In short: Sophos Firewall licensing starts with a base licence (included with XGS hardware) for networking and VPN. Protection is added as a bundle or modules: Xstream Protection includes Network, Web and Zero-Day Protection, Central Orchestration, DNS Protection and Enhanced Support, while Standard Protection includes Network and Web Protection with Enhanced Support. Support is required for firmware updates.
How Sophos Firewall licensing works
Every Sophos Firewall needs three things to be properly protected and supported:
- A base licence: required for all firewalls. It covers networking, the Xstream architecture, wireless controller functions for built-in Wi-Fi and APX access points, unlimited remote access and site-to-site VPN, SD-WAN and on-box reporting. It comes with XGS hardware but is ordered separately for virtual, software and cloud firewalls.
- Protection subscriptions: the security features, bought as a bundle or as individual modules. Without a valid subscription you can still configure a feature, but the firewall will not enforce it.
- Support: Enhanced Support is included in every bundle. If you buy modules individually, you must add a support subscription to receive firmware updates and full access to Sophos support.
Subscriptions are sold for a fixed term. Appliance bundles that combine the hardware with a subscription are also sold in some regions. The licences are held against the firewall's serial number in Sophos Fusion (formerly Sophos Central).
Xstream Protection vs Standard Protection
Sophos's firewall brochure lists two bundles: Xstream Protection, which Sophos recommends and which we quote by default, and Standard Protection for organisations that want a smaller core. You can also build your own set of modules.
| Included | Xstream Protection | Standard Protection |
|---|---|---|
| Network Protection (IPS, Active Threat Response with Sophos X-Ops feeds, Security Heartbeat, SD-RED management) | Yes | Yes |
| Web Protection (web security and control, application control) | Yes | Yes |
| Zero-Day Protection (machine learning and cloud sandboxing) | Yes | No (module) |
| Central Orchestration (SD-WAN VPN orchestration, Central Firewall Reporting Advanced with 30 days of data, XDR and MDR data connector) | Yes | No (module) |
| DNS Protection | Yes (bundle only) | No |
| Active Threat Response with MDR, XDR and third-party threat feeds | Yes (bundle only) | No |
| NDR Essentials | Yes (bundle only) | No |
| Enhanced Support | Yes | Yes |
The important point is the last three "bundle only" rows. DNS Protection, NDR Essentials and the ability to take threat feeds from Sophos MDR, Sophos XDR and third parties are not sold separately, so you cannot add them to Standard Protection later. If you run, or may move to, Sophos MDR, Xstream Protection is the right choice.
NDR Essentials originally ran only on XGS hardware; since v22 MR1 it is also available on virtual, cloud and software firewalls. For full network detection inside your LAN, the separate Sophos NDR sensor is a different product.
Individual modules and add-ons
| Module | What it adds |
|---|---|
| Network Protection | IPS, Active Threat Response with Sophos X-Ops feeds, Security Heartbeat, SD-RED management and reporting |
| Web Protection | Web security and control, application control and reporting |
| Zero-Day Protection | Machine learning and sandbox analysis of unknown files |
| Central Orchestration | SD-WAN and VPN orchestration, 30 days of advanced cloud reporting and the XDR/MDR data lake connector |
| Email Protection | On-box anti-spam, anti-malware, data loss prevention and email encryption |
| Web Server Protection | Web application firewall and reverse proxy for servers published to the internet |
Email Protection and Web Server Protection are sold only as individual modules, so they are added to either bundle when needed. Many organisations on Microsoft 365 protect email in the cloud with Sophos Email instead of on the firewall.
The ZTNA gateway on the firewall is available at no extra cost; the user-based ZTNA licences are sold separately, now as part of Sophos Workspace Protection. Any protection bundle, individual subscription or support contract also unlocks Sophos Fusion group management, cloud backups, firmware scheduling and zero-touch deployment. A firewall with only the base licence does not get Fusion management.
Firewall reporting tiers
| Tier | How you get it | Cloud data retention |
|---|---|---|
| On-box reporting | Base licence | Historical logs and reports held on the appliance while it is in its active lifecycle |
| Central reporting | Any protection bundle, individual subscription or support (not the base licence alone) | Up to 7 days in Sophos Fusion |
| Central Firewall Reporting Advanced | Included with Xstream Protection through Central Orchestration | 30 days, with custom reports you can save, schedule and export |
| Extra reporting storage | Optional purchase | Longer retention for historical and compliance reporting |
Sophos calculates the 30-day figure on average traffic for each appliance size, so a busy firewall may hold less. When you replace a firewall, Central Firewall Reporting licences do not move automatically with the firewall licence and must be transferred separately to keep your history. Organisations that need longer log retention for compliance should also look at Sophos Next-Gen SIEM, which works with XDR and MDR.
Support levels and high availability
- Enhanced Support (in every bundle): 24/7 support access, firmware and feature updates, and advance replacement hardware warranty for the term
- Enhanced Plus: an upgrade with VIP support, hardware warranty for add-ons and an optional technical account manager at extra cost
- Base licence only: no firmware updates, no Sophos Fusion management and no full access to Sophos support until you add support or a subscription
- Active-passive HA: only the primary needs licences, and the auxiliary holds a copy so it can take over. Enhanced Plus is needed on the primary for advance replacement of the passive unit. A virtual or software active-passive pair needs a base licence for the primary only
- Active-active HA: both appliances need licences of the same types (expiry dates can differ), and virtual or software pairs need a base licence each
When a subscription expires the firewall keeps its configuration but stops enforcing that feature. For example, without Network Protection IPS stops, and without Web Protection web policies and malware scanning stop. In an HA pair, the primary must also reach Sophos's licensing servers at least once every 90 days or protection from unsynced licences stops. Renewing on time matters.
Renewals, upgrades and how we quote
Common questions we help with at renewal:
- Standard to Xstream: moving up a bundle at renewal adds Zero-Day Protection, DNS Protection, NDR Essentials and MDR threat feeds without new hardware
- Hardware refresh: replacing an appliance usually means renewing onto the new appliance and transferring reporting licences
- Co-terming: aligning firewall renewals with Sophos Endpoint and other subscriptions so everything renews together
- Wider licensing: our Sophos licensing guide explains how firewall subscriptions fit with endpoint, MDR and add-ons
We never publish prices. Your cost depends on the appliance or virtual size, the bundle, any extra modules, reporting and the term, so ask us for a quote. Contact us with your firewall serial numbers or renewal notice, and we will explain your options in writing.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is included in Sophos Xstream Protection?
Xstream Protection includes Network Protection, Web Protection, Zero-Day Protection, Central Orchestration, DNS Protection and Enhanced Support, plus bundle-only features: NDR Essentials and Active Threat Response with Sophos MDR, Sophos XDR and third-party threat feeds.
What is the difference between Xstream Protection and Standard Protection?
Standard Protection includes Network Protection, Web Protection and Enhanced Support. Xstream Protection adds Zero-Day Protection, Central Orchestration, DNS Protection, NDR Essentials and MDR, XDR and third-party threat feeds, several of which cannot be bought separately.
Do I need a support subscription for Sophos Firewall?
Yes, in practice. Enhanced Support comes with every bundle. If you buy individual modules, you must add support to receive firmware updates and full access to Sophos support.
Is the base licence included with a Sophos firewall?
It is included with XGS Series hardware. Virtual, software and cloud firewalls need the base licence ordered separately, alongside the subscriptions you want.
What happens when a Sophos Firewall subscription expires?
Your configuration stays, but the expired feature stops being enforced. For example, intrusion prevention stops when Network Protection lapses, and web policies and malware scanning stop when Web Protection lapses. When support lapses, firmware updates and hardware replacement end.