In short: Sophos XG Series firewall hardware reached end of life on 31 March 2025. Subscriptions can no longer be renewed, support and hardware replacement have ended, and firmware updates have stopped. Because XGS appliances run the same Sophos Firewall OS, most organisations can move by backing up the XG configuration and restoring it on an equivalent XGS appliance.
What Sophos XG end of life means
Sophos set 31 March 2025 as the end-of-life date for all XG Series hardware appliances. After that date:
- No renewals: protection subscriptions and support can no longer be renewed for XG hardware
- No support or replacement: Sophos technical support and hardware replacement for XG appliances have ended
- No firmware updates: Sophos stopped software updates shortly after the end-of-life date, and Sophos Firewall v22 does not support XG hardware at all, so its security fixes and new features never reach an XG box
- Protection fades as subscriptions lapse: when a subscription expires the firewall stops enforcing that feature. IPS stops without Network Protection, and web filtering and malware scanning stop without Web Protection
Sophos's documentation also notes that the base firewall licence on a hardware appliance expires when the device reaches end of life, unlike on virtual, software and cloud firewalls. Whatever an individual XG box is still doing today, it is unpatched and unsupported, and it should be replaced.
The end-of-life applies to the XG hardware. The software, now called Sophos Firewall, carries on and runs on the current XGS Series.
Why it matters for UK organisations
A firewall is the device most exposed to the internet, and network edge devices are a frequent target for attackers. Running one without security updates is a real risk, and it also creates compliance problems:
- Cyber Essentials requires devices, including firewalls, to run supported software with security updates applied. An end-of-life firewall makes certification difficult; see the Cyber Essentials requirements
- Cyber insurance questionnaires commonly ask whether network devices are supported and patched
- UK GDPR expects appropriate technical measures to protect personal data, which is hard to argue with unsupported security hardware
If you also still run Sophos UTM, plan that move at the same time. UTM is a separate, older product with a different operating system, so its configuration cannot simply be restored onto an XGS. Sophos converts it with a migration utility and Sophos Firewall Config Studio instead, and we can handle both migrations in one project.
How to migrate from XG to XGS
Because XG and XGS run the same Sophos Firewall OS, your configuration can usually be moved rather than rebuilt. The outline process from Sophos's migration documentation:
- Choose the replacement: Sophos maps each XG model to an equivalent XGS model, but check that choice against today's traffic with inspection switched on rather than treating it as a like-for-like swap
- Check the XG firmware: on 19.5 MR4 or any 20.0 version, the backup-restore assistant can map interfaces for you. Older versions can still be restored directly, or upgraded first (to 19.5 MR4, or 20.0 MR2 or later) to gain the assistant
- Back up the XG: take a configuration backup. If you use a secure storage master key, have the key and the backup encryption password ready
- Start the XGS: the XGS setup assistant upgrades it to the latest firmware. You can also use zero-touch deployment from Sophos Fusion for remote sites
- Restore and map interfaces: restore the XG backup on the XGS and map the old ports to the new ones
- Rebuild HA if needed: a restore does not carry high availability settings, so configure the HA pair on the XGS afterwards
- Move licences and reporting: claim the XGS in Sophos Fusion and apply its licences. Central Firewall Reporting licences must be transferred separately to keep your reports, and on-box reports do not move across
- Reconnect Fusion services: add the XGS to its Sophos Fusion groups, rejoin SD-WAN connection groups (first deleting the rules and IPsec tunnels that Sophos Fusion created on the new firewall, which carry a Central prefix) and point any ZTNA gateway at the XGS
- Cut over and check: move SD-RED devices and access points to the XGS, test rules, VPNs and remote sites, then retire the XG
For larger or messy configurations, Sophos Firewall Config Studio (formerly the Configuration Viewer) can produce a readable configuration report, compare two configurations and edit them before you go live. Sophos's migration guidance also notes that firewall migrations generally fall outside its normal break/fix support, and it recommends a fresh, clean installation or help from a specialist, so decide early who will do the work.
Things that catch people out
- Flexi Port modules: expansion modules from XG appliances are not compatible with XGS, so budget for new ones if you need extra ports
- Port layouts: XGS appliances often have different numbers and speeds of ports, so interface mapping needs care, especially for fibre and LAG links
- Remote access VPN: legacy remote access IPsec VPN was retired in v22 MR1, so plan to move users to SSL VPN with the Sophos Connect client or to Sophos ZTNA
- Access points and SD-RED: devices attached to the XG become available on the XGS once the XG is disconnected. Check the age and support status of older access points and RED units before cutover, and note that APX Series access points reach end of life on 31 December 2027
- Reporting history: on-box reports stay on the old appliance, so export anything you need to keep before you retire it
Should you move to XGS or review the design?
An end-of-life refresh is a good moment to check that the network still fits the business:
- If you have several sites, consider SD-WAN and SD-RED, managed centrally in Sophos Fusion
- If you only have basic protection, review whether the Xstream Protection bundle is worth it for DNS Protection, NDR Essentials and MDR threat feeds
- If you are replacing Wi-Fi and switches too, Sophos Wireless and Sophos Switch add Active Threat Response isolation at the access layer
- If servers have moved to Azure or AWS, part of the estate may be better served by a virtual or cloud Sophos Firewall
We also supply Cisco Secure Firewall and Meraki MX, so if a different platform fits better, we will say so.
How we help
Forever Systems runs XG to XGS migrations for UK organisations. We audit the XG configuration, size the XGS, and either pre-stage the appliance with your restored configuration or build a clean configuration where the old one has grown messy, plan the cutover out of hours and stay on hand afterwards to tune rules and VPNs. We can also run the v22 Health Check on the new firewall and fix what it flags.
Ask us for a quote for the appliance, subscriptions and migration work. Contact us with your XG serial numbers, and we will confirm the right replacement.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
When did Sophos XG reach end of life?
Sophos XG Series hardware appliances reached end of life on 31 March 2025. Subscriptions and support can no longer be renewed for XG hardware, and Sophos stopped software updates shortly after that date.
Can I still use my Sophos XG firewall?
You should not rely on it. It no longer receives security updates or support, protection features stop as subscriptions lapse, and Sophos's documentation notes that a hardware appliance's base firewall licence expires at end of life. Replace it with an XGS appliance or another supported firewall.
Can I copy my XG configuration to an XGS firewall?
Yes. Both run Sophos Firewall OS, so you can back up the XG and restore the backup on an XGS appliance. On 19.5 MR4 or any 20.0 version, the backup-restore assistant helps map interfaces. High availability settings must be configured again afterwards.
Do my XG licences transfer to XGS?
Not as such. You claim the XGS in Sophos Fusion and apply subscriptions for the new appliance, and Central Firewall Reporting licences must be transferred separately. We can align the new term with your other Sophos renewals.
Is Sophos Firewall software end of life?
No. Only the XG Series hardware reached end of life. Sophos Firewall software continues, with v22 the current major release (MR3 arrived in October 2026), running on XGS appliances, virtual platforms, your own Intel hardware and the AWS and Azure clouds.