Skip to content
Avanet

Sophos Switch

Sophos Switch provides the managed access layer for wired devices, access points, and firewall uplinks. These guides cover model selection and registration, ports, PoE, VLANs, Layer 3 and security features, monitoring, troubleshooting, firmware, backup, and controlled replacement.

Table of contents

Plan and onboard 2 Configure the network and access 10 Operate and monitor 7 Maintain and migrate 4

Sophos Switch from planning to migration

First select the model, PoE budget, uplinks, and management path, then commission the switch locally or in Sophos Fusion in a controlled manner. Next build ports, VLANs, routing, and access security. Fleet status, discovery, monitoring, diagnostics, and Active Threat Response follow during operation; firmware, backups, recovery, and replacement form the controlled maintenance and migration path.

Plan and onboard 2

Select the model, port and PoE requirements, and local or central management. Connect the switch, register it in Sophos Fusion, and verify reachability, licensing, and an initial controlled configuration synchronization.

Configure the network and access 10

Build ports, PoE, LAG/LACP, and STP; configure VLANs and Layer 3 routing; and add DHCP, multicast, QoS, 802.1X, port security, and ACL functions in a controlled manner. Planning the access layer for XGS HA also belongs here.

Operate and monitor 7

Manage fleets, sites, and stacks; inspect neighbors and address tables; use the CLI and REST API safely; and apply SNMP, diagnostics, and Live Discover. Operate Active Threat Response only with a verified data path and rollback path.

Maintain and migrate 4

Update firmware with pre-checks and a recovery path, create and restore backups, and replace, reset, migrate, or remove a switch from Sophos Fusion in a controlled sequence.

Back up and restore Sophos Switch

This runbook separates Fusion and local .cfg backups, covers scheduling, download, and restore, and prevents gaps caused by unsynchronized changes or …

Replace or reset a Sophos Switch

Operational runbook for replacement, factory reset, account migration, removal and RMA, with an external .cfg backup and conflict checks.

Product boundaries and responsibilities

Sophos Switch provides switching, PoE, VLAN, routing, and port-security functions. Sophos Fusion is the central management path; the local web interface, CLI, and REST API remain switch-side operating paths. The Sophos licensing overview explains which management model requires a subscription.

Clear boundaries apply to adjacent tasks:

  • Sophos Firewall and XGS HA provide firewall rules, zones, WAN, VPN, and the HA pair. The switch guide plans VLANs, uplinks, LAG, and STP for that design, but does not replace firewall or HA configuration.
  • Active Threat Response connects detection with switch-side isolation. Releasing a host and investigating the underlying detection remain controlled response tasks and must not be treated as ordinary port configuration.
  • Sophos Wireless manages access points and wireless networks. The switch provides their wired VLAN, uplink, and PoE foundation, but does not configure SSIDs or wireless policies.
  • Product lifecycle, warranty, and RMA are not firmware or backup functions. Verified dates are listed in the Sophos Product Lifecycle calendar; Sophos Hardware Warranty covers replacement through support and warranty.

This keeps each guide within the task the switch actually performs and routes licensing, firewall, wireless, and hardware-service work to the responsible product workflow.