Sophos Firewall v18: impact of expired license


Security protection on Sophos Firewall requires a Subscribed/Evaluating subscription.

If a subscription is Expired/Unsubscribed, Sophos Firewall cannot perform corresponding security protection.

Here is table of subscription and security features.

Base firewall Firewall rule, NAT rule, VPN, Wireless Protection, site-to-site RED
Network protection RED appliance, ATP, IPS, Security Heartbeat
Web protection Web Filter, Anti-virus, Application Control
Email protection Anti-spam, Anti-virus, email encryption (SPX), DLP
Web server protection WAF, Anti-virus, reverse proxy
Sandstorm Sandstorm service
Enhanced support It is the minimum subscription for RMA and Sophos Technical Support service
Enhanced plus support It provides more benefits than Enhanced support.

Reference: Sophos (XG) Firewall > Administration Help > Licensing

Base firewall

Once Base firewall becomes Expired/Unsubscribed,

  1. All firewall rules stop working, no matter they are configured to allow or block traffic.
  2. All NAT rules stop working.
    In another word, Sophos Firewall stops applying firewall rule and NAT rule on any traffic.
    The following traffic is allowed and has masquerading applied automatically by Sophos Firewall, even if there is a firewall rule to drop it. 
    • from LAN zone to WAN zone
    • from DMZ zone to WAN zone
    • from LAN zone to LAN zone
    • from LAN zone to DMZ zone
    • from DMZ zone to DMZ zone
    • from DMZ zone to LAN zone
    No other traffic except the above can traverse Sophos Firewall.
  3. No VPN cannot be established.
  4. Site-to-site RED cannot be established.
  5. AP and wireless network stop working.

It applies to Sophos Firewall v18 only.

On Sophos Firewall v17.5 MR15 and earlier, firewall rule and NAT rule still work even if Base Firewall becomes Expired/Unsubscribed.

Email protection

Once Email Protection becomes Expired/Unsubscribed, Sophos firewall delivers email without anti-spam/anti-virus scanning.

It applied to Sophos Firewall v17.5 and v18.

Enhanced support, Enhanced plus support

If both Enhanced support and Enhanced plus support are expired/unsubscribed, Sophos cannot provide RMA and Technical Support service.

It applied to Sophos Firewall  v17.5 and v18.

Edition history

2022-01-14, fixed expired URL

2021-05-31, updated with section "Email protection"

2021-05-24, first release

fixed expired URL
[edited by: taowang at 2:15 AM (GMT -8) on 14 Jan 2022]