Install Sophos XG Firewall OS on a SG Appliance

In this article we will show you how to turn your SG firewall into an XG firewall by installing the new SFOS on your Sophos SG firewall.

Info: This guide is aimed at anyone who has purchased an SG Firewall with the UTM operating system pre-installed in the past and now wants to install the new Sophos Firewall OS on it. Since the SG and XG hardware are identical, this can be done in a few steps.

1. Download SFOS ISO image

The first step is to download the ISO image of the “Sophos Firewall OS”, which we will install later on the SG Firewall.

  1. Log in to https://id.sophos.com with your Sophos ID. If you do not yet have an account, you must first create a Sophos ID.
  2. After logging in, click MySophos, then Network Protection and finally Download Installers. Now you are on the right page to download the SFOS.
  3. Under Hardware Installers you will find the Firewall OS for XG Series. Click on Download to download the installer.
  4. Accept the terms and conditions and click on Submit. Then the ISO image will be downloaded.

2. Create bootable USB stick

In the second step we copy the downloaded ISO image to a USB stick. For this we use a special tool so that the SG can boot from this USB stick later.

  1. Insert a USB stick with at least 4GB of memory into your computer. Make sure that there is no more important data on the USB stick as it will be completely erased later.
  2. Go to the website https://rufus.akeo.ie/ and download the latest version of the Rufus tool.
  3. After that you can start the Rufus Tool by double clicking on it.
  4. In the dropdown next to Create a bootable disc using select the variant ISO Image.
  5. Then you can select the downloaded ISO image of the SFOS next to the dropdown.
  6. Select 8192 bytes under Cluster size and give the volume under volume label a name.
  7. Finally a click on Start is enough to format the USB stick and copy the SFOS image to it. When asked which mode to use to write the image to the USB flash drive, select Write in DD Image mode.

3. Installing SFOS on the SG Appliance

The preparations are now complete. You have a bootable USB stick with the SFOS on it. Now you can start the installation on the SG Appliance.

Important: Installing the SFOS on your SG will completely overwrite the hard disk and completely reset the device. No configurations of the SG will be taken over!

  1. Connect the SG to a screen (a keyboard is not necessary), plug in the USB stick and turn on the firewall.

    Info: By default, the appliance boots automatically from a USB device. First, the hard disk is formatted and the new OS is automatically installed. No key entry is required. In our tests with an SG 125 with HDD (no SSD) the process took about 18 minutes.

  2. Once the SFOS installation is complete, the message “remove installer Disk - press y to reboot “ appears.

    Info: You can now remove the USB stick. If you have connected a keyboard and want to press y, remember that the keyboard settings are set to US. So you would have to press z. You can, however, simply remove the USB stick and disconnect the box from the power supply and restart it. Works too. 😃

4. Start SFOS Wizard

The SFOS is now installed on the SG and a wizard will help you to set some basic configurations before you really get started.

  1. Connect your PC via the LAN 1 port of the SG firewall with a network cable.
  2. For example, give your PC the IP address 172.16.16.12.

    Info: The appliance can be reached by default via the IP address 172.16.16.16. Since you are now in the same network with your computer, you should be able to reach the firewall via a ping.

  3. Then open your web browser and access the web interface via https://172.16.16.16:4444.
  4. If everything works fine, you will be shown the XG Firewall “Welcome screen”. With a click on Click to begin you can start the wizard and make some basic configurations. The following pictures will show you what settings to expect.

With these four steps you have transformed your SG firewall with the UTM operating system into a XG with the SFOS. Next, all you need to know is how to migrate your UTM license for SFOS. In addition, you can also see the exact Migration path of your UTM license to SFOS.