First Buy or Renewal

Were we able to help you with this tutorial? Then consider us for the next Renewal. 😎
We sell licenses for all Sophos Firewalls worldwide!

To the Products

Install Sophos XG Firewall OS on a SG Appliance

In this article we will show you how to turn your SG firewall into an XG firewall by installing the new SFOS on your Sophos SG firewall.

Info: This guide is aimed at anyone who has purchased an SG Firewall with the UTM operating system pre-installed in the past and now wants to install the new Sophos Firewall OS on it. Since the SG and XG hardware are identical, this can be done in a few steps. The procedure to reinstall an XG or XGS appliance is the same.


  • Sophos Firewall Appliance (SG, XG or XGS)
  • USB stick 4 GB or larger
  • Windows, macOS or Linux computer to prepare the USB stick

1. Download SFOS ISO image

The first step is to download the ISO image of the “Sophos Firewall OS”, which we will install later on the SG Firewall.

  1. Log in to https://id.sophos.com with your Sophos ID. If you do not yet have an account, you must first create a Sophos ID.
  2. After logging in, click MySophos, then Network Protection and finally Download Installers. Now you are on the right page to download the SFOS.
  3. Under Hardware Installers you will find the Firewall OS for XG Series. Click on Download to download the installer.
  4. Accept the terms and conditions and click on Submit. Then the ISO image will be downloaded.

2. Create bootable USB stick

Info: In the YouTube video we still use the tool Rufus. With the tool balenaEtcher described here it goes a lot easier.

In the second step we copy the downloaded ISO image to a USB stick. For this we use a special tool so that the SG can boot from this USB stick later.

  1. Insert a USB stick with at least 4GB of memory into your computer. Make sure that there is no more important data on the USB stick as it will be completely erased later.
  2. Go to the website https://www.balena.io/etcher/ and download the latest version of the balenaEtcher tool.
  3. After that you can start the balenaEtcher Tool by double clicking on it.
  4. First click Flash from file and select the previously downloaded ISO Image.
  5. Select a USB stick under Select target.
  6. Finally, click on Flash! to format the USB stick and install the SFOS image on it.
Prepare USB stick with SFOS ISO file

3. Installing SFOS on the SG Appliance

The preparations are now complete. You have a bootable USB stick with the SFOS on it. Now you can start the installation on the SG Appliance.

Important: Installing the SFOS on your SG will completely overwrite the hard disk and completely reset the device. No configurations of the SG will be taken over!

  1. Connect the SG to a screen (a keyboard is not necessary), plug in the USB stick and turn on the firewall.

    Info: By default, the appliance boots automatically from a USB device. First, the hard disk is formatted and the new OS is automatically installed. No key entry is required. In our tests with an SG 125 with HDD (no SSD) the process took about 18 minutes.

  2. Once the SFOS installation is complete, the message “remove installer Disk - press y to reboot “ appears.

    Info: You can now remove the USB stick. If you have connected a keyboard and want to press y, remember that the keyboard settings are set to US. So you would have to press z. You can, however, simply remove the USB stick and disconnect the box from the power supply and restart it. Works too. 😃

4. Start SFOS Wizard

The SFOS is now installed on the SG and a wizard will help you to set some basic configurations before you really get started.

  1. Connect your PC via the LAN 1 port of the SG firewall with a network cable.
  2. For example, give your PC the IP address

    Info: The appliance can be reached by default via the IP address Since you are now in the same network with your computer, you should be able to reach the firewall via a ping.

  3. Then open your web browser and access the web interface via
  4. If everything works fine, you will be shown the XG Firewall “Welcome screen”. With a click on Click to begin you can start the wizard and make some basic configurations. The following pictures will show you what settings to expect.

With these four steps you have transformed your SG firewall with the UTM operating system into a XG with the SFOS. Next, all you need to know is how to migrate your UTM license for SFOS. In addition, you can also see the exact Migration path of your UTM license to SFOS.