Home » KB-Artikel » Sophos Firewall » Installing Sophos XG Firewall OS on an SG Appliance

Installing Sophos XG Firewall OS on an SG Appliance

In this article, we will show you how you can virtually turn your SG Firewall into an XG Firewall by installing the new SFOS on your Sophos SG Firewall.

Info: This guide is intended for anyone who bought an SG Firewall with the UTM operating system preinstalled in the past and now wants to install the new “Sophos Firewall OS” on it. Since the hardware of the SG and the XG is identical, this can be accomplished with a few steps. The procedure to reinstall an XG or XGS appliance is the same.

YouTube video


  • Sophos Firewall Appliance (SG, XG or XGS)
  • USB stick 4 GB or larger
  • Windows, macOS or Linux computer to prepare the USB stick

1. download SFOS ISO image

In the first step, we download the ISO image of the “Sophos Firewall OS”, which we will install later on the SG Firewall.

  1. Log in to https://id.sophos.com with your Sophos ID. If you don’t have an account yet, you need to create a Sophos ID first.
  2. After logging in, click on MySophos, then on Network Protection and finally on Download Installers. Now you are on the right page to download the SFOS.
  3. Under Hardware Installers you will find the Firewall OS for XG Series. Click Download to download the installer.
  4. Accept the terms and conditions and click on Submit. After that the ISO image will be downloaded.

2. create bootable USB stick

Info: In the YouTube video we still use the Rufus tool. With the tool balenaEtcher described here it is much easier.

In the second step we copy the downloaded ISO image to a USB stick. For this we use a special tool so that the SG can later boot from this USB stick.

  1. Insert a USB flash drive with at least 4GB of storage space into your computer. Make sure that there is no important data left on the USB flash drive, because it will be completely erased later.
  2. Go to https://www.balena.io/etcher/ and download the latest version of the balenaEtcher tool.
  3. After that you can start the balenaEtcher tool with a double click.
  4. First click Flash from file and select the previously downloaded ISO image.
  5. Select a USB stick under Select target
  6. Finally, click Flash! to format the USB stick and install the SFOS image.

3. install SFOS on the SG Appliance

The preparations are now all done. You have a bootable USB stick with the SFOS on it. Now the installation on the SG Appliance can begin.

Important: With the installation of the SFOS on your SG, the hard disk is completely overwritten and the device is completely reset. No configurations of the SG will be taken over!

  1. Connect the SG to a monitor (a keyboard is not necessary), plug in the USB stick and turn on the firewall.Info: The appliance automatically boots from a USB device by default. First, the hard disk is formatted and the new OS is installed automatically. No key input is necessary. In our tests with an SG 125 with HDD (no SSD), the process took just under 18 minutes.
  2. As soon as the installation of the SFOS is finished, the message “remove installer Disk – press y to reboot” appears.Info: You can now remove the USB stick. If you have a keyboard connected and want to press y, remember that the keyboard settings are set to US. So you would have to press z. However, you can simply remove the USB stick and disconnect the box from the power supply and restart it. This also works. 😃

4. start SFOS Wizard

The SFOS is now installed on the SG and a wizard will help you set up a few basic configurations before things really get started.

  1. Connect your PC to the LAN 1 port of the SG Firewall with a network cable.
  2. For example, give your PC the IP address The appliance can be reached via the IP address by default. Since you are now on the same network as your computer, you should be able to ping the firewall.
  3. Then open your web browser and access the web interface via
  4. If everything worked, you will see the “Welcome screen” of XG Firewall. With a click on Click to begin you can start the wizard and make some basic configurations. The following images show you what settings await you.

With these four steps, you have turned your SG Firewall with the UTM operating system into an XG with the SFOS. Next, you just need to know how to migrate your UTM license for the SFOS. Additionally, feel free to look at the exact migration path of your UTM license to SFOS.

Shopping Cart
Scroll to Top