Operating Sophos Firewall Air-Gap Licensing and Pattern Updates

A Sophos Firewall can be operated in highly isolated environments without direct internet access. This is not a normal offline mode but a deliberately planned air-gap operation with its own licensing logic, manual synchronization, and a separate update process for patterns.

The most important point: Air Gap is not a way to simply operate a firewall “without the internet” on the side. You need prior approval, a claimed hardware firewall, a clear update process, and regular checks of license and pattern statuses. Otherwise, the firewall may continue to run, but protection functions lose their currency, or subscriptions are deactivated.

For general licensing logic, first see Understanding Sophos Firewall Base License. This article focuses on the special case of Air Gap.

When Air Gap is Sensible

Air Gap is only suitable for environments where the firewall is deliberately operated separated from the internet. Typical examples are highly regulated networks, research environments, defense environments, production segments, or other zones where direct cloud or update connections are not allowed.

Before deciding, three questions should be separated:

Air Gap does not automatically increase security. It reduces a certain connection surface but shifts responsibility to processes: download, verification, transfer, upload, documentation, and monitoring.

Prerequisites

Before installation, these points should be clarified:

• The firewall must be claimed as an air-gap firewall in Sophos Central.
• Air-gap usage must be approved by the Sophos Account Manager.
• According to Sophos, Air Gap is intended for hardware firewalls.
• The environment must not simply be temporarily offline but must be planned as an isolated environment.
• The firewall must not be operated with MSP Flex licensing in an unsuitable model.
• Admin access to CLI and WebAdmin is required.
• A secure way to transfer license and pattern files into the isolated environment is needed.

Before implementation, document the serial number, model, Sophos Central account, license status, and responsible person. For serial numbers and license basics, see Activate Sophos Firewall License Key and Find Sophos Firewall Serial Number.

Overview of the Process

The air-gap process consists of several separate steps. If one of them is missing, the firewall is not properly in air-gap operation.

The order is important. A license file alone is not enough if Air Gap has not been activated on the firewall. Conversely, the CLI command is useless if there is no valid air-gap license file from the correct account.

Download Air-Gap License

The license file is downloaded in Sophos Central. The typical path is:

Sophos Central > Profile Menu > Licensing > Firewall licenses > Download airgap license

The license file should be handled carefully after download and should not be placed in private downloads, messengers, or unclear clipboards. A brief internal record is sensible:

• Download date
• Sophos Central account
• Affected firewall or firewall group
• Serial numbers
• Responsible person
• Planned upload time

Sophos specifies that a downloaded air-gap license must be applied within 30 days. If the file is used too late, a new file should be downloaded.

Activate Air Gap on the Firewall

To make manual license synchronization visible in WebAdmin, Air Gap must be activated on the firewall via CLI.

Procedure:

1. Log in to the firewall console or via SSH.
2. In the Sophos console, select 4 for Device Console.
3. Execute the command:

system airgap enable

Afterwards, the Manual license synchronization section should be visible under Administration > Licensing.

This step should be documented. In productive environments, it belongs in the same change as the license file upload, so it is clear later when Air Gap was activated and which license file it corresponds to.

Upload Air-Gap License

After activation, the license file is applied in WebAdmin.

Procedure:

1. Log in to the WebAdmin Console.
2. Open Administration > Licensing.
3. In the Manual license synchronization section, select Choose file.
4. Select the air-gap license file.
5. Apply with Update license.
6. Check license status and expiration dates.

After the upload, check whether the expected subscriptions are active. A successful license synchronization does not replace a functionality check. If Web Protection, IPS, Zero-Day Protection, or other modules are used, policy, pattern status, logging, and tests must be correct separately.

HA Cluster: Consider Initial Primary

In Active-Passive HA, air-gap licensing is particularly delicate. The license file should only be applied to the Initial Primary. This device must also be the current Primary during the upload.

If the license is uploaded to the wrong node, license differences or unexpected HA behavior can occur. Therefore, it is sensible for operation:

1. Check System services > High availability before the upload.
2. Document Initial Primary and current role.
3. Set Initial Primary as Preferred primary device.
4. Apply the license file on the correct Primary.
5. Then check HA status and license status.

For HA basics and role logic, see Set Up Sophos Firewall High Availability. In Air Gap, this preparation is not optional because the wrong node can later cause incomprehensible license or failover symptoms.

Manually Apply Pattern Updates

Without automatic online updates, patterns must be consciously maintained. This affects signatures, engines, clients, and other update components. In air-gap environments, a pattern file is downloaded and uploaded in WebAdmin.

For SFOS 22.0 and newer, Sophos refers to the air-gap pattern file:

https://airgap.u2d.sophos.com/sfos_pattern_updates_v2.tar

Procedure:

1. Download the pattern file on a designated system.
2. Transfer the file into the isolated environment via the approved transfer method.
3. Log in to the firewall.
4. Open Backup & firmware > Pattern updates > Manual pattern update.
5. Select Choose file.
6. Upload the pattern file.
7. Confirm the upload and check the update status.

In HA environments, patterns are applied on the Primary and then synchronized to the Auxiliary. Therefore, the HA status should be checked first here as well.

Check Pattern Status

An air-gap operation is only as good as the routine behind it. New patterns are regularly available. If the firewall is not updated for a long time, the value of IPS, Antivirus, Application Signatures, and other protection functions decreases.

Practical control:

For a general operational check, additionally see Proper Use of Sophos Firewall Health Check. There, Air Gap should not be understood as an exception to update hygiene but as a special process for the same duty: keeping protection functions current.

License Expiration and Incommunicado Window

With normal license synchronization, 90 days without a successful sync are critical. For air-gap licenses, a longer window of 180 days applies. After that, security subscriptions are deactivated; Base Firewall and Enhanced Support remain active.

For operation, this means:

• By day 160 at the latest, a new air-gap license file should be prepared.
• At the latest with warning messages, the upload must be planned.
• After 180 days without a new air-gap license, deactivation of protection subscriptions threatens.
• Traffic can continue, but without the affected protection functions.
• The status should be monitored via WebAdmin, Alerts, and licensing.log.

licensing.log is particularly important for license problems. An overview of relevant firewall logs is available in Sophos Firewall Troubleshooting: Services and Logs.

What is Restricted in Air-Gap Environments

Air Gap means that online services do not function as they would in a normally connected firewall. Some functions are not supported at all, while others lose part of their effectiveness.

Typical limitations:

This point is often underestimated in projects. An air-gap firewall cannot deliver the same cloud-supported protection effect as a normally connected firewall. Therefore, it should be decided before the design which protection functions are absolutely necessary and how the missing online functions will be compensated: internal DNS and NTP servers, manual pattern routine, Syslog, local documentation, and a clear support process.

Establish Operational Routine

Air Gap requires a fixed routine. Otherwise, license and pattern updates only become noticeable when a warning appears or a protection module is no longer current.

Sensible routine:

Firmware updates remain a separate process. For execution, see Perform Sophos Firewall Firmware Update, for backup and recovery Create or Restore Sophos Firewall Backup.

Common Mistakes

Clarifying Air Gap Only After Installation

Air Gap should be clarified before procurement and installation. If the firewall is already productively isolated but no suitable air-gap approval or license file is available, unnecessary pressure arises.

Treating Pattern Updates as Optional

Pattern updates are not less important in air-gap environments but operationally more demanding. Without routine, protection functions quietly become outdated.

Ignoring HA Role Before License Upload

In Active-Passive HA, the Initial Primary must be the correct current Primary. Otherwise, the license status can become unclear after failover or upload.

Assuming Cloud Functions

Zero-Day Protection, Sophos Central Management, Online Reputation, RED Online Provisioning, or Support Access should not be silently planned in air-gap designs.

Handling License Warnings Too Late

Air-gap licenses have a 180-day window, but the process should not start on the last day. Download, transfer, change approval, and upload take time.

Checklist

• Air-gap approval clarified with Sophos.
• Firewall claimed in the correct Sophos Central account.
• Serial number, model, and license status documented.
• Secure file transfer into the isolated environment defined.
• system airgap enable executed and documented.
• Air-gap license uploaded under Administration > Licensing.
• For HA: Initial Primary, current Primary, and Preferred Primary checked.
• Pattern file downloaded and applied under Backup & firmware > Pattern updates.
• License status, pattern status, and licensing.log checked.
• Operational routine for pattern, license file, HA status, and firmware window established.

FAQ