Skip to content
Avanet

Sophos Firewall FWDS501: Enlarge the Primary Disk before SFOS 22

Sophos Firewall

FWDS501 means that the Primary Disk or its partition layout is blocking an upgrade to SFOS 22. With older virtual Sophos Firewalls, enlarging only the virtual disk is not enough: after Hard disk 1 has been expanded, the resize script provided by Sophos must prepare the partitions.

⚠️ This procedure applies only to an affected standalone virtual firewall running SFOS 21.0 MR2 Build 349 or 21.0.2.x. Do not run the script on a hardware or software appliance, in an HA cluster, or under a different SFOS version. The script’s version check must not be changed or bypassed.

SFOS 21.0 has already reached End-of-Life. In this special case, the version serves only as the intermediate step documented by Sophos within a planned maintenance window. The firewall should then be updated directly to a supported version listed in the SFOS 22 upgrade check.

First check whether this procedure applies

A change is required only if FWDS501 appears in the Control Center, under Backup & Firmware > Firmware, or in an email alert. The warning blocks the upgrade, not current operations. In Sophos Central, affected firewalls are marked under Firewall Management by a download icon with a caution symbol. Without this warning, the partitioning does not need to be changed as a precaution.

The following procedure is suitable when all these conditions are met:

  • virtual Sophos Firewall, not a hardware or software appliance
  • standalone system without HA
  • exactly SFOS 21.0 MR2 Build 349 or 21.0.2.x
  • FWDS501 due to an undersized Primary Disk or partitions
  • Hard disk 1 can be clearly identified and expanded in the hypervisor
  • a current backup, Secure Storage Master Key, backup password, and serial number are available

If the firewall is still running an older compatible version, a supported upgrade path to SFOS 21.0 MR2 must first be planned and completed. The script is run only after that. If the firewall is already running SFOS 21.5 or 22, it must not be downgraded specifically for this script. For HA, a software appliance, or unclear virtual disk and snapshot chains, a coordinated procedure with Sophos Support or a fresh deployment followed by a backup restore is safer.

Why the 80 GB disk does not solve the problem

Some older virtual installations were deployed with two disks:

  • Hard disk 1 / Primary Disk: previously only 4 GB; contains the system partitions
  • Hard disk 2 / Report Disk: usually 80 GB; stores local reports and log data

For Hard disk 1, Sophos specifies 32 GB as the minimum and 64 GB as the recommendation for a new virtual deployment; Hard disk 2 remains the separate 80 GB Report Disk. A large Report Disk does not replace the Primary Disk. Enlarging only Hard disk 2 therefore does not create space for the root and content partitions on Hard disk 1.

A full Report or /var partition is a different issue. For that case, see Check storage space and reports on Sophos Firewall.

Prerequisites and recovery plan

This operation changes the virtual disk and the partition layout. The following items should therefore be prepared before the maintenance window:

  1. Store a fresh configuration backup outside the firewall. The matching Secure Storage Master Key, backup password, and serial number must also be available. The complete recovery procedure is described in Create or restore a Sophos Firewall backup.
  2. Ensure direct access to the hypervisor console. After a shutdown or in the event of a network problem, recovery must not depend on the normal VPN connection.
  3. SSH and access to the Advanced Shell must work. The login process is described in Connect to Sophos Firewall using SSH.
  4. Check snapshots and differential disk chains. If the platform prevents Hard disk 1 from being expanded, do not improvise or subsequently shrink a virtual disk.
  5. The maintenance window must cover two restarts, the partition check, and the subsequent SFOS 22 startup.

Enlarge the Primary Disk step by step

1. Check and document the initial state

Open 5. Device Management > 3. Advanced Shell in the SSH console and record both values:

df -kh | grep content
showfw -g | grep ROOT_SZ

For df, the Size column is relevant, not only the available space. /dev/content must have a total size of more than 7 GB. ROOT_SZ is returned in bytes and must be greater than 629145600. The value 629145600 is exactly 600 MiB and is not sufficient.

If at least one value is below the threshold and FWDS501 is displayed, this is exactly the state addressed by the following procedure. The output belongs in the change documentation. If both values are already sufficient but FWDS501 remains visible, the cause should be clarified with Sophos Support before making any change.

2. Shut down the firewall cleanly

Shut down the virtual firewall in 4. Device Console:

system shutdown

The virtual disk is changed only after the VM is completely powered off. A hard power-off through the hypervisor can damage file systems and the configuration.

3. Expand Hard disk 1 in the hypervisor

In the hypervisor, enlarge Hard disk 1, or the Primary Disk, to at least 32 GB. Hard disk 2 with the Report partition remains unchanged.

Menu names differ between VMware, Hyper-V, KVM, and other platforms. The important point is not the position in a particular interface, but the unambiguous identification of the existing Primary Disk. If anything is unclear, first check the VM documentation and disk mapping.

4. Start the VM and restart it once more

Start the VM and wait until SFOS is fully reachable. Then perform the additional restart specified by Sophos in 4. Device Console:

system restart

After this restart, wait again until WebAdmin and SSH are reachable.

⚠️ Copy the script to /tmp only now. Sophos clears /tmp during a restart. If the file were copied beforehand, it would no longer be available for the next step.

5. Copy the resize script

Save the official Sophos resize script on the administrator’s computer. The current download is named resize_partitions.sh. The following example copies the file and deliberately assigns it the consistent name resize_partition.sh on the firewall:

scp resize_partitions.sh admin@192.0.2.1:/tmp/resize_partition.sh

The command runs on the administrator’s computer, not in the firewall shell. 192.0.2.1 is a documentation address and must be replaced with the firewall’s reachable management IP address. If the browser gave the local file a different name, the first filename in the command must be adjusted as well.

6. Check and run the script

Back in 5. Device Management > 3. Advanced Shell, first check whether the file is present:

ls -l /tmp/resize_partition.sh

Then set the permission and run the script:

chmod 755 /tmp/resize_partition.sh
sh /tmp/resize_partition.sh

Only the following output is the success message documented by Sophos:

Success: New root offset stored and content partition relocated

If this message is missing, the script reports an incorrect version, or it stops with an error, the upgrade must not continue. Do not edit the script or modify the partitions manually with fdisk, parted, growpart, or similar tools.

7. Restart and verify the result

After the success message, restart in 4. Device Console:

system restart

Then repeat both read-only checks in the Advanced Shell:

df -kh | grep content
showfw -g | grep ROOT_SZ

/dev/content must now have a total size of more than 7 GB, and ROOT_SZ must still be greater than 629145600. The upgrade must not begin if the value is 629145600 or less. Both outputs should be recorded for the before-and-after comparison; manual partition commands are not a substitute for a correct result.

The firmware page synchronizes warnings approximately every 30 minutes. It can take up to one hour for FWDS501 to disappear. If the warning remains after that, Sophos Support is the next step.

Only then update to SFOS 22

The upgrade starts only after the script has completed successfully, /dev/content is larger than 7 GB, ROOT_SZ is greater than 629145600, and FWDS501 is no longer displayed. Then complete the full SFOS 22 upgrade check.

During the first SFOS 22 startup, the root and configuration partitions are adjusted further automatically. This process can add about five to six minutes to this first startup. Do not hard power off the VM during this phase, even if WebAdmin and ping do not yet respond.

When the script procedure does not apply

A new virtual firewall using a current installer is the cleaner approach if the version requirement is not met, the existing disk structure is unclear, or the script does not finish successfully:

  1. Secure the configuration backup, Secure Storage Master Key, backup password, and serial number.
  2. Deploy a new virtual firewall with at least 32 GB, preferably the recommended 64 GB, on the Primary Disk and 80 GB on the separate Report Disk.
  3. Activate the license and restore the backup.
  4. Test interfaces, routing, VPN, NAT, authentication, and central management.

Local reports are not restored with a configuration backup. Data already transferred to Central Firewall Reporting remains available there.

Software Appliance with FWDS501

On a Software Appliance installed on dedicated x86 hardware, FWDS501 can also indicate undersized partitions or an undersized disk. The virtual resize script must not be used in this case. Instead, check three values in the Advanced Shell:

fdisk -l
showfw -g | grep ROOT_SZ
df -kh | grep var

fdisk -l shows the total disk size. For df, use the Size column rather than the available space. For the existing installation, Sophos requires more than 32 GB for the disk, more than 629145600 bytes for the root partition, and more than 20 GB for /var.

  • If the total disk is 32 GB or smaller, reinstall SFOS. Allocate at least 64 GB to the new Software Appliance, activate the license, and then restore the previously saved backup.
  • If only the root partition is too small and the total disk is large enough, Sophos describes SFOS 21.0 MR2 as an intermediate step that automatically expands the root partition. Because SFOS 21.0 is End-of-Life, this path belongs in a planned maintenance window with an immediate upgrade to a supported SFOS 22 version. A firewall already running a newer version must not be downgraded for this purpose.
  • If /var is no larger than 20 GB, a separate partitioning procedure approved by Sophos or assistance from Sophos Support is required. The virtual script and manual Linux partitioning commands are not a solution for this case.

When to stop and contact Support

The procedure must be stopped if:

  • the script is to be run even though the firewall is not yet running exactly SFOS 21.0 MR2 Build 349 or 21.0.2.x
  • HA is active, or both nodes cannot be handled individually using an approved plan
  • Hard disk 1 and Hard disk 2 cannot be distinguished unambiguously
  • the backup, SSMK, backup password, serial number, or hypervisor console is unavailable
  • snapshots or the virtual disk chain prevent a safe expansion
  • the script does not return the exact success message
  • /dev/content does not have more than 7 GB after the restart
  • ROOT_SZ is 629145600 or less after the restart, or FWDS501 is still displayed after one hour

In these cases, a planned restore to a new VM is usually safer than attempting to repair the partitions manually.