Upgrading 17 to 18 experiences would and criticism

There is a good post about upgrades in general: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/129246/best-practice-for-sophos-firewall-firmware-upgrade

But from 17.5 to V18.0/5, there are some specialties. 

First of all, the HA will reboot at the same time. Therefore you will have a downtime of ~2-5 minutes until both appliances reboot. 

The configuration should not change and it should not have impact on your configuration but the config will look messy. Therefore some cleanup should be follow up. 

Linked NAT will be created for each and every firewall rule. This is generally speaking not needed, because you have a SNAT MASQ Rule at the bottom. 

I recommend to disable the virtual fastpath, if something behavior oddly after upgrade. The new architecture is loaded after upgrade and the new DPI engine is loaded: You can disable this via console> system firewall-acceleration disable    and in the webadmin under TLS/SSL Inspection Rule. 

I've tested on an xg115 the upgrade from 17 to 18, migrated policies are "decomposed" in the NAT rules ( and that is ok ) but are spread even in Migrated IPv4 SD-WAN policy route resulting in Firewall Policies option "Do not apply this migrated rule to system-destined traffic" checked and grayed out. Do I have to manually create again all firewall policies to clean all this mess? 

See: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/RoutingSDWANPolicyRoutesMigrated.html

Firewall Rules are only having a Checkbox, indicating there was a rule created. This checkbox does not matter. 

Check the Sd-WAN Rules and read the Online help carefully. 

See: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/RoutingSDWANPolicyRoutesMigrated.html

Firewall Rules are only having a Checkbox, indicating there was a rule created. This checkbox does not matter. 

Check the Sd-WAN Rules and read the Online help carefully.