Looking to upgrade our UTM hardware - what are our options?

Can you post the dashboard of the performance graphs when you have a heavy usage of that box?

You mean this one? I've marked two instances where the UTM flat out failed to process DNS queries as it got overloaded. 

In both instances the "culprit" was tracked to httpd processes hogging the CPU, and further investigation (using a web application firewall status page) showed there being numerous connections to our DevOps, all from a single IP, which I've then tracked to a colleague working from home. He had a VPN active, but since the VPN did not use our office as the default gateway he would be using the public IP of our DevOps (rather than the internal IP).

The issue was remediated after I asked my colleague to use a "default gateway" VPN and after I had restarted the webserver proxy service. Still, this is more of a workaround than a proper solution and that makes me nervous...

Your options are:

I would recommend either SG135 or SG210. Software cost is the main point here.

See my reply to LuCar Toni ... I'm not sure what's going on behind the scenes, but the reseller we're currently in contact with essentially told us any new SG units are impossible to get. If this is some ploy to get us to move to newer hardware and SFOS then it's rather dirty...

I wouldn't even mind moving to SFOS (and it's somewhat backwards configuration design when compared to UTM), but it lacks LE support and we need that.

We have dozens of both models available.

Cześć Mateusz,

The reseller contact you're using is misinformed and should ask his management what the complete story is.  Reading between the lines of the notice sent to Partners, Sophos will stop SG manufacturing in June and sell only remaining stock after June 30, 2023.

You might find it more cost-effective to change to the software version.

Cheers - Bob

Question is, does it make sense to invest in a product going EOL in a few years.....?

You can "convert" an SG model to an XG, there is an official procedure for that.

Given you have bought enough "horsepower" for your company, you want lose your invest.

You can "convert" an SG model to an XG, there is an official procedure for that.

Given you have bought enough "horsepower" for your company, you want lose your invest.

PhilippRusch I need to clarify my statement above.  Using the term "product", I mean both the hardware and the software. While upgrading to a more powerful version of SG should amount to restoring a previous config file, upgrading to a whole new OS is more involved. 

At one point there was a conversion utility, but not sure if that's still available. Also, due to lack of feature parity it's probably best to do the config manually anyway.

My point, if one is going to be changing software to anything else, they need to fully evaluate if the upgrade path makes sense. How well does the new software meet their needs.

Even as a home user, I dread redoing it as my config is not all that simple, with multiple vlans, granular firewall rules, several servers behind the firewall and so on. I only want to redo this once for the foreseeable future.

Jay Jay I fully agree.

For a paid license you get migration support from your Sophos partner and a specialised team at Sophos. This is to minimize efforts and risk. BUT: there is no such thing as "feature parity", you have to evaluate the functions you need and then decide.