Thread Info
  • Replies 17 replies
  • Subscribers 30 subscribers
  • Views 12025 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall: Impact of expired license

taowang

Overview

Security protection on Sophos Firewall requires a Subscribed/Evaluating subscription.

If a subscription is Expired/Unsubscribed, Sophos Firewall cannot perform corresponding security protection.

Here is table of subscription and security features.

Base Firewall Firewall rule, VPN, Wireless Protection, NAT rule, site-to-site RED
Network Protection IPS, ATP, SD-RED device, Security Heartbeat
Web Protection Web Filter, Application Control, Anti-virus
Zero-day Protection Machine Learning, Sandboxing File Analysis, Threat Intelligence
Central Orchestration SD-WAN VPN Orchestration, Central Firewall Reporting Advanced
Email Protection Anti-spam, Anti-virus, DLP, Encryption (SPX), Email Malware Protection
Web Server Protection WAF, Anti-virus, reverse proxy
Enhanced Support It is the minimum subscription for
  • RMA,
  • Sophos Technical Support service, and
  • firmware upgrade*.
* It applies to v19.0 MR1 and later. More details in the section Enhanced support, Enhanced plus support
Enhanced Plus Support It provides more benefits than Enhanced support. Details in Sophos Support Service Guide.

Reference: Sophos Firewall > Administration Help > Licensing

Base Firewall

Once Base Firewall becomes Expired/Unsubscribed,

  1. Sophos Firewall stops applying firewall rule and NAT rule on any traffic.
    • All firewall rules stop working, no matter they are configured to allow or block traffic.
    • All NAT rules stop working.
    • The following traffic is allowed and has masquerading applied automatically by Sophos Firewall, even if there is a firewall rule to drop it.
      • from LAN zone to WAN zone
      • from DMZ zone to WAN zone
      • from LAN zone to LAN zone
      • from LAN zone to DMZ zone
      • from DMZ zone to DMZ zone
      • from DMZ zone to LAN zone
      No other traffic except the above can traverse Sophos Firewall.
  2. No VPN cannot be established.
  3. Site-to-site RED cannot be established.
  4. AP and wireless network stop working.

It applies to Sophos Firewall v18 and later.

Email protection

Once Email Protection becomes Expired/Unsubscribed, Sophos firewall delivers email without anti-spam/anti-virus scanning.

It applied to all Sophos Firewall OS versions.

Enhanced support, Enhanced plus support

If both Enhanced support and Enhanced plus support are expired/unsubscribed

  • For all Sophos Firewall OS versions, Sophos cannot provide RMA and Technical Support service.
  • For Sophos Firewall OS v19.0 MR1 and later, the firewall has 3 free firmware upgrade, and further firmware upgrades will only be possible with a valid support subscription. It does not impact the trial license, home use license or firmware upgrades from the install wizard

Edition history

2022-12-09, updated the section "Enhanced support, Enhanced plus support"

2022-09-29, minor update

2022-07-19, updated for v19.0 MR1

2022-01-14, fixed expired URL

2021-05-31, updated with section "Email protection"

2021-05-24, first release



minor update
[edited by: taowang at 11:46 AM (GMT -8) on 9 Dec 2022]
Parents

  • This is messed up, I've bought a device that would have worked until his death and now it will be just a white brick only because I've updated to V18. I'll roll back to V17.5 for the next days and in the meanwhile I'll buy a firewall of a different brand!

    What a shame Sophos!

  • in reply to Andrea_e

    What do you mean? Base License is valid until 2999. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    I read that "Sophos Firewall v18: impact of expired license" and on the 1st of April the licenses of my XG 125 are going to expire.
    I gotta say that I didn't read which license, I've just seen a list of licenses.
    But if the base firewall never expire, why in this article there is this "Once Base firewall becomes Expired/Unsubscribed"?
    By the way, I see that the Webserver protection is expiring, so it still means that I have to renew the licenses (I'm looking for the prices and I really don't understand which license should I get, is there a comparison of the different licenses with the relative features?).

  • in reply to Andrea_e

    There are certain scenarios, which can lead to a deactivated/expired Base License. This article is just a complete view of all scenarios. But for the general customer, the base license will not expiry. 

    SFOS comes with a set of licenses, which activate features. Thats the subscription model. So if you do not have any license, you still have access to the base license. Check this PDF for the features in each subscription. 

    https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-firewall-br.pdf 
    Page 5 / 6 
    (It is about XGS Hardware, but the subscription model is the same). 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    I see, it seems I jumped to quickly to conclusions!

    I need the Standard Protection Bundle and the Web Server Protection, but my distributor doesn't have the latter, it only has standard, enhanced and xtream bundles...how can I buy what I need?
    Thanks

  • in reply to Andrea_e

    Bundle basically means Hardware + Software. So you need the Standard Protection + Webserver Protection as a "a la card" license. They should be able to generate you an offer for you appliance. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni
    LuCar Toni said:
    What do you mean? Base License is valid until 2999. 

    Is it though? My understanding is that the current policy is to downgrade Base License validity to match product EOL date, essentially sabotaging the system with a kill switch. Is this incorrect?

  • in reply to lu_ne

    See: https://partners.sophos.com/prm/English/c/sophos-license-activation-policy 

    Generally speaking: Running End of Life Hardware without any updates (Security, Pattern etc.) is a bad idea. If no EOL is announced, the Base License will still be Y2999. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni
    LuCar Toni said:
    Generally speaking: Running End of Life Hardware without any updates (Security, Pattern etc.) is a bad idea.

    This is a subterfuge, not an answer, and I take it as confirmation of what I said, that Sophos is actively going to sabotage products to become virtually useless and obsolete after a period that they established, and that's actually a worse idea in my opinion.

    LuCar Toni said:
    If no EOL is announced, the Base License will still be Y2999. 

    That's like saying that the day is as long as the night is short. Every product (where applicable) gets an EOL date eventually, so it seems that "wordplay" means that every product will be sabotaged by Sophos except those that aren't yet. Essentially, Y2999 is meaningless in the sense that currently no product has an EOL past 2026.

    Thanks for not answering though.

Reply
  • in reply to LuCar Toni
    LuCar Toni said:
    Generally speaking: Running End of Life Hardware without any updates (Security, Pattern etc.) is a bad idea.

    This is a subterfuge, not an answer, and I take it as confirmation of what I said, that Sophos is actively going to sabotage products to become virtually useless and obsolete after a period that they established, and that's actually a worse idea in my opinion.

    LuCar Toni said:
    If no EOL is announced, the Base License will still be Y2999. 

    That's like saying that the day is as long as the night is short. Every product (where applicable) gets an EOL date eventually, so it seems that "wordplay" means that every product will be sabotaged by Sophos except those that aren't yet. Essentially, Y2999 is meaningless in the sense that currently no product has an EOL past 2026.

    Thanks for not answering though.

Children
No Data
Unfiltered HTML