In short: Sophos Firewall needs a Base Licence plus subscriptions to enforce security. Modules such as Network, Web and Zero-Day Protection can be bought individually, with a support subscription, or as the Xstream Protection bundle, which adds DNS Protection, MDR and third-party threat feeds, NDR Essentials and Enhanced Support. Subscriptions attach to each firewall.
How Sophos Firewall licensing is structured
A Sophos Firewall runs the Sophos Firewall OS (SFOS) on a hardware appliance from the XGS range, as a virtual or software appliance, or in the public cloud. What it can enforce depends on its licences. Sophos's own documentation is clear that security protection requires a subscription: you can configure settings without one, but they cannot be enforced.
Every hardware and virtual firewall needs the Base Licence for its core firewall and networking functions. Protection is then added as individual subscriptions or as a bundle, and some bundles are sold together with a new appliance while others are subscription only.
Subscriptions and the Xstream bundle
| Subscription | What it adds | How it is sold |
|---|---|---|
| Base Licence | Core firewall and networking | Required on every firewall |
| Network Protection | Intrusion prevention and network threat protection | Individually or in a bundle |
| Web Protection | Web security, filtering and application control | Individually or in a bundle |
| Zero-Day Protection (formerly Sandstorm) | Analysis of suspicious files, including cloud sandboxing | Individually or in a bundle |
| Central Orchestration | SD-WAN and VPN orchestration and central reporting | Individually or in a bundle |
| DNS Protection | Sophos's cloud DNS protection service at the network level | Xstream Protection bundle |
| MDR and third-party threat feeds, NDR Essentials | Threat response fed by Sophos MDR and third-party intelligence, and network detection | Xstream Protection bundle |
| Enhanced Support | Access to Sophos support and firmware updates | Included in bundles |
The Xstream Protection bundle is the usual choice for most organisations because it combines the protection modules with the bundle-only features above. Enhanced Plus support is an upgrade that adds direct access to senior Sophos support staff.
How subscriptions are licensed
You claim each firewall in your Sophos account and add subscriptions to it, so subscriptions belong to one firewall. They are bought on a fixed term; one-year terms are standard and longer terms are available. There is no per-user charge, but each appliance or virtual size has a recommended capacity, so sizing matters as much as the subscription.
- Support: if you buy individual subscriptions rather than a bundle, you need a support subscription to reach Sophos support; with only the Base Licence you get self-help resources.
- High availability: in an active-passive pair, licences are activated on the initial primary and sync to the secondary, and a virtual pair needs only one Base Licence (cloud appliances excepted). In active-active, both firewalls need the same licence types. Advance hardware replacement under warranty depends on an Enhanced Plus subscription on the primary.
- Transfers and replacements: Sophos has processes for transferring subscriptions between firewalls and claiming RMA replacement units.
- Upgrades: you can move from individual modules to a bundle, and we align renewals so nothing lapses.
Ask us for a quote and we will size the firewall against your connection and user numbers.
Management and deployment
Sophos Firewall can be managed locally or from the Sophos console (Sophos Central, becoming Sophos Fusion). Firewalls can be shipped to a site and set up with zero-touch deployment, and the firewall shares health status with Sophos Endpoint through Synchronized Security, so an infected device can be isolated automatically. Sophos access points and switches are licensed and managed from the same console.
Who it suits and how we help
Sophos Firewall suits organisations already using Sophos Endpoint or MDR, because the products share threat information, and multi-site organisations that want SD-WAN and central management. We handle sizing, configuration, migration from your current firewall and renewals. For product depth see Sophos Firewall on our specialist site, and compare vendors on our firewalls page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Sophos Firewall work without a subscription?
You can configure security settings, but Sophos says security protection cannot be enforced without a valid subscription. With only the Base Licence you also get self-help resources rather than Sophos support.
What is in the Sophos Xstream Protection bundle?
The protection modules plus bundle-only features: DNS Protection, threat response fed by Sophos MDR and third-party threat feeds, NDR Essentials and Enhanced Support. We confirm the exact contents for your firewall model and firmware when we quote.
Is Zero-Day Protection the same as Sandstorm?
Yes. Zero-Day Protection is the current name for the subscription previously called Sandstorm Protection.
Can I license a virtual Sophos Firewall?
Yes. Virtual and software firewalls need the Base Licence, like hardware, plus the subscriptions you want. In an active-passive high availability pair of virtual firewalls, only one Base Licence is needed.