Sophos hardware defect and prepare RMA properly

A hardware defect on a Sophos Firewall, SD-RED, switch or an access point is not just a warranty issue. For admins, it’s immediately about operation, replacement device, backup, license, serial number, support case, shipping and dismantling. The better these points are prepared, the faster an RMA can be processed properly. In the event of a technical defect, a calm process is important: first classify the error pattern and warranty, then collect the necessary information, open an RMA ticket and prepare the return. For the general process of a Sophos support case, Open Sophos support ticket: preparation and portal is also suitable.

First check: really hardware defect?

Before an RMA case, you should briefly check whether the problem really looks like hardware. Otherwise you waste time with a replacement, even though the power supply, cable, provider, firmware, configuration or environment are involved. Typical hardware notes:

Device no longer starts or gets stuck in the boot process.
Power supply LED or appliance LEDs do not show normal status.
Fans, power supply or temperature values are abnormal.
Ports fail permanently or do not show a link even though the cable and remote station have been checked.
SSD, memory or I/O errors occur repeatedly.
Device is physically damaged or unstable after power event.
SD-RED, switch or access point remains offline despite correct supply and network check. With Sophos firewalls, you should first check whether the WebAdmin interface, SSH, Log Viewer or an HA peer are still accessible. If only the WebAdmin interface hangs, the hardware is not automatically defective. In this case, Restart Sophos Firewall WebAdmin GUI may be a better first step.

Clarify warranty and support claims

Whether an exchange is possible depends on the device, purchase date, support contract, license status and product life cycle. These points should not be guessed but should be verified using documentation, SophosID, Sophos Central or partner information. The following are particularly important for Sophos Firewall:

Serial number of the affected appliance
Purchase or delivery date
current support or bundle status
Product life cycle, for example end of sale or end of life
RMA or support conditions of the specific region
for HA: serial numbers of both appliances and affected node The runtime basics are described in How long do I get a warranty on my Sophos hardware?. For firewalls, Understand Sophos Firewall Base License is also worthwhile because base license, support, security bundle and RMA are not the same.

⚠️ If a firewall fails productively, you should think about warranty clarification and operational restoration in parallel. An RMA process does not replace a current backup, emergency access and a clear recovery plan.

Prepare before RMA ticket

An RMA ticket should contain all the data Sophos needs to verify the device, claim, error pattern and shipping.

Device data

Prepare:

Product and model
Serial number
Hardware revision, if visible
Firmware version and build
License or account assignment
Location of the device
Date of purchase or delivery note, if available
Photos of label, serial number or damage if appropriate Depending on the device, the serial number can be found in WebAdmin, on the chassis, in Sophos Central, in license documents, or in previous support communications. For firewalls, Find Sophos Firewall serial number is the appropriate flow.

Error image

The error pattern should be specifically described:

What’s not working?
Since when does the error occur?
Is the error permanent or sporadic?
What was changed immediately before?
Which LEDs, ports or logs are noticeable?
Was a different power supply, cable, port or remote station tested?
Are there screenshots, photos or logs? For firewalls you shouldn’t just write defekt. A short diagnosis is better, for example: XGS 2100 does not boot after power event, Port3 no link with tested cable and switch port, or SSD errors and reporting database failures.

Operating status

What is relevant for the exchange is how badly the business is affected:

Is the firewall completely offline?
Is there an HA cluster?
Is the affected node primary or auxiliary?
Is there a replacement firewall or temporary workaround?
Are backups available and tested access data available?
Does the serial number or license need to be transferred to a replacement device? With HA you should clearly document the cluster status. Sophos Firewall HA Cluster variants and operation helps classify roles, failover and support risks.

Backup and restore before replacement

With a Sophos firewall, replacing the hardware is only part of the job. What is crucial is whether the configuration comes cleanly onto the replacement device. Check before shipping or removing:

current backup available
Backup password or Secure Storage Master Key known
Firmware version of the old and new device compatible
Serial number, license and account assignment documented
WAN credentials, certificates and local admin access available
Understood HA or Central registration
Maintenance window and fallback plan defined The practical procedure is in Backup and Restore on Sophos Firewall. If an appliance needs to be reinstalled, Reinstall Sophos Firewall OS: Reimage with USB stick is relevant. If the old device is still accessible, you should also save relevant logs before removing it. For support and analysis, Backup Sophos Firewall logs for support and analysis is the appropriate article.

Open RMA ticket

An RMA case is handled like a technical support ticket via Sophos Support. The subject line should clearly state that it is an RMA. Example:

RMA request - Sophos Firewall XGS 2100 - serial C123456789

The ticket should contain the following information:

Product:
Model:
Serial number:
Hardware revision:
Firmware version:
License/account:
Fault description:
Troubleshooting performed:
Impact:
HA cluster: yes/no
Dead on arrival: yes/no
Replacement shipping address:
Contact person:
Phone:
Email:
Special shipping instructions:
Attachments:

Sophos describes the process in the official RMA process. What is practically important is that the case must first be properly documented and checked by Sophos. This is followed by approval, dispatch of the replacement device, license or device regulations and, depending on the case, the return of the defective hardware.

RMA form as a template

To ensure quick processing, it helps to prepare the information in a structured manner. You can copy this template directly into the support case and fill it out:

===================================================
Technical Issue (describe the issue you are facing)
===================================================
Description/RMA Reason: [ ]
Fault Code: (leave it for Sophos Support to fill)
Sub Fault Code: (leave it for Sophos Support to fill)
======================================
Defective Product Details/License Details
======================================
Model/Product:
Revision:
Firmware version:
Serial # of faulty device:
License #: (was used in the faulty device)
Dead on arrival: Y/N
Is this part of a HA Cluster: Y/N
======================================
Shipping Info (All fields required):
======================================
Company:
TAX ID #: (EU countries, Brazil, and India)
Name:
Address:
City:
Zip/Postal code:
Country:
Phone:
Email:
Special Instructions:
======================================

If possible, the ticket should be written in English so that it can be processed internationally. Attachments such as photos, screenshots or log excerpts should only be uploaded if they do not contain unnecessary confidential data.

Plan expected duration realistically

In the best case scenario, an RMA exchange can be on site in about two days after approval. Realistically, you should expect three to four days. Depending on the region, availability, testing, shipping and queries, it may take longer.

⚠️ For productive operation, you should not rely on hardware replacement always occurring immediately. An RMA process is not a high availability concept. If you need to avoid short downtimes, you should plan for a Sophos Firewall HA Cluster, replacement hardware or a documented emergency plan.

Prepare replacement device

Once Sophos accepts the RMA case and ships a replacement device, recovery should be prepared. Don’t wait until the package arrives. Check:

What firmware version is expected on the replacement device?
Does the replacement device need to be updated or reinstalled before the restore?
Is the backup compatible with the target version?
Is the Secure Storage Master Key or backup password present?
Is there a maintenance window for replacement?
Does the device need to be remapped in Sophos Central or SophosID?
Are certificates, VPN connections or HA parameters checked after the restore? After the restore you should not only test whether the firewall is accessible. WAN, LAN, routing, DNS, DHCP, VPN, NAT, firewall rules, license status, central connection, logs and monitoring are important. Test firewall rules with Log Viewer, Policy Test and Packet Capture is suitable for follow-up control of rules and traffic.

Organize returns via DHL

If Sophos requests a return, a return label or return instructions are often included with the replacement device. The specific processing can vary depending on the country, service case and logistics partner. In many cases DHL is used. If a DHL return label is available, collection can be booked via DHL: ➜ Book DHL pickup When asking for a shipping label, you should only choose Nein if a valid return label already exists.

DHL form for collecting a return — If return labels are available, collection can be scheduled directly via DHL. The concrete surface may change.

The tracking number is on the return label. This number is required for collection and later tracking.

DHL return label with marked tracking number — The tracking number on the return label should be documented internally.

What should be returned

Before sending, you should carefully check what Sophos is demanding back. In many RMA cases, only the defective device itself should be returned, not accessories. What is crucial, however, is the specific RMA instruction. Check:

Device switched off and safely packed
only required components included
Only include power supplies, antennas, rackmount kits or cables if Sophos requests it
Return label correctly attached
Tracking number documented internally
Shipping deadline from the RMA email is observed
old configuration data or storage media are treated according to internal specifications If a return deadline is given, it should be taken seriously. In case of late or missing return, a replacement device may be charged depending on the RMA conditions.

Check after replacement

After replacing the hardware, the case should not be considered closed immediately. A short audit is required. Checklist:

Replacement device runs with expected firmware.
Backup was restored successfully.
License status and support status are correct.
WAN, LAN, VLANs and routing work.
Firewall rules and NAT hit as expected.
VPN and remote access connections have been tested.
HA status is correct if a cluster is used.
Central connection, reporting and monitoring work.
Logs show no new hardware or system errors.
RMA ticket includes return tracking and completion note. If anomalies remain, the existing ticket should be updated with concrete test results instead of opening a new case without context.

FAQ

Do you have to open a support ticket before an RMA?

Yes, in practice RMA processing takes place via a Sophos support case. Support checks the device, claim, error pattern and shipping information.

Should you check a defective power supply separately first?

Yes. If a device does not start, you should check the power supply, socket, power adapter, cable and, if necessary, a replacement power adapter before reporting the entire appliance as defective.

What is particularly important about a Sophos firewall?

For firewalls, backup, secure storage master key, serial number, license status, firmware version and recovery plan are particularly important. Without these points, a replacement device can be delivered, but productive recommissioning will be delayed.

Do accessories have to be returned?

Only if Sophos requests it in the RMA statement. Often only the defective device should be returned. Power supplies, antennas or cables should not be included unless specifically requested.

What happens if the defective device is not returned?

If Sophos requests a return and the return is not made on time, the replacement device may be charged based on the RMA terms. Therefore, tracking number, shipping date and pickup confirmation should be documented internally.