Activate Sophos Firewall Licence Key
A Sophos Firewall licence key is activated in SFOS in the product or licence section of the firewall. This is particularly relevant for renewals, additional modules, single licences, or manually provided licence keys.
Before activation, you should check the serial number, account assignment, licence documents, and internet access of the firewall. With an incorrect serial number or account, a licence key may not match the expected appliance. You can find the serial number with Find Sophos Firewall Serial Number.
⚠️ Important: Licence activation and firewall configuration are different topics. A licence key does not automatically change firewall rules, VPN, Device Access, or Central Management. Nevertheless, before working on licences and renewals, it should be clear which firewall and Sophos Central account are affected.
For understanding the Base Licence, Support, Bundles, and individual Security Subscriptions, see Understanding Sophos Firewall Base Licence. If it’s not just about applying a key but choosing a suitable bundle, What Sophos Firewall Bundles Are Available? can help.
If the firewall is deliberately operated without direct internet access, a normal licence key is not the whole process. In this case, before activation, Air-Gap Licensing and Pattern Updates should be checked, as approval, licence file, manual upload, and pattern updates are involved.
Check Before Activation
Before applying the licence key, these points should be known:
- Serial number of the affected Sophos Firewall,
- Model and appliance type,
- Current licence status,
- Expected target status after activation,
- Sophos Central or SophosID context,
- Licence key or licence PDF,
- Internet access of the firewall for licence verification,
- In isolated environments: air-gap approval, licence file, and manual update process,
- Responsible person for renewal or licence management.
If a firewall is in the wrong account, the account assignment should be checked first. The procedure is described in Transfer Sophos Firewall to Another Sophos Central Account.
Open Product Section
Menu path:
WebAdmin > User Menu > About product
Procedure:
- Log in to the Sophos Firewall WebAdmin Console.
- Open the user or account menu at the top right.
- Select About product.
In this section, you can see the licence status, appliance information, and the option to activate a subscription or licence key.
Activate Subscription
In the product section, licence activation is started via Activate subscription.
A dialogue then opens where the licence key can be entered.
Activating a Licence Does Not Mean Feature Ready
After successful activation, only the entitlement is initially visible. Whether a function can then be used productively depends on configuration, policy, logging, and operation.
| Activated Licence | Check Additionally Afterwards |
|---|---|
| Support or Bundle | Firmware update entitlement, expiry date, and support responsibility |
| Web Protection | Firewall rules, web policy, HTTPS/TLS inspection plan, and exceptions |
| Zero-Day Protection | Appropriate web or download policy, user acceptance, logs, and false-positive process |
| Central Function | Central registration, roles, task queue, reporting, or orchestration status |
| Mail or WAF | MX/DNS/NAT/certificate design, rules, logs, and fallback plan |
This separation is important because an activated key does not replace a professional rollout. If new protection modules are introduced after licence activation, they should be planned and tested like a normal change.
Enter Licence Key
Copy the licence key from the licence documents and paste it into the input field. Then verify or activate the key.
After activation, you should check whether the expected licence status is displayed. Depending on the licence, this includes:
- Duration,
- Activated modules,
- Support status,
- Affected serial number,
- Notes on expired or unassigned licences.
In HA clusters, you should additionally check both appliances. It is crucial not only that the active node shows the new status but also that the licence and support information in the cluster is synchronised as expected. For future support cases, both serial numbers, roles, and the visible licence status should be documented.
Check After Activation
After applying, you should briefly document:
- Which firewall was activated?
- Which serial number is affected?
- Which licence key or order is associated?
- Which modules and durations are displayed?
- Is the licence visible in the expected account?
- Do Base Licence, Support, Bundle, and Security Subscriptions match the expected target status?
- Does a renewal or asset system need updating?
- Does a separate configuration or test change need to be planned for newly activated modules?
- In HA clusters: do licence status and serial numbers match on both nodes?
For general assignment of Sophos portals, see Sophos Portals: SophosID, Central, Support, and Firewall Access. If the licence status is needed later for support or RMA, the firewall documentation should also include serial number, model, and account assignment. For clusters, additionally see Understanding Sophos Firewall HA Cluster Variants.
Typical Errors
Licence Key Does Not Match the Firewall
First, check the serial number, licence documents, and account assignment. With multiple firewalls or multiple Central accounts, confusion can quickly arise.
Firewall Cannot Verify Licence
The firewall requires internet access, DNS, and a functioning system time. If activation fails, gateway, DNS, time, and basic internet connection should be checked.
Licence Is Visible, but Module Does Not Work as Expected
After licence changes, it may be necessary to reload the status or wait briefly. Then check whether the module is really licensed, activated, and correctly configured. A licence alone does not activate a meaningful policy.
Wrong Account or Wrong Tenant
If the firewall is in the wrong account, the account and licence assignment should be corrected. For this, Transfer Sophos Firewall to Another Sophos Central Account is relevant.