following questions are answered:

• What licenses do I need when I have 2 appliances in High Availability mode
  • For Active-Active mode
  • For Active-Passive mode

Applies to the following Sophos products
Sophos Firewall XG Software
Sophos Firewall

What licenses do I need when I have 2 appliances in High Availability mode

For Active-Active mode:

• Each appliance requires its own subscriptions and the active subscriptions must match on both appliances.
  
• Sandstorm does not affect the HA setup regardless of the expiry date in each device.

For Active-Passive mode:

• Only the Active appliance requires subscriptions and SF-OS will ensure that the Passive appliance has a copy of those subscriptions, so it can take on processing if the Active appliance fails.
  It is therefore vital that the subscriptions are activated on the intended Active appliance and one has to ensure that HA is enabled only from the appliance which has a valid subscription.
• If a Software/Virtual device is used, you need to purchase only one Base license and once that Serial Number is registered, SF-OS will manage the creation of the Passive appliance; there is no need to purchase a separate Base Firewall license for the Passive device or a separate serial number.
• The XG Firewall that carries the license subscription must be configured as the primary node in the HA initial setup.
• The initial HA primary node must be the primary node all the time.
• If the initial HA primary node becomes the auxiliary after a reboot or HA fail-over, please make it the primary node again by putting the initial auxiliary (which is currently the primary node because of a reboot or fail-over) on standby. To do this, go to System services > High availability and then click on Switch to passive device.
  
  
  
  Reason: When HA fail-over happens, the initial primary node becomes the auxiliary node and the HA cluster can run for 90 days with the license subscription of the initial primary node. After 90 days, the HA cluster syncs to the license of the current primary node (initial auxiliary node). Normally the initial auxiliary node has no license subscription, therefore, the HA cluster loses its license subscription and now works as a router only.
  

Note: Active/Passive is not yet available for XG in Azure.

Related information

• XG Firewall: Licensing guide
• XG Firewall: FAQ on activating XG license keys
• XG Firewall: FAQ on the migration of Sophos SG, Cyberoam NG, and iA licenses
• XG Firewall: FAQ on new registration
• XG Firewall: Activation and registration error messages

Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.