Understand and enable LINCE mode on Sophos Firewall

Sophos Firewall provides a LINCE mode under SFOS 22. It restricts the available cryptographic algorithms and changes SSH behavior, among other things. Sophos doesn’t document a factory reset as it does for FIPS mode; the immediate documented effect is that the SSH service restarts and existing SSH sessions are disconnected.

The most important point comes before any command: An enabled LINCE mode is not automatically proof of certification for the installed SFOS build. The current Sophos help for SFOS 22 explicitly names SFOS 20.0 MR1 and MR2 as LINCE-certified. Formal certification therefore also requires the certificate and its exact product, version, and platform scope.

The safe sequence is short:

Clarify the compliance requirement and certification scope in writing.
Document the SFOS build, platform, HA status, and current SSH usage.
Test the backup, an independent WebAdmin or console path, and the recovery path.
Check SSH keys and clients against the LINCE algorithms.
For HA, enable the mode on both devices while they are still standalone.
Run system certification lince enable and wait for the SSH restart.
Retest management access, key authentication, VPNs, syslog, and backup.

⚠️ Warning: The command disconnects existing SSH connections. Don’t enable the mode from an active SSH session without working WebAdmin or local console access and a compatible SSH key.

LINCE mode and LINCE certification aren’t the same

LINCE is a Spanish government security certification for IT products. The mode on the firewall enables the cryptographic restrictions documented by Sophos. A certification, however, always applies only to the product version and evaluation scope named in the certificate.

The current SFOS 22 help documents LINCE mode but only identifies SFOS 20.0 MR1 and MR2 as LINCE-certified. This doesn’t establish that SFOS 22 becomes formally certified merely by enabling the mode.

For an audit or tender, keep at least these items of evidence separate:

exact firewall type and SFOS build
enabled LINCE mode as a technical system setting
official certificate with version, platform, and scope
documented configuration and validation of the affected services

If no suitable certificate exists for the target version, the compliance team or Sophos should confirm the permitted migration path. A visible mode or restricted algorithm list doesn’t replace this approval.

What changes cryptographically

Sophos lists the following permitted algorithms for LINCE mode:

KexAlgorithms:
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

Encryption:
aes128-gcm@openssh.com
aes256-gcm@openssh.com

Public key authentication:
hmac-sha2-256
hmac-sha2-512

Server host key algorithms:
rsa-sha2-512
rsa-sha2-256
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521

The names show why preparation matters: Old SSH clients, old public keys, or automation systems may no longer find a common combination after activation. Inventory all administrative SSH access, monitoring scripts, and backup automation first. A working WebAdmin login doesn’t prove that public-key authentication also works.

LINCE is also not the same as FIPS 140-3 on Sophos Firewall. FIPS has different platform, algorithm, and HA limits and triggers a factory reset when enabled. Don’t interchange the two modes in terminology or in a migration plan.

Prepare the activation

A reliable recovery path must be ready before the maintenance window. This includes a current encrypted backup, the backup password, and the Secure Storage Master Key that was active when it was created. WebAdmin or the local console must also work independently of the SSH connection that is about to be disconnected.

Document the following for the technical inventory:

SFOS version and build
standalone or HA status and the role of each device
SSH clients, public keys, and automation accounts in use
VPN peers and negotiated cryptographic values
TLS syslog collector and its certificate names
backup target, restore target, and current LINCE status

Don’t replace an existing key speculatively when using public-key authentication. Check the key type, client support, and alternative administrative access first. Connect to Sophos Firewall using SSH explains normal access; for the LINCE change, the local console remains the safest independent recovery path.

Enable LINCE on a standalone firewall

Enable it in the CLI with:

system certification lince enable

After confirmation, the SSH service restarts. The active SSH session is therefore expected to end and this alone isn’t an error. Don’t immediately restart the firewall or send more commands through a second parallel SSH session.

Once the service is ready again, establish a fresh login. Don’t test only the username and password. When public-key authentication is used, the exact intended key must work. Then test WebAdmin, API automation, and every system that uses SSH for backup or operation.

A successful new SSH session confirms the management path but not all effects of the mode. Also run a production-like VPN test and a TLS syslog test. For syslog transport in LINCE mode, SFOS accepts either the Common Name or Subject Alternative Name for name matching; the complete configuration is covered in Connect syslog and SIEM.

Check Status and Turn LINCE Off Again

Read the current state before making any mode decision:

system certification lince show

Device Console also provides the command to turn the mode off:

system certification lince disable

This is not an unplanned emergency rollback. A change in either direction is blocked while HA is active. The detailed LINCE help also does not describe the immediate turn-off sequence, particularly no guaranteed interruption-free SSH operation. Therefore, disable also requires independent administrative access, a current backup, compatible SSH clients and policies, and a maintenance window. Afterwards, establish a new session, run show, test SSH, API, VPN, and TLS syslog, and check the system logs. The confirmed previous state remains the rollback plan.

HA requires the correct sequence

For a new HA cluster, first enable LINCE on both firewalls while they are still standalone. Build HA only after both devices use the same mode and are separately reachable.

Since SFOS 21.5 MR1, LINCE can’t be turned on or off after the cluster is established. An ad-hoc change on one node of an existing HA cluster is therefore not a valid test. Plan the cluster change, maintenance window, and recovery first.

The complete HA procedure explains roles, licensing, synchronization, and validation. LINCE follows a different model from FIPS: With LINCE, both standalone devices are aligned before HA; with FIPS, the prepared primary later enables the mode on the auxiliary.

Understand backup, restore, and firmware behavior

On a compatible firewall, a restore adopts the LINCE status of the backup. If the backup contains LINCE, the mode is enabled; if it doesn’t, the mode remains disabled. The mode isn’t available on a version that doesn’t support LINCE.

HA adds a strict condition: The backup and both target devices must have the same LINCE status. If they don’t, the restore is rejected. Record the status together with the SFOS build, model, HA role, backup password, and SSMK in the restore log.

Sophos Firewall backup and restore explains how to check compatibility and the Secure Storage Master Key. A backup is only a recovery path when the intended target device and its LINCE status actually allow the restore.

Sophos also documents a narrow firmware case: If LINCE is enabled after a migration or upgrade, the firewall can roll back to the previous version where LINCE was disabled, as long as its configuration remains available. This isn’t a general guarantee for every downgrade. The upgrade path, supported version, configuration compatibility, and certification scope still require separate checks.

Validate after activation

A sound validation combines technical operation with the formal objective:

Record the exact SFOS build and time.
Test fresh WebAdmin and SSH logins through the intended management paths.
Test public-key access with the production client and key.
Validate VPNs with real bidirectional application traffic.
Check TLS syslog connectivity, name validation, and new events.
For HA, validate both nodes separately before building the cluster.
Create a new backup and document restore compatibility.
Compare the certificate and evaluation scope with the deployed build.

The result should explicitly distinguish between mode enabled, services operational, and formal certification proven. These statements aren’t interchangeable.

Troubleshoot safely

SSH connection ends immediately after the command

This is expected because the SSH service restarts. Use the previously tested WebAdmin or console path to verify that the firewall is operating normally. Only then establish a new SSH connection.

Compare the client’s key exchange, encryption, MAC, and host key algorithm with the documented LINCE set. Don’t blindly replace the server key or all clients during the outage. If no common combination exists, return through the independent access path and correct the migration plan.

LINCE can’t be changed in the HA cluster

This is the documented product limit from SFOS 21.5 MR1 onward. Don’t try to separate the nodes with undocumented commands. Plan the backup, management access, downtime, and complete cluster rebuild first.

HA restore is rejected

Compare the LINCE status of the backup and both target devices. Also check the model, SFOS version, SSMK, and normal restore limits. Don’t bypass a mode mismatch with an ad-hoc firmware change or an unverified second backup.

An auditor requests proof of certification for SFOS 22

The enabled mode alone isn’t sufficient. Because the current Sophos page explicitly identifies only SFOS 20.0 MR1 and MR2 as certified, Sophos or the responsible compliance body must provide valid evidence for the specific target version. Until then, don’t claim formal LINCE certification for SFOS 22.

FAQ

Does enabling LINCE perform a factory reset?

Sophos documents a restart of the SSH service and disconnection of existing SSH sessions for the LINCE command, but no factory reset. The factory reset belongs to enabling FIPS mode and must not be transferred to LINCE.

Can LINCE be enabled later in an HA cluster?

No. Since SFOS 21.5 MR1, LINCE can’t be turned on or off while HA exists. Both devices must be brought to the same status as standalone firewalls before HA is built.

Is SFOS 22 officially LINCE-certified when LINCE mode is enabled?

That can’t be inferred from the mode. The current SFOS 22 help explicitly names only SFOS 20.0 MR1 and MR2 as certified. SFOS 22 requires separate evidence that matches the specific build and deployment scope.