Activate Sophos Firewall Licence Key

If the Sophos License Schedule contains a Subscription Key, activate it in the WebAdmin Console under Administration > Licensing > Activate subscription. Then check the key with Verify key, review the displayed subscription, and activate it with Confirm.

Many renewals are now assigned automatically to the serial number in the order and do not include a new key. In this case, do not reuse an old key. Click Synchronize under Administration > Licensing instead.

⚠️ Important: A licence key can be used only once and is tied to a specific firewall model. Activating it does not change firewall rules, VPN configurations, or the Central Management registration.

Check before activation

• The firewall is claimed in the correct Sophos Central account.
• Under Administration > Licensing, the Base License has the status Subscribed, not Evaluating.
• The model and Sophos Firewall serial number match the License Schedule.
• The Subscription Key has not already been used on another firewall. A License ID in Central is not the licence key.
• The firewall has internet access for online activation and synchronization.
• On a Hardware as a Service (HWaaS) device, the bundle is assigned automatically; you cannot apply your own subscriptions.

For an isolated hardware appliance, use the separate procedure for Air gap licensing and pattern updates. If the License Schedule does not contain a key, the subscription may already have been activated automatically.

Activate the licence key on the firewall

1. Sign in to the Sophos Firewall WebAdmin Console.
2. Open Administration > Licensing. In older UI versions, the same product section is available from the user menu under About product.

3. Click Activate subscription.

4. Paste the Subscription Key from the License Schedule. Do not enter a License ID, serial number, or a key that has already been used.
5. Click Verify key, then check the model, subscription, and term.

6. Activate it with Confirm. The new subscription must then appear as Subscribed under Module subscription details.

New subscriptions start when the order is fulfilled; entering the key later does not shift the start or expiration date.

Alternatively, activate it in Sophos Central

1. In Sophos Central, open the profile icon.
2. Select Licensing > Firewall licenses.
3. Find the firewall by its serial number and expand its details.
4. Click Apply subscriptions.
5. Enter the Subscription Key and select Preview subscription.
6. Check the assignment and term, then confirm with Apply subscription.
7. On the firewall, run Administration > Licensing > Synchronize.

Claiming, licence assignment, and Central Management are separate operations. If the firewall is in the wrong Central account, see Transfer Sophos Firewall to another Sophos Central account; the Central Management registration must be changed separately if required.

Check the licence status

After activation, check the following under Administration > Licensing:

• correct serial number and appliance model
• status Subscribed
• expected subscription and included modules
• expiration date and support status
• same assignment in Sophos Central

A new licence enables the entitlement but does not configure any policies. Newly licensed features must therefore be configured, tested, and monitored separately. Understand the Sophos Firewall Base License explains the differences between the Base License, support, and security subscriptions.

In active-passive HA, the Initial Primary holds the licences and the auxiliary receives a copy. In active-active HA, both devices require their own licences of the same types. The roles and licence requirements are described in Sophos Firewall HA cluster variants.

After activation, check both serial numbers, HA roles, and the visible licence status. In active-active mode, the licence must match on both devices.

Online firewalls normally synchronize their licences every 24 hours and issue a warning after 70 days without a successful synchronization. After 90 days, security subscriptions are deactivated. On hardware appliances, the Base Firewall and Enhanced Support remain active; on virtual or software appliances in active-passive HA, the Base License may also be deactivated and HA disabled. Air gap licensing has a separate 180-day period.

If activation or synchronization fails

• No key in the License Schedule: Check whether Sophos or the partner has already activated the renewal automatically. Then run Synchronize on the firewall.
• The key is rejected: First check for spaces or transmission errors. The key may already have been used, belong to the wrong model, or have been replaced by a corrected order. The firewall must also be claimed and the Base License must have the status Subscribed. Paid keys cannot be used with Home or free 30-day licences.
• The subscription is in Central but not on the firewall: Run Synchronize. If it fails, check the internet connection and investigate DNS, routing, and system time as possible causes.
• Wrong firewall or wrong account: Do not test the key on additional devices. Record the serial numbers and License Schedule, then clarify the appropriate subscription or account transfer.

For the message Synchronization with server failed, you can monitor the licence log live in the Advanced Shell:

tail -f /log/licensing.log

Then trigger Synchronize in WebAdmin and check the new log lines for connection, certificate, or assignment errors. Stop the output with Ctrl+C. The command only reads the log; Connect to Sophos Firewall using SSH explains how to open the Advanced Shell safely.