Does a Sophos Firewall keep passing traffic when the subscription expires?

Yes. The base license included with the hardware keeps the firewall forwarding and applying rules, and Sophos continues to deliver software and pattern updates. IPS, application control, sandboxing, and threat intelligence stop; existing WAF rules stop enforcing. Only if the base license itself expires does the firewall drop to acting as a router.

Is there a grace period on Sophos Firewall subscriptions?

Sophos publishes none for the firewall. Its licensing guide says to renew within 90 days of expiration in the context of support entitlement, and the 30-day temporary license it documents applies to Sophos Central Email, not Sophos Firewall.

If a Sophos license lapsed, does the renewal start today or on the old date?

Normally from the date of activation, though Sophos says it may occasionally be backdated. Renewed before expiry, the new term starts the day after the old one ends. Sophos publishes no reinstatement fee.

Can I still upgrade firmware on a Sophos Firewall with no subscription?

Three times. Sophos gives every firewall three free firmware upgrades; after that a valid support subscription is required. Security updates do not count against the three.

What is the difference between Xstream Protection and Standard Protection?

Standard is Network Protection, Web Protection, and Enhanced Support. Xstream adds Zero-Day Protection (sandboxing and machine learning), Central Orchestration (SD-WAN orchestration and advanced reporting), and DNS Protection.

Can I still renew an XG 115 or an SG 210?

No. The XG series reached end of life on March 31, 2025, and the final renewal SKUs could only be ordered until January 31, 2025. The SG and UTM line's final renewal date was December 31, 2025, with end of life June 30, 2026. Both need a hardware refresh.

Sophos Firewall license renewals: what MSPs need to know

Xstream vs Standard Protection, what stops module by module when a Sophos Firewall subscription expires, the three-free-firmware rule, the Sophos Central requirement since March 2025, renewal start-date rules, XG and XGS lifecycle dates, and where the expiration date lives.

Last checked against Sophos documentation on September 2, 2026. Vendor policies change; the sources at the bottom are the record.

Sophos documents expiry more precisely than most vendors, module by module. The base license keeps the firewall forwarding and applying rules, and even after the subscriptions lapse the appliance keeps receiving software and pattern updates. What stops is the intelligence: IPS signatures are not loaded, application signatures are not loaded, sandboxing and machine learning are turned off, and after the third free firmware upgrade the firewall cannot be upgraded without a support subscription.

Two policy changes in the last two years matter for anyone tracking Sophos renewals. Since March 28, 2025 every Sophos Firewall needs a valid subscription or support contract to be managed and reported in Sophos Central. And renewals auto-activate on the serial number, so the order has to carry the right serial or nothing happens.

Sophos license tiers

Tier	What it includes
Base License	Included with the hardware: stateful firewall, VPN, wireless, high availability, and Firewall RED. If the base license itself expires, the firewall acts as a router and masquerades all outbound traffic without processing firewall rules.
Standard Protection bundle	Network Protection (IPS, Sophos X-Ops threat feeds, SD-RED management, Security Heartbeat), Web Protection (web security and control, application control including Synchronized App Control, web malware protection), and Enhanced Support.
Xstream Protection bundle	Everything in Standard plus Zero-Day Protection (machine learning, sandboxing, threat intelligence), Central Orchestration (SD-WAN VPN orchestration and Central Firewall Reporting Advanced), and DNS Protection.
Add-on modules	Email Protection (anti-spam, antivirus, DLP, encryption) and Webserver Protection (web application firewall) are licensed separately from the bundles.
Enhanced / Enhanced Plus Support	Enhanced: scheduled software upgrades and updates, support portal, remote assistance, and Advance Hardware Replacement on eligible products. Enhanced Plus adds senior-engineer routing, up to 8 hours a year of remote consulting, and priority malware sample analysis. In an active-passive HA pair, Enhanced Plus on the primary is required for advance replacement of the secondary.

Available terms

Sophos does not publish subscription term lengths on its public pages. Resellers list Sophos Firewall subscriptions in 1-, 2-, 3-, and 5-year terms plus a 63-month option, and Sophos's own UTM-to-XGS refresh promotion references a minimum 3-year Xstream Protection term, which confirms multi-year subscriptions exist.

For MSPs, Sophos Central Partner also offers Flex monthly billing on firewalls as an alternative to term subscriptions.

What happens when a Sophos license expires

The base license keeps working, so the firewall continues to forward traffic and apply rules. Sophos states you continue to receive software updates, including feature and maintenance releases and pattern updates, after the subscriptions expire.

Network Protection expired: IPS signatures are not loaded and IPS policies are not applied; SD-RED tunnels disconnect. Web Protection expired: application signatures are not loaded, and in proxy mode web policies and HTTPS decryption stop. Zero-Day Protection expired: machine learning and sandbox analysis are turned off, and threat intelligence is turned off. Central Orchestration expired: SD-WAN groups become unavailable and reporting drops to 7 days. Email Protection expired: mail is delivered without anti-spam or antivirus. Webserver Protection expired: existing WAF rules stop enforcing.

Firmware has its own rule. The firewall has three free firmware upgrades; any further upgrade requires a valid support subscription. Security updates are not deducted from the three.

If Enhanced or Enhanced Plus support expires, Sophos cannot provide RMA or technical support for any SFOS version.

Since March 28, 2025 all Sophos Firewall deployments require a valid subscription or support contract for Sophos Central management and reporting, so an expired firewall also drops out of central management.

Sophos publishes no grace period for firewall subscriptions. The licensing guide says licenses must be renewed within 90 days of expiration, in the context of support and HA entitlement. A 30-day temporary license after expiry is documented only for Sophos Central Email, not the firewall.

Renewing after a lapse

Renewed on time, the new subscription starts the day after the existing one expires. If the subscription has already expired, Sophos states the renewal will normally start from the date of activation but may occasionally be backdated. That is the opposite default from WatchGuard, SonicWall, and Fortinet, which back-date as a rule.

Sophos publishes no reinstatement fee and no cutoff after which a lapsed firewall cannot be renewed, beyond the 90-day renewal window it states for support entitlement.

Co-terming

Sophos does not publish a pro-rated co-termination program for Sophos Firewall subscriptions. What it does document is the mid-term behavior: adding or upgrading a subscription mid-term starts immediately and cancels the remainder of the old one unless you request a future start date, and overlapping subscriptions are allowed with a warning.

The practical way to align a fleet is the future start date. Ask the distributor for the renewal with a start date on the target, so the new terms end together.

For the legacy UTM line, Sophos stopped supporting non-aligned end dates within a bundle on October 1, 2023, which is why UTM renewals arrived as a single aligned bundle from then on.

End of sale and end of life

Sophos's hardware lifecycle policy supports XGS appliances for at least five years after end of sale. The last date to order an extension is 12 months before the end-of-life date, and support contract renewals may not extend beyond end of life.

The whole XG series reached end of life on March 31, 2025, with the final renewal SKUs having been orderable only until January 31, 2025. The first-generation XGS desktop appliances went end of sale in April 2025 and follow the dates below. Sophos's per-model retirement calendar is a knowledge base article that did not render for our check, so model-level end-of-sale dates are noted where a Sophos announcement gives them.

Model	End of sale	End of life / support	Note
XGS 87 / 107 / 116 / 126 / 136 (Gen 1 desktop)	2025-04	2030-09-30	Post-EoS support from 2025-09-30; final renewal 2029-09-30.
XG 86 / 106 / 115 / 125 (all XG series)	2022-03-31	2025-03-31	Past end of life. Final renewal 2024-03-31; last SKU order 2025-01-31.
SG 135 / SG 210 (UTM)	—	2026-06-30	Final renewal 2025-12-31; no support beyond 2026-12-31.

Where to find the expiration date

Firewall web admin: Administration > Licensing > Module subscription details shows each module's status and expiry. The firewall synchronizes with Sophos every 24 hours, or immediately with the Synchronize button.
Sophos Central: Profile > Licensing > Firewall licenses tab, expand the firewall; shows the expiry and the license ID, which for the base license is the serial number. Licensing has moved to Central; MySophos is legacy.
Sophos Central Partner: filter firewalls by "Expiry between" across every customer you manage.
Warnings: Sophos Central shows a sign-in banner 30 days before expiry. A firewall-side pre-expiry alert is not documented in the SFOS notifications reference.

How the renewal moves

Sophos sells only through resellers and MSPs, and Partner Portal quotes and renewals default to a preferred distributor you set in the portal.

The renewal order includes the firewall's serial number. Since February 22, 2023 renewal license keys auto-activate: on processing, Sophos updates the subscriptions attached to that serial rather than issuing keys to apply, and the firewall picks up the change on its next synchronization. Keys are model-specific, so a renewal ordered against the wrong serial or model does nothing until corrected.

How MSP Renewals tracks Sophos

MSP Renewals stores each Sophos Firewall with its serial number, the bundle you sell it on (Xstream Protection or Standard Protection), the term you normally quote, and the expiration date you enter or sync. It alerts at 90, 30, and 5 days, drafts the renewal quote at 90 days, and can send the pricing request to your distributor automatically with the serial, bundle, term, and your reference number.

Because Sophos auto-activates on the serial, the serial in the request is the whole job. The pricing request also carries the end-of-support date for the XGS 116 and 116w so a term is not bought past the hardware's life. When the client approves, the device's expiration rolls forward by the term you sold and the countdown restarts.

Start Free Trial $29/mo founder pricing

Sophos renewal questions

Does a Sophos Firewall keep passing traffic when the subscription expires?: Yes. The base license included with the hardware keeps the firewall forwarding and applying rules, and Sophos continues to deliver software and pattern updates. IPS, application control, sandboxing, and threat intelligence stop; existing WAF rules stop enforcing. Only if the base license itself expires does the firewall drop to acting as a router.
Is there a grace period on Sophos Firewall subscriptions?: Sophos publishes none for the firewall. Its licensing guide says to renew within 90 days of expiration in the context of support entitlement, and the 30-day temporary license it documents applies to Sophos Central Email, not Sophos Firewall.
If a Sophos license lapsed, does the renewal start today or on the old date?: Normally from the date of activation, though Sophos says it may occasionally be backdated. Renewed before expiry, the new term starts the day after the old one ends. Sophos publishes no reinstatement fee.
Can I still upgrade firmware on a Sophos Firewall with no subscription?: Three times. Sophos gives every firewall three free firmware upgrades; after that a valid support subscription is required. Security updates do not count against the three.
What is the difference between Xstream Protection and Standard Protection?: Standard is Network Protection, Web Protection, and Enhanced Support. Xstream adds Zero-Day Protection (sandboxing and machine learning), Central Orchestration (SD-WAN orchestration and advanced reporting), and DNS Protection.
Can I still renew an XG 115 or an SG 210?: No. The XG series reached end of life on March 31, 2025, and the final renewal SKUs could only be ordered until January 31, 2025. The SG and UTM line's final renewal date was December 31, 2025, with end of life June 30, 2026. Both need a hardware refresh.