Sophos hardware warranty, support, and RMA explained

For Sophos hardware, warranty, support coverage, and the RMA process are separate matters. The base warranty provides a remedy for a covered hardware defect. Suitable, continuous support may additionally provide Advance Hardware Replacement. Sophos Support must validate the fault and approve the RMA.

To check eligibility, collect the product family, serial number, order or purchase evidence, support status, management type, HA role, and current lifecycle status. A visible Sophos Firewall Base License does not by itself prove support or advance-RMA entitlement.

What the terms mean

• Base Warranty: manufacturer’s warranty against defects in materials and workmanship when the hardware is used as documented.
• Extended Warranty: longer cover for specifically listed product families and generally for the original purchaser.
• Support contract: access to the agreed support services; Advance Hardware Replacement depends on the product and licensing model.
• Standard Hardware Replacement: the defective unit is returned first, and Sophos ships the replacement after receiving it.
• Advance Hardware Replacement: after an approved RMA, Sophos may ship the replacement before receiving the defective unit.
• RMA: Return Merchandise Authorization, the return or replacement approved by Sophos.

For the concrete coverage decision, compare the serial number, order date, product family, and support status with the current Sophos Hardware Warranty Terms. Then record the outcome and binding return deadline in the support case together with the written RMA instructions.

Warranty duration and scope

The base warranty runs for 12 months from the date Sophos processes its channel partner’s order. This is not necessarily the purchase, delivery, or installation date. An invoice and delivery note help identify the order, but Sophos’s recorded processing date starts the period.

Sophos lists extended cover for these families:

• SD-RED and APX Series: five years from the processed partner order, but never beyond End-of-Life.
• Sophos Switch and AP6 Series: Limited Lifetime Warranty; Sophos defines “Lifetime” as ending at End-of-Life.
• XGS Appliances, XG, and SG: 12-month base warranty. Sophos expressly applies the EOL limit to extended warranty and support periods instead.

The warranty covers manufacturing defects, not software, configuration, or configuration assistance. Exclusions include misuse, power or environmental conditions outside the specification, accidents, natural disasters, and unauthorized repair or alteration. Missing or tampered warranty stickers may void cover. A replacement may be new, refurbished, repaired, or a newer equivalent and carries only the remainder of the original warranty. The same SFOS release and backward compatibility are not guaranteed.

Always check the Sophos Product Lifecycle before a renewal or replacement. A support term can’t extend beyond EOL.

When Advance Hardware Replacement applies

For appliances running SFOS, including SFOS 22, eligibility depends on licensing and HA mode:

• Standalone SG/XG and XGS Appliances with a Term License: active Enhanced Support, included with Standard Protection and Xstream Protection.
• Standalone SG/XG and XGS Appliances with an MSP License: active Standard Protection or Xstream Protection under the MSP model.
• Active-Active HA: each appliance needs its own applicable cover.
• Active-Passive HA: the Primary needs Enhanced Plus for Term Licensing or Xstream Protection for MSP Licensing; Primary and Auxiliary are then eligible.
• AP6 and Sophos Switch in Sophos Fusion (formerly Sophos Central): active support subscription.
• SD-RED 20/60 and APX managed by SFOS: the connected SFOS device needs active Enhanced Plus Support.
• Standalone APX: not eligible for Advance Hardware Replacement.

Advance-RMA eligibility for APX and SD-RED ends after five years from the processed partner order or at EOL, whichever comes first. The written RMA determines which devices, components, and accessories must be returned; don’t add or remove items based on assumption.

This matters at branch sites: an access point or SD-RED may look like a small inventory item but can connect the entire site. Plan its replacement path and emergency operation as carefully as those of a firewall.

For an HA cluster, verify both serial numbers, the mode, and the Primary and Auxiliary roles. Sophos Firewall HA clusters explains the technical roles.

Waiting period after a support gap

If support is purchased more than 30 days after the warranty or previous support contract expires, a three-month waiting period for replacement hardware may apply. The Warranty Terms revised in March 2026 name XG and XGS, while the current support-service footnote names only XGS. Because the Warranty Terms claim precedence in a conflict, don’t assume the narrower wording benefits an XG reactivation; obtain written confirmation before purchase. Paid reinstatement may waive the waiting period.

Don’t wait for a failure before reactivating support. The support-license change for Sophos Firewall customers explains the wider operational impact of missing support.

Sophos Switch: prepare warranty and RMA correctly

For Sophos Switch, the Limited Lifetime Warranty applies only until the End-of-Life date of the relevant model. It is not a promise of advance replacement without a time limit. Advance Hardware Replacement requires an active Sophos Switch Support and Services subscription; Sophos confirms whether the specific fault and replacement are covered only in the support case. A switch that still works locally proves neither an active subscription nor Advance RMA entitlement.

Hardware maintenance and support can continue after End of Sale until EOL if valid warranty or support cover remains in place. If a failed model is already EOL but is still covered by a valid support contract, Sophos may choose to provide the same model, if available, or an alternative with equal or greater capacity. The replacement may have a newer revision and current software; unchanged operation of the previous firmware or configuration is not guaranteed. Therefore check the model, port and uplink types, PoE budget, firmware, and backup compatibility before cutover.

Prerequisites and evidence before the case

Before restarting, resetting, or removing the unit, preserve the evidence needed to reproduce the fault and restore the previous state:

• model, hardware revision, serial number, purchase or order date, and location;
• Sophos Fusion account, device assignment, Sophos Switch Support and Services subscription status, and current lifecycle;
• firmware version, management method, Site or Stack assignment, and last known working configuration;
• start, frequency, and business impact of the fault, plus affected ports, uplinks, PoE devices, or services;
• LED states and photos or video of the fault;
• results of basic cross-checks using another outlet or power feed, cable, transceiver, peer device, or comparison port, where this adds no operational risk;
• status, alerts, last contact, relevant port values, and RAM and Flash logs while the unit remains accessible;
• a current, externally available .cfg backup and a port, VLAN, uplink, and PoE plan for the replacement.

Volatile RAM logs are lost on restart or power-off. A Factory Reset also changes the local configuration and potential fault evidence. Follow Diagnose Sophos Switch and collect support data first; Back up and restore Sophos Switch covers backup and restore.

Support route and service boundary

The reliable route to hardware replacement is a technical case in the Sophos Support Portal. Sign in with the Sophos ID, describe the fault to Sophos Support Assistant, answer its diagnostic questions, explicitly request case creation if necessary, review the collected details, and submit them. The case is open only when a case number is displayed. For an urgent outage, also use the regional telephone number on the official contact page and have the case number and serial number ready. Open a Sophos support ticket summarizes the current portal flow.

Sophos Support handles faults in installation, administration, and operation, and departures from documented product behavior. A new network implementation or complete new configuration is outside this break/fix scope. The RMA process likewise does not replace backup, cabling plans, cutover, or technical acceptance; these remain the operator’s or service partner’s responsibility.

Submit the evidence listed above with the RMA form. Sophos Support validates the fault and hands the case to Customer Care; only after RMA creation and compliance review does the RMA team coordinate shipping. No unit is shipped without a case and RMA number, written approval, and confirmed delivery address. Neither next-business-day shipment nor a particular delivery date is guaranteed.

Register and accept the replacement switch

When the replacement arrives, an important account boundary applies: register it in the same Sophos Fusion account as the failed switch. The support subscription is administered through the customer account and is not permanently tied to one hardware unit. This does not mean that Sophos transfers the configuration automatically.

Before returning the old unit, complete at least these checks:

1. Compare model, revision, serial number, port count, uplink types, PoE budget, and transport damage with the RMA and network plan.
2. Before adding the unit, decide whether the Parent template of the intended Site or Stack or an individual .cfg backup is the authoritative configuration source. Check the target model and firmware for compatibility with that route; do not apply the template and backup against each other without control.
3. Only then register the replacement in the correct Fusion account and intended Site or Stack; verify the subscription and device assignment.
4. Apply the chosen configuration in a controlled manner, then check identity, management access, Fusion status, open tasks, and alerts.
5. Test uplinks, LAG and STP, VLANs and management VLAN, Layer 3 functions, PoE, 802.1X or Port Security, SNMP, Syslog, and the services actually affected.
6. Record the new serial number, firmware, restore result, acceptance time, and outstanding deviations in the existing case and inventory or CMDB.

The full cutover, including rollback points, restore, conflict checks, and acceptance matrix, is in Replace, reset, or remove Sophos Switch. Prepare the old unit for shipping only after these checks pass and the RMA instruction requires its return. If the fault remains, add the replacement test results to the original case rather than opening an unrelated new one.

Switch data, reset, and return

A reset must destroy neither support diagnostics nor the only backup. While the switch is accessible, first save the required .cfg file outside Sophos Fusion. This is especially important because Remove from Sophos Fusion deletes the backups stored there for that switch. Only then, and only as the RMA instruction permits, remove configurations and customer data under the internal erasure procedure. If the switch is no longer accessible, document this and the data risk in the case; do not open the chassis yourself.

The replacement arrives without accessories. Remove transceivers, Connectivity or Flexi-Port modules, rackmount kits, power supplies, and power cords from the failed unit and retain them for continued operation unless Sophos gives different written instructions for the case. Where possible, use the replacement’s box for the failed main unit. The return label, carrier, and deadline come from the RMA instruction; the current Sophos RMA process specifies 15 days after receipt of the replacement. Retain tracking and proof of delivery until the case is confirmed closed.

Handle the RMA safely

The detailed runbook is in Prepare a Sophos hardware fault and RMA. For an eligibility check, use this sequence:

1. Record the model, revision, serial number, order details, support status, fault, and both HA nodes where applicable.
2. While the unit is accessible, save logs and a current backup. For a firewall, create a current Sophos Firewall backup and retain its password and, when applicable, the Secure Storage Master Key; for a switch, store the required .cfg file outside Sophos Fusion.
3. Open a technical support case. Only Sophos Support validates the hardware fault and creates the RMA number; don’t ship or dispose of anything without instructions.
4. Follow the approval for standard or advance replacement, address, accessories, carrier, customs duties, and return date. “Next-business-day shipment” is a reasonable-efforts target after complete approval before the regional cut-off, not a delivery guarantee.
5. Check the replacement model and firmware compatibility before restoring. For a firewall, transfer the paid firewall license, then test WAN, LAN, routing, NAT, VPN, HA, Central, logs, and monitoring. For a switch, follow the same-account registration and switch acceptance described above.
6. Return the defective unit or named components, securely packaged and displaying the RMA number, as instructed. For advance replacement, the current Warranty Terms require return within 15 calendar days after receiving the RMA. Sophos may charge for the replacement if the defective hardware hasn’t been returned as requested within 30 days after receipt of the replacement. The date in the RMA remains decisive.

If the replacement must be assigned to another Sophos account, resolve that before license transfer. See Transfer a Sophos Firewall to another account.

Shipping, title, and risk also differ. For standard replacement, the customer prepays return carriage; for advance replacement, Sophos specifies the carrier and pays freight. Title to the defective hardware passes to Sophos at the earlier of the customer’s receipt of the replacement or Sophos’s receipt of the defective hardware. Title to the replacement passes only at the later of shipment or Sophos’s receipt of the defective unit, while risk of loss for the replacement passes to the customer on shipment. Confirm the RMA instructions, tracking, and any desired transit insurance before dispatch.

Protect configuration and customer data

Sophos disclaims responsibility for configurations or data on returned hardware. The customer is responsible for removing all customer data before shipment:

• Save the backup and required logs first, and verify the recovery plan.
• Then remove data under your organization’s privacy and erasure procedure while the unit remains accessible.
• Don’t remove internal HDDs, SSDs, or other parts without explicit written authorization from Sophos.
• If the unit is inaccessible, disclose the data risk in the case and request written instructions rather than opening the chassis or damaging warranty stickers.
• Dispose of hardware only when Sophos instructs this in writing. Secure erasure, complete destruction, e-waste compliance, and proof of disposal then also apply.

A late, incomplete, or missing return can result in a charge for the replacement. Sophos may also charge for “no fault found” or missing components. Retain tracking, proof of delivery, and confirmation that the case is closed.

Operations and renewal checklist

1. Record product family, model, revision, and serial number.
2. Match Sophos’s recorded order date with purchase and delivery evidence.
3. Check account, licensing model, support product, and expiry date.
4. For HA, check both appliances, their roles, and cover.
5. For SD-RED, APX, AP6, or Switch, identify the management type.
6. Check EOS, Last Renewal, and EOL dates.
7. Test backup, keys, firmware compatibility, and the recovery plan.
8. Provide HA, a spare, or documented emergency operation for critical sites.

Warranty and advance replacement provide hardware, not a working configuration or guaranteed recovery time. Replacement strategy and restore testing therefore belong in operational planning.

FAQ