Transfer a Sophos Firewall licence to a replacement device

When a Sophos Firewall is replaced, the paid subscription must move from the previous serial number to the new firewall. In Sophos Fusion (formerly Sophos Central), this operation is called Transfer subscriptions. It transfers the licence, but neither the local configuration nor the Central management registration.

For a typical replacement, use this order:

1. Verify the old and new serial numbers, models, Central account, and HA roles.
2. Secure a current backup, the encryption password, and the Secure Storage Master Key.
3. Claim the new firewall in the same Sophos Fusion account.
4. For an RMA, check the offered automatic transfer; otherwise use Transfer subscriptions.
5. Verify the subscription and expiry date on the destination firewall and synchronise the licence in SFOS.
6. Restore the configuration separately and test production operation.

⚠️ During an RMA transfer, Sophos warns that the old firewall will become unusable. The serial numbers, backup, and cutover plan must therefore be correct before confirmation. A licence transfer is not a configuration backup.

Choose the correct transfer first

Sophos Fusion offers several similarly named operations. They solve different tasks:

• Transfer subscriptions moves paid licences between two firewalls in the same Central account. This article explains that workflow.
• Transfer firewalls moves the claim and licence assignment to another Central account. For that, use Transfer Sophos Firewall to another Sophos Fusion account.
• Activate subscription redeems a new Subscription Key. This is described in Activate a Sophos Firewall licence key.
• Backup and restore transfers the SFOS configuration. It is independent of the licence transfer.

The serial number connects the hardware, claim, and licence status. Before every step, clearly document the serial numbers of both firewalls. The display name or location alone isn’t a reliable check when devices are similar.

Even without HA, a paid licence already assigned to the wrong firewall serial number can require a transfer to the intended serial number.

Prerequisites before the transfer

Run the operation in the Sophos Fusion Admin account where the source firewall is claimed. The administrator account in use must be able to see Licensing > Firewall licenses and the transfer action. Before a manual transfer, the destination firewall must be claimed in that same Central account. If the devices are in different accounts, or only ownership is changing, use Transfer firewalls rather than a subscription transfer.

Sophos specifies three fixed limits for a manual subscription transfer: The firewalls must be the same model or one that Sophos accepts as equivalent, evaluation subscriptions can’t be transferred, and Hardware as a Service devices are excluded. In Central, first record the source’s Features, Subscription, License ID, and Expiry. For the destination serial number, check the claim, model, and any existing paid subscriptions.

If the destination doesn’t appear under Transfer to, or model equivalence is unclear, don’t experiment with another serial number or a second account. First compare the licence documents, both serial numbers, and the RMA or replacement order with the Sophos partner or Support.

Prepare the technical migration in parallel. This includes a current Sophos Firewall backup and restore test, required certificates, WAN credentials, local access to both devices, a maintenance window, and a cabling and configuration fallback plan. The destination firewall needs internet access to retrieve and synchronise its licence. For HA, identify the Initial Primary, current Primary, and Auxiliary before the licence step.

Set the timing and account for downtime

Transfer subscriptions moves the paid entitlement to the destination serial number. Only click it when the destination firewall is ready and can be checked immediately afterwards. Claiming, licence transfer, restore, and cable cutover are separate steps; a successful portal transfer doesn’t switch the traffic path to the replacement.

The Central transfer doesn’t include a documented restart. The overall cutover can still cause an outage through restore, different port mappings, WAN cutover, or HA reconfiguration. Sophos explicitly warns of downtime when restoring active-passive HA after an RMA. Size the maintenance window for the complete device replacement, not just the portal operation.

Transfer the subscription to the destination firewall manually

This workflow is suitable for a regular hardware replacement or when the automatic RMA transfer isn’t offered. Subject to the prerequisites above, the same manual workflow also corrects such a misassignment without HA: the source is the firewall to which the licence was assigned by mistake; the destination is the intended firewall.

1. Open the profile icon in Sophos Fusion.
2. Go to Licensing > Firewall licenses.
3. Find the source firewall by serial number and expand its details row.
4. Compare Features, Subscription, License ID, and Expiry with the planned result.
5. Select Transfer subscriptions.
6. If required, select the option to show firewalls that already have paid licences.
7. Under Transfer to, select the destination firewall by its intended serial number. Compare source and destination with the runbook once more before proceeding.
8. Confirm with Finish. If subscriptions overlap, Central displays an additional confirmation dialog.
9. Find the destination firewall again, expand its details, and verify Features, Subscription, License ID, and Expiry.

A destination firewall that already has a licence isn’t a reason to confirm the overlap dialog blindly. First establish which terms and modules are expected after the transfer. Stop the process and clarify the licence assignment if the details conflict. Only after checking that the expected terms and modules are correct and no conflicts remain, click Yes in the overlap dialog to proceed with the transfer.

Claim an RMA replacement and check the licence transfer

For an RMA recognised by Sophos, the licence transfer can be offered while claiming the replacement device. In Sophos Fusion, open Licensing > Firewall licenses, select Claim firewall, enter the new serial number, and click Validate. The dialog warns that the licence will be transferred to the replacement device and that the old firewall can no longer be used. Only after checking both serial numbers should the transfer be confirmed and Claim firewall executed.

The automatic dialog only appears when Central recognises the matching RMA case. According to the SFOS 22 help, automatic transfer may not occur when the registrants don’t match, a serial number was recorded incorrectly in the RMA case, the replacement isn’t the same model, or the faulty device wasn’t registered. In that case, first claim the replacement and then carry out the manual subscription transfer in a controlled manner.

Once the RMA transfer is complete, the faulty device is deregistered. Check this status and the replacement firewall’s licence details before returning the faulty firewall. Follow the return instructions for the specific RMA case. If the specific RMA case requires a return, Sophos must receive the faulty firewall within 15 days after the customer receives the replacement device. Dispatching it on day 15 is not sufficient; if the return is late or incomplete, Sophos may suspend the subscription transfer or charge costs. Remove SFPs, Flexi-Port modules, rackmount kits, power supplies and cables before returning the faulty firewall. The complete hardware procedure, including diagnosis, a Support case, restore and return, is explained in Sophos hardware failure: prepare for an RMA and replacement.

Apply a paid licence to an existing virtual trial firewall

Sophos describes a special procedure for a virtual firewall with a trial serial number. The VM already in operation remains the destination; the new serial number received with the purchase is the source of the paid subscriptions. The existing VM is therefore not replaced with a newly installed appliance.

1. Document the trial serial number of the running VM and the new serial number from the purchase documents separately. In the runbook, label the new serial number as Source and the existing trial serial number as Destination.
2. Claim the newly purchased firewall using its new serial number in the same Central account in which the trial serial number is registered.
3. Start the manual procedure described above from the new serial number. Under Transfer to, select the virtual firewall already in operation with the trial serial number, not the other way round. Before selecting Finish, compare both serial numbers with the runbook again.
4. After the transfer, check the licence details under the existing trial serial number and synchronise the licence on the running VM under Administration > Licensing. The paid modules and subscription terms shown there must match the planned result.

This does not transfer the evaluation subscription to another device. Instead, the paid subscription moves to the existing VM; the newly claimed serial number is deleted as part of this operation. The absence of this new entry afterwards is therefore expected in this special procedure and is not, on its own, an indication that the transfer has failed. The virtual firewall does not need to be reinstalled and continues to operate with the transferred subscriptions.

Assign the HA licence correctly

For Active-Passive HA, the licences belong to the Initial Primary, according to Sophos. The display name Primary alone is not sufficient, because the current role can change after a failover.

If the licences were assigned to the Auxiliary by mistake, first document its incorrectly licensed source serial number and the intended destination serial number of the Initial Primary separately from the current HA roles, and cross-check them in SFOS and Central.

⚠️ This abbreviated correction procedure applies only when the current Primary and Initial Primary are the same physical device. If they are different devices or the mapping is unclear, stop before disabling HA or transferring licences and clarify the appropriate procedure with Sophos Support; do not improvise a role switchback.

Only once the mapping is unambiguous should HA be disabled on the current Primary as a planned change, the licences transferred in Central from the documented source serial number to the documented Initial Primary destination serial number, and HA then reconfigured. This is a planned HA change, not a routine online transfer.

For an active-passive RMA, the replacement and healthy node must be on the same firmware build before HA is rebuilt; check the model, revision, and Initial Primary first. Sophos warns of an outage during reimaging, recabling, and HA reconfiguration. Active-active and active-passive also have different licensing requirements. Follow the matching procedure in Sophos Firewall HA variants and licensing, and don’t use a transfer to repair an unclear HA state.

Validate the licence and replacement device

After the transfer, compare Features, Subscription, License ID, and Expiry under the destination serial number in Sophos Fusion with the values recorded beforehand. On the firewall, check the licence status under Administration > Licensing and run Synchronize if required. The serial number, model, modules, and terms must match the plan, and required modules must appear as Subscribed.

Then perform the technical acceptance separately from the licence check:

• Restore the backup on the intended firmware and destination model.
• Check interfaces, zones, routing, DNS, NAT, firewall rules, and VPN connections.
• Check Central management and reporting separately; a claim or licence transfer doesn’t automatically register these services again.
• Wait for pattern and licence synchronisation, then verify protection modules with a controlled test.
• For an RMA, confirm that the faulty firewall is deregistered.

A visible expiry date in Central doesn’t prove a working traffic path. Conversely, an initially outdated display in SFOS doesn’t automatically mean that the transfer failed. Only synchronisation, licence details, and a real functional test together provide reliable acceptance.

Fallback and escalation

Before the cable cutover, the technical fallback is the secured backup together with the documented old cabling and local access. Sophos doesn’t document a transactional undo control or guarantee a reverse transfer for Transfer subscriptions. Don’t confuse a configuration fallback with a reversible licensing action.

If a regular replacement fails after the transfer, leave the old device unchanged until the partner or Sophos Support has clarified the licence assignment; don’t initiate another speculative transfer. For a confirmed RMA, the old device is unusable and deregistered after transfer, so it explicitly isn’t a licensing rollback target. For escalation, provide the Central account, RMA or Support case, both serial numbers, models and revisions, licence details before and after, and the exact transfer time.

When the licence transfer doesn’t work

The destination firewall is missing from the list

First check whether the new firewall is claimed in the same Central account. Then verify the model, serial number, evaluation status, and HWaaS status. Don’t try to bypass a missing or unclear model combination by using another device as an intermediate destination.

The automatic RMA transfer doesn’t appear

Compare the RMA number and the old and new serial numbers with the Support case. If the registrant, model, or registration doesn’t match the case, a manual transfer may be required. Don’t return the old firewall until the claim, licence details, and deregistration are resolved.

Central shows the licence, but SFOS doesn’t

First run Synchronize under Administration > Licensing. If the status remains incorrect, check internet access, DNS, system time, and licensing.log. The detailed workflow is in Activate and synchronise Sophos Firewall licences.

The replacement device has no configuration

This isn’t a licence-transfer error. Transfer the configuration separately through backup and restore or as part of a planned migration. Stop the recovery if no compatible backup, password, and, where required, Secure Storage Master Key are available.

FAQ