Configure and check Sophos Firewall pattern updates

Under Backup & firmware > Pattern updates, you can monitor the Sophos Firewall’s ongoing pattern updates. On a normal online firewall, Auto update should be enabled. Then select the required Interval and check the list to ensure that the automatically installed signature, engine and client patterns show a current timestamp and the status Success.

Update pattern now starts an immediate retrieval of these patterns when required. It does not install APX and RED firmware: because these updates restart the devices, they require a deliberate click on Install and belong in a maintenance window.

What a pattern update updates

Patterns are replaceable data and software packages for individual components. Examples include antivirus, IPS and application signatures, engines, clients, and firmware for managed APX access points and RED devices. This allows new detections to be installed without replacing the complete SFOS firmware each time.

A pattern update is therefore not the same as an SFOS firmware update. SFOS firmware updates the firewall operating system and can include new functions or fundamental bug fixes. Patterns are updated independently and by component. Hotfixes also use a separate update path.

For an administrator, it is not enough to know that Auto update is enabled. What matters is whether the last retrieval actually succeeded and whether the expected components show a current version. Otherwise, enabled automation can easily conceal a persistent download or licensing error.

Configure automatic pattern updates

1. Open Backup & firmware > Pattern updates.
2. Enable Auto update.
3. Under Interval, select how often the firewall should check for new patterns.
4. Check Current version, Available version, Last successful update and Update status in the list.
5. If an immediate check is required, click Update pattern now and wait until the automatically installed patterns show their new state.

The interval only determines how often the firewall checks for an available package; it does not make Sophos release new patterns sooner. Unless there is a specific operational requirement, the offered default setting can remain in place. A shorter interval therefore does not automatically provide faster protection.

Sophos provides automatic updating by default. A quick look at the overview is still worthwhile: a suddenly old timestamp can indicate a download, licensing or component error even if the firewall continues to process internet traffic.

The statuses mean:

• Ready to install: The package has been made available and is waiting for manual installation. For APX and RED firmware, this is the normal safe state before the maintenance window.
• Downloading: The firewall is currently downloading the pattern. Do not restart it or trigger a second update path in parallel.
• Success: The last update process completed successfully.
• Failed: The retrieval or installation failed. Check the timestamp, affected component and appropriate logs.

A single Success for one component does not automatically confirm every other row. Security-relevant patterns and APX and RED firmware must therefore be reviewed separately.

Install APX and RED firmware deliberately

Firmware for APX access points and RED devices managed by the firewall also appears as a pattern. The firewall downloads it but does not install it automatically. This is intentional: the APX or RED restarts after installation, active connections are interrupted, and reconnect only after the update.

Before clicking Install, check the affected APX and RED devices, their locations and a suitable maintenance window. At a remote RED site, also establish how long a short connection interruption can be tolerated and who can be reached on site if the device does not return.

For Wireless, this process applies only to APX models that are actually managed by the firewall. AP6 access points are not managed through SFOS or its pattern updates; their firmware is maintained outside the firewall through Sophos Central or the local AP6 interface. The model distinction and current recommendation are explained in Set up a wireless network on Sophos Firewall. For RED devices, Set up Sophos RED covers the complete site configuration.

Why IPS signatures may be missing

Application signatures in pattern updates do not depend on a Network Protection licence or enabled IPS. On an online firewall, however, IPS signatures are updated only when both requirements are met:

• An active Network Protection subscription or trial licence is available.
• IPS is enabled under Protect > Intrusion prevention > IPS policies.

If either requirement is missing, the pattern update can appear successful even though only application signatures are being updated. This is not a contradiction but the documented licensing and operating behaviour. The licence status, enabled IPS and assigned rules must therefore be checked together. The complete setup is explained in Configure IPS Protection on Sophos Firewall.

Licensed air-gapped firewalls are an exception: IPS and application signatures are updated through the designated offline process even when IPS is disabled. This special operating mode is described separately in Air-gap licensing and pattern updates.

Narrow down failed pattern updates

If the status is Failed, do not immediately restart a service. First document the affected component, current and available versions, last successful time, and firmware build. Then work from the general update process towards the affected protection module.

1. Check whether the firewall has general internet access and can reach Sophos services.
2. Verify that date, time and NTP synchronisation and DNS resolution are plausible.
3. Trigger Update pattern now exactly once and observe the status until a result appears.
4. Save the appropriate logs before a restart or another repair attempt displaces older evidence.
5. Use the specific error to determine whether the licence, connection, pattern file, firmware level or an individual service is affected.

On older SFOS 22 builds, comparing versions is particularly useful: in SFOS 22.0 MR2 Build 546, Sophos fixed an error that caused SAVI and AVIRA pattern updates to fail and stopped the antivirus service (NC-180066). It also fixed an issue in which the eBPF service stopped responding after a pattern update (NC-177769). If the symptoms match, a planned firmware update is a more sensible next step than repeated service restarts. However, these two IDs do not explain every pattern error.

The logs can be downloaded under Diagnostics > Tools > Troubleshooting logs. For a quick live check, after logging in to Sophos Firewall over SSH, open 5. Device Management > 3. Advanced Shell. These read-only examples each display the last 100 lines:

General system update process:

tail -n 100 /log/u2d.log

Antivirus patterns:

tail -n 100 /log/up2date_av.log

IPS and application signatures:

tail -n 100 /log/sig_upgrade.log

SFOS does not guarantee a single success message that looks identical in every build. Compare timestamps and error messages with the affected row in the pattern overview. If only an updated device fails to reconnect, awed.log is appropriate for a managed APX and red.log for a RED. The mapping of additional files and safe log handling are covered in Sophos Firewall services and logs.

If a protection service remains stopped after a failed update, Restart Sophos Firewall services safely explains the next controlled step. Repeatedly clicking Restart without saving the logs makes root-cause analysis more difficult.

Install a pattern file manually under SFOS 22

A manual upload is useful when an isolated environment has no automated air-gap process or Sophos Support explicitly requests a manual update test. For a normally reachable online firewall, automatic updating remains the preferred permanent operating mode.

For SFOS 22.0 and later, Sophos provides a single .tar file containing the patterns for all modules:

Download the pattern file for SFOS 22

Then:

1. Open Backup & firmware > Pattern updates > Manual pattern update.
2. Click Choose File and select the unchanged .tar file.
3. Upload it with Upload and confirm with OK.
4. In the pattern list, check which components were updated successfully.

The file does not apply universally to older SFOS versions. The firewall version and intended file must therefore match before a manual upload. In an HA cluster, run the update on the current Primary; the patterns are automatically synchronised to the Auxiliary. Both nodes must then show a healthy HA state.

FAQ