Classify Sophos hardware warranty, support and RMA
With Sophos hardware you should not mix warranty, support contract and RMA. In everyday life it all sounds like “exchange”, but legally and operationally there are various questions: Is the device still under warranty? Is there a valid support contract? Is Advance Hardware Replacement covered? Does the device still fit into the product life cycle?
This distinction is particularly important for Sophos Firewall. An appliance can have a visible Base License but still not have sufficient support or RMA eligibility. The basics of the license view are in Sophos Firewall Base License understand.
Differentiate between warranty, support and RMA
The most important terms:- Base Warranty: basic manufacturer’s warranty against hardware defects during the basic warranty.
- Extended Warranty: extended manufacturer’s warranty for certain product families.
- Support contract: Entitlement to support services, updates and, depending on the product, hardware replacement service.
- Advance Hardware Replacement: Exchange service where Sophos can ship a replacement device after an approved RMA before receiving the defective device back.
- RMA: Return Merchandise Authorization, i.e. the specific exchange or return process.
- Lifecycle: End-of-Life or other lifecycle limits may affect warranty, support and scheduling.
In practice, you should never just ask about “guarantee”. It is better to check specifically: product family, serial number, purchase date, support status, lifecycle, HA role and RMA conditions.
Basic guarantee
The Sophos Hardware Warranty Policy provides a basic warranty of twelve months. This does not necessarily begin on the customer’s installation date, but rather from the time Sophos processes the channel partner’s order. For admins this means: delivery note, invoice and Sophos registration should be checked together.The basic guarantee is particularly relevant for operation with new hardware. In the case of productive firewalls, however, it should not be seen as a replacement for a clean support and exchange concept.
Extended warranty by product family
Sophos differentiates the extended warranty by hardware family.
Classification by product family:
- SD-RED: extended warranty up to a maximum of five years, but not beyond the End-of-Life date.
- APX Series: extended warranty up to a maximum of five years, but not beyond the End-of-Life date.
- Sophos Switch: Limited Lifetime Warranty, where Sophos Lifetime ends on the End-of-Life date.
- AP6 Series: Limited Lifetime Warranty, where “Lifetime” on Sophos ends on the End-of-Life date.
For older devices, this information should always be checked against the current lifecycle. Sophos Product Lifecycle Calendar: Check End-of-Sale and End-of-Life helps with planning.
Sophos Firewall and XGS AppliancesWith Sophos Firewall appliances, warranty and support are particularly closely linked to operation. For SFOS appliances, Enhanced Support is the basis for hardware replacement for term licenses; Standard Protection and Xstream Protection include Enhanced Support.
Important for admins:
- A Serial number must be correctly documented.
- The firewall must be registered in the correct Sophos account.
- Support or bundle license must match the device and runtime.
- For HA clusters, the support coverage of the roles must be checked.
- Lifecycle and firmware version must match the planned operation.
With Active-Passive-HA, the classification is not always intuitive. For certain SFOS license models, Enhanced Plus is relevant on the primary or active appliance so that both devices are authorized for Advance Hardware Replacement. For HA environments, not only the individual serial number should be checked, but the entire cluster. The operating principles are in Sophos Firewall HA cluster: Active-Passive, Active-Active and Auxiliary Appliance.
SD-RED, Access Points and switches
For SD-RED, Access Points and switches, you have to differentiate between the manufacturer’s warranty and Advance Hardware Replacement.For Advance Hardware Replacement, Sophos states, among others, these conditions:
- AP6 and Sophos Switch in Sophos Central require an active support subscription.
- SD-RED 20 and SD-RED 60 managed via SFOS depend on the support status of the connected SFOS device for Advance Hardware Replacement.
- APX devices managed via SFOS are also dependent on the support status of the connected SFOS device.
- Standalone APX devices are not eligible for Advance Hardware Replacement.
This is operationally important because a Access Point or an SD-RED is often perceived as a “small device” in an outdoor location. But if there is a productive location there, the exchange process must be planned just as carefully as with a firewall.
Buy support later: pay attention to the waiting time
If a support contract for XG or This waiting time can only be waived under certain conditions, for example with reinstatement.For operations, this means: Don’t just buy support when a device is already defective. Before renewals, you should check support status, expiration dates and critical locations early on. The 2025 support changes are classified in Sophos Firewall: Important change for customers without a support license.
What a guarantee does not replace
Warranty or Advance Hardware Replacement only solve hardware replacement. The exchange service does not replace operational planning.
Especially with Sophos Firewalls you also need:
- current backup
- Backup password or Secure Storage Master Key
- documented serial number and account assignment
- known firmware version
- Recovery plan for WAN, LAN, VPN, NAT and HA
- Access to Sophos Central or SophosID
- Monitoring and log checking after the exchange
The practical procedure is in Sophos hardware defect and prepare RMA properly. Backup and restore to Sophos Firewall should also be prepared for firewalls.
Check claim in the company
Before a support case or renewal, you should document these points:1. Check product family and model. 2. Record serial number. 3. Search for purchase date, delivery note or order date. 4. Check Sophos Account or Sophos Central assignment. 5. Check support and bundle licenses. 6. Check lifecycle status. 7. For HA, check both appliances. 8. Check the management type for SD-RED, APX, AP6 or Switch. 9. Drop existing support or RMA communications. 10. Document site criticality and replacement strategy.
If the firewall needs to be transferred to another account, Sophos Firewall transferred to another account will fit.
Common errors
Confuse Base License with support
A visible Base License does not automatically mean support, updates or RMA are covered. The support status must be checked separately.
Only consider the warranty period
When it comes to productive firewalls, it’s not just the question of whether a device will be replaced at some point. What matters is how quickly a replacement device is available and whether the configuration can be restored.
Buy support too late after it expiresIf a support contract is purchased too late after it has expired, there may be a waiting period for hardware replacement. This should be checked before renewal gaps or reactivations.
Treat HA clusters as a single device
With HA, it is necessary to check which role has which appliance and which support requirement applies to primary, auxiliary, active or passive.
Ignore lifecycle
Warranty and support end at the latest at the relevant lifecycle limits. Old XG, SG, RED or access point generations should therefore be evaluated not only from a technical perspective, but also from a lifecycle perspective.