Sophos XG End of Life: Dates, SFOS Limits and the Move to XGS

Every Sophos XG firewall is now past end of life. The last models, from the XG 86 desktop to the XG 750 rackmount, reached end of life on 31 March 2025. The XG 85 and XG 105 went in August 2022. The first generation of XGS desktops is next: sales have ended, and end of life is 30 September 2030.

Most pages stop at those dates and a trade-up offer. This one also covers the firmware ceiling of each model, which vulnerabilities old SFOS versions carry, what the move to XGS involves in practice, and when replacing an XG with another box is the wrong answer.

Sophos XG end-of-life dates

Sophos ended sales of most XG models on 30 September 2021. The last one-year renewal could run until 31 March 2024, the last renewal orders were accepted until 31 January 2025, and end of life followed on 31 March 2025. From that date, XG hardware receives no support, firmware or security fixes, whatever subscription it carries.

What each milestone stops

Sophos uses three hardware milestones. End of sale stops new appliance orders. Last renewal is the last date a subscription can run on the model; after it, protection services cannot be extended. End of life ends hardware support, replacements, software maintenance and security updates.

For XG, all three are in the past. An XG still in production today runs on whatever firmware and signatures it last received.

Source: Sophos retirement calendar for Sophos Firewall, SG UTM and related products (KBA-000003353).

The older SG appliances running Sophos UTM 9 reached end of life on 30 June 2026. That line has its own migration story, covered in Sophos UTM end of life. The cross-vendor end-of-life tracker places these dates next to Fortinet, Palo Alto and others.

SFOS versions and the per-model ceiling

The hardware decides which SFOS version an appliance can run. The XG 85 and XG 105, with 2 GB of memory, stop at SFOS 17.5. All other XG models stop at SFOS 20.0 MR3. SFOS 21 and later run only on XGS, virtual and cloud appliances, and the second-generation XGS desktops need at least SFOS 20.0 MR1.

Sophos supports SFOS per maintenance release, not per major version. These are the releases still relevant to XG and early XGS units:

Source: Sophos retirement calendar (KBA-000003353).

One detail is easy to misread. SFOS 20.0 MR3 is still maintained, but on XGS and virtual appliances. XG hardware past end of life does not receive that maintenance, even though it runs the same version.

Security exposure on old SFOS

Sophos firewalls have been a repeated target. CISA lists three SFOS vulnerabilities as exploited in the wild, and several later critical flaws were fixed with hotfixes for supported versions only.

Source: CISA Known Exploited Vulnerabilities catalogue and Sophos security advisories.

Two conclusions. An XG on SFOS 20.0 GA or MR1 sits outside every later hotfix list, and one on 17.5 or 18.x carries flaws that attackers have actively used. And for XG hardware past 31 March 2025, Sophos's position is that software support ends at end of life, so do not count on fixes released after that date.

Several of these flaws sit in the User Portal and Webadmin. Whatever you decide about the hardware, keep both off the internet.

Under NIS2, Article 21 asks for vulnerability handling and basic cyber hygiene on systems such as a perimeter firewall. In Belgium, CyFun asks for security updates at every assurance level. An XG past end of life fails both by definition.

The path to XGS: trade-up, licences and configuration

Moving from XG to XGS is the simplest migration Sophos offers, because both run SFOS. It is still not a copy-paste. Three things decide how smooth it is: the commercial terms, the licence overlap and the configuration restore.

Trade-up and licences

Before end of life, Sophos ran trade-up promotions for XG customers: up to 99% off XGS hardware with a three-year Xstream Protection subscription, three years for the price of two, or 50% off hardware with a one-year term. Those offers were tied to the XG lifecycle, so ask your partner what applies today before you budget on them.

For licences, Sophos describes an overlapping entitlement on early renewal from XG to XGS. The XGS licence starts when the order is processed, the paid XGS term starts the day after the XG licence expires, and the XG licence stays valid until the end of its contract. Only early renewals qualify. New, extended, on-time and late renewals do not, and neither does MSP Flex. Practitioners report paying for overlapping months when they renewed XG for a year and then had to move before it ran out.

Configuration restore

• Version first. Bring the XG to a recent release; the backup must come from SFOS 19.5 MR4 or later to restore on SFOS 20.0 MR2 or later on XGS.
• Port mapping. From SFOS 20.0 MR2, a backup-restore assistant maps interfaces when the port layout differs. An XG HA backup can be restored to XGS without disabling HA first. Community threads report that the assistant does not always appear, so check every interface, VLAN and bridge after the restore.
• Old access points. AP 15, 55 and 100 are not supported from SFOS 21.5, and XGS supports no legacy AP model except the AP 100X. AP 5, 10, 30 and 50 were already dropped in SFOS 18.5. Sites managing these from the firewall need new access points.
• Legacy RED tunnels. SFOS 21.5 is the last release that supports legacy RED server and client mode. The upgrade to 22.0 will not start while such a configuration exists. Rebuild those tunnels before you move to current firmware.

What you gain and lose with XGS

XGS adds a dedicated Xstream flow processor next to the main CPU. Trusted traffic is offloaded to it after inspection, which frees the CPU for TLS inspection and threat protection. The figures show the difference.

Source: Sophos XG Firewall brochure and Sophos XGS product specifications. The two generations were tested under different conditions; treat the comparison as indicative.

The gain is large, especially for TLS inspection, where an XG 125 is effectively unusable on a modern internet line. What you lose: legacy access points and RED tunnels that worked on the XG, time spent checking the restored configuration, and, if you pick a first-generation XGS from leftover stock, a box that is already on a 2030 end-of-life clock. Choose second generation.

Staying on the XG has its own price, even without an invoice. No firmware fixes, no guaranteed protection updates, a growing distance to a supported SFOS version for the eventual restore, and a finding in any NIS2 or CyFun audit. The firewall decommissioning checklist covers how to retire the old unit properly.

If remote access and web filtering are most of what your XG does, this is the moment to test the alternative before buying hardware. You can try Jimber free on one site or user group.

When the XG should not be replaced like-for-like

An XGS is the right answer when the firewall does work only a local box can do: routing and inspecting traffic between internal VLANs, protecting a server room that hosts most applications, or isolating devices through Sophos's integration with its own endpoint protection.

Many XGs in the mid-market do different work. They terminate SSL or IPsec VPN for remote staff, filter web traffic for users who are often not in the office, and connect branches over site-to-site tunnels to reach applications that now live in Microsoft 365. For those sites, a like-for-like refresh rebuilds a design where remote traffic is backhauled to the office and the VPN portal stays exposed to the internet, the same portal several of the vulnerabilities above went through.

The alternative is to move those jobs off the box. Remote access moves to zero trust network access, with no listening portal. Web security moves to a cloud secure web gateway close to the user. Branches use a light SD-WAN device instead of a firewall. Jimber delivers firewall-as-a-service, ZTNA, a secure web gateway and SD-WAN on one European platform, with data handled in the EU. The 30-day plan from end of life to SASE sets out the sequence. Owners of other ageing lines face the same choice; see SonicWall TZ and NSA, WatchGuard Firebox and Palo Alto PA-220 and PA-800.

The case for staying with Sophos

A good Sophos partner will make three fair points.

"Synchronized Security only works with a Sophos firewall." With Sophos endpoint protection, the firewall receives each device's health status and can isolate a compromised machine at once. A separate cloud platform breaks that loop unless you integrate it. For organisations that run Sophos endpoint protection and managed detection together, that is a real reason to stay.

"Local traffic belongs on a local box." Correct. Multi-gigabit traffic between internal networks, such as CAD files, imaging or backups to a local NAS, should not travel to the cloud and back. An XGS handles it at wire speed. That argues for a local firewall where such traffic exists, not for sending remote users through it.

"XG to XGS is the least disruptive path." The team knows SFOS, the restore keeps most of the configuration, and an XGS amortised over five years is a predictable cost. That is true for the migration itself. It does not change the next end-of-life date, already set at 2030 for the first XGS generation, or the question of which jobs need a box at all.

Conclusion

Every Sophos XG is past end of life, and the units still running are on firmware that no longer receives fixes. If you move to XGS, choose the second generation, check the SFOS version and the restore, and plan for old access points and RED tunnels. Before you order, check which of the XG's jobs still need a firewall in the building.

If remote access and web security are what your XG mostly does, Try Free with one site. Or book a demo and we will go through your Sophos estate together.

Frequently asked questions

When did Sophos XG firewalls reach end of life?

Most XG models reached end of life on 31 March 2025, after end of sale on 30 September 2021. The XG 85, 85w, 105 and 105w reached end of life earlier, on 17 August 2022. Since then, XG hardware receives no support, firmware or security fixes.

Can a Sophos XG run SFOS 21?

No. The XG 86 to XG 750 stop at SFOS 20.0 MR3, and the XG 85 and 105 at SFOS 17.5. SFOS 21 and later run only on XGS, virtual and cloud appliances.

What happens if I keep using an XG after end of life?

The appliance keeps passing traffic, but Sophos provides no further software support, fixes or replacements, whatever subscription it carries. New vulnerabilities stay open, and an unsupported perimeter firewall is a finding under NIS2 and CyFun.

When do Sophos XGS firewalls reach end of life?

The first-generation XGS desktops (87, 107, 116, 126, 136 and w variants) reach end of life on 30 September 2030, with the last renewal on 30 September 2029. The second-generation desktops (88 to 138) and the XGS rackmounts have no end-of-life date announced.

What is the end-of-life date for the Sophos XG 125?

The XG 125 and 125w reached end of sale on 30 September 2021 and end of life on 31 March 2025. Their last SFOS version is 20.0 MR3. The second-generation XGS 128 is the closest current desktop model.

Can I restore an XG backup on an XGS?

Yes, if the versions line up. The backup must come from SFOS 19.5 MR4 or later, restored on SFOS 20.0 MR2 or later, where a backup-restore assistant maps interfaces between port layouts. Check every interface afterwards.

Do my old Sophos access points work with XGS?

Mostly not. XGS supports no legacy AP model except the AP 100X. AP 15, 55 and 100 are not supported from SFOS 21.5, and AP 5, 10, 30 and 50 were dropped in SFOS 18.5.

How does licensing work when moving from XG to XGS?

For early renewals, Sophos gives an overlapping entitlement: the XGS licence starts when the order is processed, the paid XGS term starts after the XG licence expires, and the XG licence remains valid until its end. On-time, late and MSP Flex renewals do not qualify.

When did Sophos UTM and SG reach end of life?

Sophos UTM 9 and the SG appliances reached end of life on 30 June 2026. Customers with a valid licence keep support until the licence expires or 31 December 2026, whichever comes first. UTM configurations cannot be restored on SFOS and must be rebuilt.