Sophos UTM/SG End-of-life: Frequently Asked Questions

We will add to these questions in the coming weeks and months, so please check for any updates. 

Do you have further questions and comments? 

You can discuss your Sophos UTM lifecycle and migration questions here or reach out to your local Sophos representative. 

What is Sophos announcing? 

We are announcing the lifecycle milestones for most versions of Sophos UTM plus the SG Series hardware appliances. These conclude with an End-of-Life (EOL) date of June 30, 2026. 

Which Sophos UTM products are impacted? 

The following products are impacted by one or more of the lifecycle milestones: 

• Sophos UTM software running on any SG Series hardware. 
• Sophos UTM used as a software only installation on third-party hardware. 
• Sophos UTM running in a virtual environment. 
• Sophos UTM Home Edition. 
• SG Series hardware appliances. 

Which Sophos UTM products are NOT impacted? 

Sophos UTM on Amazon Web Services (AWS) is explicitly excluded from this end-of-sale announcement. 

Why is Sophos making this announcement? 

Sophos has built a powerful, next-gen firewall platform, which seamlessly integrates with our complete product ecosystem, sharing a single management plane in Sophos Central. 

Sophos Firewall and the latest XGS Series hardware appliances provide a single, scalable architecture, built to serve customers from the smallest single-person office to large campus networks. This platform has evolved to become the firewall of choice for the majority of our customers and partners. 

What dates is Sophos announcing? 

The table below shows the relevant lifecycle milestones and the products they impact.   

See also: Retirement Calendar 

 Any order placed must not extend beyond the EOL date, June 30, 2026. If you/your customer already own/s a license which extends beyond June 30, 2026, your local Sophos representative will be happy to discuss your options.  

What about SG Series appliances running Sophos Firewall OS (SFOS)? 

For SG appliances running SFOS, the equivalent XG Series lifecycle milestones apply. 

The Sophos lifecycle policy states: 

“When running SFOS on an SG appliance, the EOS/Last renewal/EOL dates of the corresponding XG model will apply.” 

 We would strongly encourage existing SG Series customers, who are already running SFOS, to make use of our promo to upgrade to the XGS Series at a significant discount. Your local partner can provide further details. 

How does this announcement impact me/my customer? 

The following table outlines how and when you will be impacted by the lifecycle changes. 

Where can I find the expiry date of my license? 

You can check the expiry date of a Sophos UTM license and any associated subscriptions in the product’s WebAdmin.  

Select Management > Licensing from the WebAdmin menu after login.  

You or your partner can also confirm your recorded expiry date by logging into MyUTM and searching for the license ID for the relevant UTM/SG installation. If the expiry date shown in MyUTM differs from that shown in the product WebAdmin, download a new copy of the license from MyUTM and apply it to your product. 

My UTM license is not due to expire for some time, can I do an early renewal? 

Yes, early renewals are possible. The expiry date of any subscription must not extend beyond the EOL date, June 30, 2026. 

What migration paths are available for Sophos UTM/SG Series customers? 

The primary migration path for UTM customers is Sophos Firewall OS (SFOS) plus the XGS Series appliances for those using SG hardware.  

In some cases, we recommend using additional products: 

• Customers using UTM Email Protection will benefit from a more feature-rich experience if they migrate to Sophos Central Email Advanced. 
• Customers using Sophos UTM to manage wireless networks with supported AP or APX Series access points can currently migrate to Sophos Central Wireless at no additional cost. 
• Customers using older or EOL legacy AP Series access points will need to upgrade their APs. 
• Customers using older RED devices, may need to migrate to more recent models to ensure they are supported in SFOS.  

Customers using the legacy Sophos SSLVPN agent, or the IPsec VPN Agent provided by NCP, will need to migrate to using Sophos Connect client. You should also consider whether Sophos ZTNA is a more appropriate solution for your remote connectivity needs. 

Are there migration tools available to help me move to Sophos Firewall? 

We would always recommend that you start with a fresh installation when moving to Sophos Firewall. This has proven to be the best practice, shared by our partners who have helped their customers with numerous migrations over the past months.  

Sophos has provided partners with a couple of migration tools which can be used under some circumstances. We also have a Migration HelpDesk which your partners can access. 

For some more complex deployments, further assistance may be required. Your Sophos partner can advise you on the best course of action for your individual scenario. 

Is it possible to do a trial of Sophos Firewall? 

Yes, you can request a trial via our website, or reach out to your Sophos partner for further assistance. 

Can you provide customer references for Sophos Firewall? 

In addition to the experiences shared here on the Sophos Community, you can read the many reviews from Sophos Firewall customers around the globe on the Gartner® Peer Insights website.

Product behavior

Will my Sophos UTM installation keep running after the end-of-life date?

Sophos UTM deployments that still have a valid license and subscriptions will continue to run after the end-of-life date but over time, functionality and security will be degraded.

Features that depend on pattern updates or live lookup services will be immediately impacted.

The following updates and live services will stop on, or shortly after July 1, 2026:

• Anti-virus signature and engine updates, for both the Sophos and Avira engines
• IPS signature and engine updates
• Anti-spam (SASI) signature and engine updates
• URL classification lookups (SXL)
• Advanced Threat Protection data updates

You will no longer be protected against new threats or the latest changes to website categorization.

As these services shut down and the installed data and engines age, the behavior of the features that depend on those components may become unreliable. Web Filtering, Email Filtering, and Intrusion Prevention in particular may fail and cause traffic disruption beyond the failure to detect new threats.

Basic Firewall and others features that do not depend on data services or updates, such as routing, VPN, high availability and reporting should not be directly impacted.

After the end-of-life date:

• there will be no further updates to the Sophos UTM operating system and software.
• In the event that vulnerabilities are discovered in any components, Sophos will not provide patches or fixes.

This may result in the product, your data, and networks protected by the UTM/Firewall becoming increasingly vulnerable to attack. We strongly advise against using any EOL product. As a business, this could seriously impact your compliance status.

Can I keep running Sophos UTM after my current license or subscriptions expire?

When feature subscriptions expire, the affected features will no longer be available for use. You will see warnings in the WebAdmin user interface that features are not licensed.

When all feature subscriptions expire, the system reverts to the Essential Firewall (base license) with very limited functionality. For more information about features and subscriptions, see this page in the Sophos UTM documentation: Licensing (sophos.com)

On hardware appliances with licenses appropriate to the appliance model, the WebAdmin will continue to be available but unlicensed features will be unavailable.

On installations with software or virtual machine licenses, the WebAdmin user interface will only allow access to the license upload page. It is no longer possible to configure the device or view reports or other information.

Can I use my SG Series hardware appliance for some other purpose after upgrading to an XGS appliance, or after the end-of-life?

You are welcome to try. However, Sophos will not provide support for running anything other than the appropriate Sophos UTM or Sophos Firewall software/firmware on the device. Sophos will not provide support beyond the stated end-of-life dates for the software or hardware products.

As a piece of hardware in general, you may be able to re-use or recycle various components from your appliance for other purposes.

Formatting updates
[edited by: BarbaraH at 8:33 AM (GMT -7) on 20 Apr 2023]