Licensing
docs.sophos.com/nsg/sophos-firewall/18.5/Help/enus/webhelp/onlinehelp/AdministratorHelp/Administration/Licensing/index.html
Feb 8, 2023
You can activate your evaluations and subscriptions. You can also synchronize your
licenses.
Device registration and license activation
To see the device registration details and the status of the licenses, go to
Administration > Licensing.
The firewall fetches the following registration details from your Sophos Licensing Portal
account:
Model number and the device key.
Company name with which you've registered the firewall.
Contact person in your organization.
Email address used to register the firewall.
The modules show as Unsubscribed when you set up the firewall for the first time. See
FAQs for registration.
Synchronizing licenses
If Sophos Firewall is connected to the internet, the firewall synchronizes with the Sophos
Licensing Portal every 24 hours, and licenses are updated automatically.
You can synchronize the licenses manually for the latest subscriptions. Click
Synchronize next to Module registration details.
Activating license keys
You can activate paid and trial licenses.
To activate paid subscriptions, do as follows:
1. Go to Administration > Licensing.
2. Under Device registration details, click Activate subscription.
3. Enter the license key you received from Sophos.
4. Click Verify key.
5. After the key is verified, click Confirm.
6. Click Synchronize to synchronize the firewall with the licensing system.
The firewall updates the subscriptions list.
See FAQs on activating license keys.
1/4
See the video Registration and basic setup.
Module subscription details
You can subscribe to the license modules as follows:
With a license key (paid subscription).
Without a license key for a 30-day trial (free subscription).
Note
If you want to evaluate a module again later, you can activate its evaluation in the next
major version.
Example: If you had evaluated Zero-day protection in version 18.5 but didn't buy it, you
can activate its evaluation again in 19.0.
You can see the status of the subscriptions and their expiration date. Statuses can be one
of the following:
Subscribed
Evaluating
Not subscribed
Expired
License bundles
The following license bundles are available for XGS and XG Series firewalls:
Xstream Appliance Bundle
Standard Appliance Bundle
Base License
Base License
Xstream protection
Network Protection
Web Protection
Zero-Day Protection
Central Orchestration
Enhanced Support
Standard protection
Network Protection
Web Protection
Enhanced Support
Individual licenses and firewall features
You can also subscribe to individual licenses. The licenses deliver the following features:
Base License: Stateful Firewall, VPN, Wireless.
Network Protection: Intrusion Prevention (IPS), Advanced Threat Protection
(ATP), SD-RED Device Management.
Web Protection: Web Security and Control, Application Control, Web Malware
Protection.
2/4
Zero-day protection: Machine Learning, Sandboxing File Analysis, Threat
Intelligence.
Central Orchestration: SD-WAN VPN Orchestration, CFR Advanced.
Email Protection: Anti-spam, Antivirus, DLP, Encryption, Email Malware
Protection.
Webserver Protection: Web Application Firewall.
Note
For Support subscriptions, see Support scope and communication methods.
See Licensing guide for Sophos Firewall.
Licenses for high-availability cluster
Active-passive HA: You must activate the licenses on the device you've configured as
the initial primary. Don't activate them on the auxiliary device. The cluster uses the
licenses of the primary device.
Active-active HA: Both Sophos Firewall devices need the licenses. The licenses must be
the same for both devices. See HA licensing FAQs.
Activating licenses for airgap
Airgap installations are physically isolated deployments and aren't connected to the
internet. You can update their licenses manually.
Airgap isn't available for all deployments. See the following:
Sophos only approves airgap requests if you have a network that isn't connected to
the internet and doesn't have any Sophos Firewall MSP Flex licensed firewalls.
Airgap is available only for hardware devices.
Note
Your Sophos account manager must approve air gap deployment for your Sophos Firewall
hardware. You can request air gap access with your account manager at the time of
purchase.
To update the license for airgap deployments, do as follows:
1. Download the license file from your Sophos Licensing Portal account.
2. Sign in to the web admin console and go to Administration > Licensing.
A section Manual license synchronization shows up for airgap firewalls.
3. Select the license file.
4. Click Update license.
See How airgap and manual pattern update works.
3/4
Transferring licenses to another Sophos Firewall
You must transfer your license to another appliance in the following cases:
Active-passive HA: You've activated the licenses on the auxiliary device and must
transfer them to the primary.
Replacement: You're replacing your current Sophos Firewall device with a
different one.
License purchase after trial: You've purchased the licenses after an evaluation.
See License transfer for Sophos Firewall.
Upgrading from UTM to SFOS
You can migrate the UTM 9 licenses to licenses of SFOS installed on SG appliances. We
then transfer your UTM 9 licenses to equivalent SFOS licenses.
Note the following:
The SG Series firewall must be registered.
You can't migrate UTM 9 licenses to SFOS on Sophos Firewall appliances.
After migrating the licenses to SFOS, you can't migrate back to the UTM 9 licenses.
Restriction
This option is only available if you upgrade to SFOS licenses on SG Series firewalls.
See License migration.
See Licensing guide for Sophos Firewall.
Was this page helpful?
© 2023 Sophos Limited.
4/4