Reinstall Sophos Firewall OS: USB reimage

A reimage fully reinstalls Sophos Firewall OS. The procedure is intended for recovery situations, lab systems, model changes or a clean reinstall. For normal version changes, a firmware update through the WebAdmin interface is usually the better choice.

⚠️ Important: A reimage overwrites the firewall completely. Configuration, local logs, certificates, reports and stored account data are no longer present on the device afterwards. Before starting, a current backup and the matching Secure Storage Master Key (SSMK) are required if encrypted configuration data is to be restored later.

Reimage, firmware update or factory reset?

For a normal update, first check Sophos Firewall: perform SFOS firmware update. A Factory Reset is also not the same as a reimage: it resets the configuration, but does not remove all local data like a full reinstall. The Secure Storage Master Key is also not cleared during a Factory Reset. If the firewall really needs to return to a clean default state including logs, reports and local operational data, reimage is the more suitable path. For XGS appliances with damaged firmware, Sophos refers to the reimage procedure because SFLoader is not available for XGS.

When not to start a reimage

A reimage is the hard recovery option. If normal administrative access is still possible, first check whether a less invasive approach is sufficient.

Reimage makes sense if the operating system is damaged, a clean rebuild is required, or Sophos Support or the recovery plan specifies this path. For normal maintenance, individual GUI problems or unclear performance issues, it is usually too early.

If the firewall starts in Failsafe mode, record the detected cause before a Reboot, Factory Reset, or reimage. Check Sophos Firewall in Failsafe mode shows the show failure-reason command and the safe next decisions.

Back up before the reimage

Before a production reimage, prepare these points:

• Download a current configuration backup and store it safely.
• Document the Secure Storage Master Key if the backup contains encrypted account data.
• Check licence status, serial number and Sophos Central assignment.
• Document model, revision, current SFOS version, build, target version and backup version.
• Note WAN data, VLANs, static routes, VPN parameters and special HA information separately.
• Plan a maintenance window because the firewall does not protect or process traffic during the reimage.
• Ensure local access to the appliance, power supply, USB port and management port.
• Check the restore process beforehand, especially for HA clusters and critical VPN sites.
• Save logs or support archives if the cause must still be analysed later.

The relevant basics are covered in Sophos Firewall: create and restore backups, Sophos Firewall: SFOS 22 upgrade check and Sophos Firewall HA cluster: Active-Passive, Active-Active and Auxiliary Appliance.

If the reimage is part of an RMA or HA scenario, this documentation becomes even more important. Then not only the main version matters, but also the build. A replacement device should match the healthy firewall or be deliberately brought to the target version before backup, licence transfer and HA reconfiguration begin.

Clarify restore compatibility in advance

The most important part of a reimage is not writing the USB stick, but the successful restore afterwards. A backup should not be assessed for the first time only after the reinstall.

Clarify beforehand:

For hardware replacement, XG-to-XGS migration or restore to another model, also check whether the Backup-Restore Assistant is available and whether port mapping is correct before the final restore. The process is described in Sophos Firewall backup and restore.

For HA and RMA, the rule of thumb is: firmware version and build of the involved devices are checked before restore. If the required old firmware version can no longer be downloaded normally, do not improvise; involve Sophos Support or the existing support process.

Requirements

• Sophos Firewall appliance or suitable software or virtual appliance.
• USB stick with at least 4 GB storage.
• Windows, macOS or Linux computer to create the bootable USB stick.
• Tool for writing the ISO image, for example balenaEtcher.
• Local access to the appliance.
• Optional: USB-to-Micro-USB cable or RJ45-COM adapter for status messages and troubleshooting through the serial console.

Enhanced Support entitlement is not required for the reimage itself. Regular firmware upgrades are still subject to the relevant licence and support conditions.

1. Download the correct SFOS installer image

The installer image is obtained from the official Sophos download page:

1. Open the Sophos Firewall Installers. Alternatively, use the direct download.
2. For Sophos hardware appliances, select the required SFOS version under Hardware Installers.
3. Accept the licence terms and download the ISO image.

Hardware appliances usually use an image with the HW prefix. Software and virtual appliances use other image types. What matters is that platform, target version and restore plan fit together. A wrong image is not a small cosmetic mistake; it can stop the recovery workflow.

Installer image filename

Example: HW-22.0.1_MR-1-490.iso

The most important filename components:

• Platform or appliance type

  • HW: ISO image for Sophos hardware appliances. This variant is usually required for reimaging an XGS appliance.
  • SW: ISO image for Sophos Firewall as a software appliance.
  • VI: Image package for Sophos Firewall as a virtual appliance.
  • AMI: Image for Amazon AWS.
  • AZU: Image for Microsoft Azure.

• Virtualisation platform for VI files

  • HYV: Microsoft Hyper-V.
  • KVM: KVM.
  • VMW: VMware Hypervisor.
  • XEN: Xen.

• Release type

  • GA: General Availability. This is a generally available major or interim version, often with new functions.
  • MR: Maintenance Release. An MR mainly contains fixes, stability improvements and security adjustments within an existing version.

• File extension

  • .iso: ISO image that can be written to a USB stick or used for software appliances.
  • .zip: Archive with image files for virtual appliances.
  • .sig: Signed image for certain appliance models or update scenarios.

For production systems, the current MR of a supported version is usually the better choice than a freshly released GA version. If a reimage is part of a recovery or support case, the target version must always match the available backup, licence status and planned restore.

For an XGS reimage, a file such as HW-22.0.1_MR-1-490.iso is normally relevant. SW, VI, AMI or AZU are intended for other platforms and should not be used for a hardware appliance.

2. Create a bootable USB stick

The USB stick is formatted when the ISO image is written. All existing data on the USB stick is lost.

1. Insert a USB stick with at least 4 GB storage into the computer.
2. Download and start balenaEtcher.
3. Use Flash from file to select the downloaded SFOS ISO image.
4. Under Select target, select the correct USB stick.
5. Use Flash! to write the ISO image to the USB stick.

After writing, eject the USB stick cleanly. If macOS or Windows reports the stick as unreadable afterwards, this is not necessarily an error because the image was written for the appliance boot process.

3. Reinstall SFOS on the firewall

The reimage process runs directly on the appliance. The device must not be switched off during this process.

1. Shut down the firewall completely.
2. Optionally prepare monitor, LCD or serial console if the installation status should be observed.
3. Insert the prepared USB stick into the firewall.
4. Switch on the firewall.
5. Wait until the Sophos Firmware Installer starts from the USB stick.
6. Monitor the installation status depending on the appliance model.
7. After successful installation, remove the USB stick.
8. If the installer then asks for confirmation, restart with y.

Status on XGS desktop appliances

Many XGS desktop models have no VGA, SVGA or HDMI connector for a monitor. The reimage status is therefore shown through the status LED on the front. If more detail is needed, use the serial console through the COM connector.

The reimage is only complete when the LED is solid green. While the LED is blinking red, the process is still running.

Status on XGS rack appliances

Rack appliances show the status on the integrated display. Typical messages are Installation in progress, Installation successful, Installation failed or Failsafe mode.

Status through the serial console

For additional diagnostics, a console can be connected. On current XGS desktop appliances, this is usually no longer a classic old RS-232 connector on the notebook, but a USB-to-Micro-USB cable connected to the firewall’s COM Micro USB port. The appliance still provides a serial console through it. On the admin computer, it appears as a COM port on Windows or as a tty device on macOS and Linux.

This is especially useful when no display connector is available, the LED remains solid red, booting from the USB stick is unclear, or installer and error messages need to be viewed directly. Many XGS models also have an RJ45-COM port. This RJ45-COM port is a console port, not a normal network port. If Micro-USB and RJ45-COM are connected at the same time, Micro-USB has priority.

Typical tools:

• Windows: PuTTY, Windows Terminal or another serial terminal client.
• macOS: Terminal with screen, for example screen /dev/tty.usbserial-XXXX 38400.
• Linux: screen, minicom or picocom.

Serial settings:

4. Reach the firewall after the reimage

After the reimage, the firewall starts with the default configuration. The first access is typically through Port 1:

• Management IP: https://172.16.16.16:4444
• Connection: connect the computer directly to Port 1 of the firewall
• Computer IP: set a suitable static IP in the 172.16.16.0/24 network if access is not possible

Then follow the basic configuration or restore an existing backup. During restore, the matching Secure Storage Master Key must be provided if the backup contains protected account data.

After the restore, at least these points should be checked:

• Interfaces, zones and VLANs.
• Default gateway, static routes and SD-WAN routes.
• Firewall rules, NAT rules and Webserver Protection.
• VPN connections and certificates.
• Licence status and synchronisation with Sophos Central.
• HA status if the firewall is part of a cluster.
• Logging, syslog targets and reporting.

For centrally managed firewalls, connect Sophos Firewall to Sophos Central also helps. For model changes or older devices, Sophos XG or XGS Firewall: choose the right appliance is relevant.

Do not treat HA and RMA like a standalone device

With a single lab device, a reimage is usually linear: write image, install, restore backup, test. With HA and RMA, the workflow is more sensitive. Beforehand, you must know which device is healthy, which role it has, which firmware version and build it runs, and whether Sophos Central or the licence transfer must be cleaned up first.

In Active-Passive environments, a replacement device should not simply be connected to the cluster with all cables attached. A controlled workflow is more typical: check firmware state, reach the replacement device locally through Port 1, connect WAN only for registration or licence transfer, restore the matching backup, deliberately rebuild HA and only then move productive cables. The exact order depends on whether the Primary or the Auxiliary is being replaced.

Acceptance test after reimage and restore

After a successful login, a quick look at the dashboard is not enough. The firewall must serve the most important production paths correctly again.

Useful order:

1. Check licence status, serial number, model and firmware version.
2. Check interfaces, link status, VLANs and zones.
3. Check WAN gateway, DNS, NTP and Sophos Central connection.
4. Validate firewall rules, NAT rules and Log Viewer with a test client.
5. Test site-to-site VPNs and remote access with real test targets.
6. Check HA status and roles if a cluster is involved.
7. Check syslog, Central Reporting, backups and scheduled reports.
8. Remove old temporary access, local admin accounts or recovery exceptions.

If a restore was successful but traffic does not flow, do not immediately reimage again. Interface mapping, routing, NAT, Device Access, licence status or the peer return path are often involved. For analysis, use test firewall rule with Log Viewer, Policy Test and Packet Capture, understand NAT on Sophos Firewall and Sophos Firewall IPsec VPN troubleshooting.

Common problems

Firewall does not boot from the USB stick

Usually the USB stick was not written correctly, the wrong image was selected or the appliance does not start from the expected USB port. In that case, write the ISO again with balenaEtcher, test another USB stick and observe startup through monitor, LCD, status LED or serial console.

LED remains solid red

A solid red status LED means that the reimage failed. Do not simply continue productively by guesswork: check USB stick, image type, target model and installation message. If the error repeats, serial console and Sophos Support are more useful than several identical attempts.

Backup restore fails

Typical causes are an unsuitable target version, a damaged backup, a missing SSMK or a restore to another model without clean port mapping. First check backup version, target SFOS version, build, platform and SSMK. Then clarify whether a Restore Assistant, an intermediate step through another SFOS version or support is required.

WebAdmin is not reachable after reimage

After the reimage, the default configuration applies again. Connect the computer directly to Port 1, set a suitable IP in the 172.16.16.0/24 network and open https://172.16.16.16:4444. If that does not work, first check link status, local client IP, browser certificate warning and possibly boot status.

HA does not start cleanly after restore

With HA, the problem is often not the reimage itself, but role, firmware state, build, Initial Primary, Central assignment or restore order. Therefore, do not automatically reactivate HA; first document the state of both devices and compare it with the planned HA workflow.

Traffic does not flow after restore

If the configuration was restored but traffic does not work, interface mapping, zones, routing, NAT, Device Access, licence status or return paths are often involved. Log Viewer, Rule ID, NAT ID, Route Lookup and Packet Capture then help more than another reimage.

Licence or Central connection is missing

After reimage, RMA or model change, serial number, account assignment, licence transfer, DNS, gateway and Sophos Central connection must fit again. Only once the firewall is cleanly online should this be treated as a productive operating state.

Checklist

• Backup downloaded.
• Secure Storage Master Key available.
• Backup and target SFOS version documented.
• Firmware build and model revision checked, especially for HA or RMA.
• Serial number, licence status and Central assignment checked.
• Correct SFOS installer image selected.
• USB stick written successfully.
• Maintenance window and local access clarified.
• Appliance not switched off during the reimage.
• WebAdmin reached through Port 1 after restart.
• Backup restored and SSMK entered.
• Network, VPN, licence, Central and HA checked.
• Rule, NAT, routing and VPN tests performed with real clients.
• Temporary recovery access and notes cleaned up.

FAQ