Install Sophos XG Firewall OS on a SG Appliance

In this article we’ll show you how to turn your SG firewall into an XG firewall by installing the new SFOS on your Sophos SG firewall.

Info: This guide is intended for anyone who has purchased a SG Firewall with the pre-installed UTM operating system and now wants to install the new Sophos Firewall OS on it. Since the hardware of SG and XG is identical, this can be done in a few steps.

1. Download the SFOS ISO image

In the first step, we download the ISO image of the “Sophos Firewall OS”, which we will install later on the SG Firewall.

  1. Login to with your Sophos ID. If you don’t have an account yet, you must first create a Sophos ID.
  2. After logging in, click MySophos, after that on Network Protection, and then click Download Installers. Now you are on the right page to download the SFOS.
  3. By going to Hardware Installers you will find the Firewall OS for XG Series. Click on Download to download the installer.
  4. Accept the terms and conditions and click on Submit. The ISO image is then downloaded.

2. Create a bootable USB stick

In the second step, we copy the downloaded ISO image to a USB stick. We use a special tool for this purpose, so that the SG can boot from this USB device later on.

  1. Insert a USB stick with at least 4GB of memory into your computer. Make sure that there are any important data left on the USB stick, as it will be completely erased later.
  2. Browse the website and download the latest version of the Rufus tool.
  3. After that you can start the Rufus Tool by a double-click.
  4. In the dropdown next to Create a bootable disc using, select ISO Image.
  5. Afterwards, you can select the downloaded ISO image of the SFOS next to the dropdown.
  6. Select Cluster size and choose 8192 bytes and give the volume a name under volume label.
  7. Finally, just click on Start to format the USB stick and copy the SFOS image onto it. When you are asked which mode to write the image to the USB stick, select Write in DD Image mode.

3. Installing SFOS on the SG Appliance

The necessary preparations are now complete. You have a bootable USB stick with the SFOS on it. Now the installation on the SG Appliance can begin.

Important: Installing the SFOS on your SG completely overwrites the hard disk and resets the device to its original state. No SG configurations are transferred!

  1. Connect the SG to a screen (a keyboard is not necessary), plug in the USB stick and turn on the firewall.

    Info: By default, the appliance automatically boots from a USB device. First, the hard disk is formatted and the new OS is automatically installed. No key input is required. In our tests with an SG 125 with HDD (no SSD) the process took about 18 minutes.

  2. As soon as the SFOS installation is complete, the message “remove installer Disk - press y to reboot” appears.

    Info: You can now simply remove the USB stick and disconnect the firewall from the power supply. Then plug everything back in and restart. If you have connected a keyboard, you can of course also use the “clean” way and press y as instructed. 😃

4. Run SFOS Wizard

The SFOS is now installed on the SG and a wizard will help you to set up some basic configurations before you get started.

  1. Connect your PC to a network cable via the SG Firewall’s LAN 1 port.
  2. Give your PC for example the IP address

    Info: By default, the appliance is accessible via the IP address Since you are now on the same network as your computer, you should be able to access the firewall via a ping.

  3. Then open your web browser and access the web interface with
  4. If everything worked out, you will see the XG Firewall’s “Welcome screen”. With a click on Click to begin you can start the wizard and make some basic configurations. The following pictures show you what kind of settings you can expect.

With these four steps you have turned your SG Firewall with the UTM operating system into a XG with the SFOS. Congratulations! Next, you just need to know how to migrate your UTM license for SFOS. This tutorial will follow soon. However, you can already take a look at the exact migration path of your UTM license to SFOS here.