Sophos Firewall OS v19 MR1 introduces changes to our support licensing and future access to firmware upgrades
Currently planned for July 19, 2022, the soft release of Sophos Firewall OS (SFOS) v19 MR1, will introduce some changes to the scope of our support licensing and future access to firmware upgrades.
Once a firewall is running v19 MR1 or later, subsequent firmware upgrades will require a valid support subscription. To allow customers without support sufficient time to add the subscription, the first three firmware upgrades after MR1 will be free.
Once the allocation of three free upgrades is exhausted, the support requirement comes into effect and further firmware upgrades will only be possible if a valid support subscription is available.
Customer Scenario
Immediate Action Required
Future Action Required
Owns a valid support subscription
Applies to Enhanced and Enhanced Plus
None
None, as long as support remains valid
Has no support subscription
e.g., using Base License or individual à-la-carte subscription only
None - eligible for next three upgrades after v19 MR1
Purchase support to continue receiving upgrades
Using a Trial license
None, support is included
None, no change
Using a Home license
Customers who have a valid support subscription
For the approx. 80% of Sophos Firewall customers who already have a valid Enhanced or Enhanced Plus support subscription, there will be no change.
Customers who do not own a support subscription
Customers who have just a Base license or an individual à-la-carte security subscription without support today, do not need to take any immediate action. However, to continue receiving firmware updates, they will need to add a support subscription once they have used their allocation of three free firmware updates after installing MR1.
Customers who have a trial license
Customers with a trial license are not affected as that includes support for the trial period.
Customers who have a Home license
Customers with a Home license are not affected.
Note: The three free upgrade limitation mentioned below applies to customers without an active support subscription only.
The allocation of three firmware upgrades postpones the enforcement of the support requirement even when there is no active support subscription. This is in addition to the initial install wizard firmware update.
Any Early Access Program (EAP), General Availability (GA), or Maintenance Release (MR) firmware version which is installed after upgrading to v19 MR1.
These updates will continue to be provided for any product which has not yet reached its end-of-life date for all customers and will not be deducted from the three-free-update allocation for customers without support.
Re-imaging the appliance with the ISO will continue to work as it does today. Any firewall without a support subscription can also be re-imaged with the ISO of any newer firmware, which will not be deducted from the three-free-update allocation. Re-imaging the appliance resets the free upgrade allocation when there is no active support subscription.
Firmware upgrades and mandatory firmware from the initial install wizard will work as today and will not be deducted from the three-free-update allocation.
For customers without support, this will be shown in the user interface.
If you don’t have an active support subscription and have used your free upgrade allocation, further firmware upgrades will NOT be possible. This applies to firmware updates from the user interface, using OpCode, SFLoader, or from Sophos Central. Customers will need to purchase a support subscription to continue receiving upgrades.
There is no impact on the backup-restore workflow. Firmware upgrades (incl. free upgrades) are independent of device configuration and therefore, backup-restore will work as today.
While this practice is new for us (with the exception of Sophos Switch), it is the standard for many of our competitors for their firewalls, switches, wireless access points and more.
Support should be an essential part of every firewall project.
We plan to send emails to all partners who have sold/own, and customers who own Sophos Firewall around July 14, 2022.
For Active Passive HA Configuration, how is this covered?
https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/SystemServices/HighAvailability/HAPrerequisites/index.html
Currently, only the active firewall needs a license....
Licensing of HA A-P cluster is governed by the Active node licenses, hence, firmware upgrade of HA A-P cluster is NOT dependent on the support subscription of the Passive node. One will need the support subscription on Active node to upgrade the firmware of both devices in HA A-P cluster.
Let me get this straight: in case of HA A-P, you need (on the Active node) Enhanced Support or Enhanced Plus Support to upgrade the firmware of both devices? Thanks
Correct. You will need the support subscription on Active node (one device) to upgrade the firmware of both devices in HA A-P cluster.
Additionally, you need to have Enchanced Plus to get an RMA / Replacement for the Aux Unit.
Enhanced on the Active and Enhanced Plus on the Passive? Or the Enhanced Plus on the Active covers also the Passive? Thanks
See: https://docs.sophos.com/support/plans/en-us/Sophos-Support-Services-Guide.pdf
You need Enhanced Plus on the Primary. This will cover the RMA Process of the Second appliance as well.