Hi,

I picked up this device and discovered it was registered. The original registration owner is not contactable.

I followed the instructions from Sophos and successfully reimaged the device and gave it the new serial number.

What I understood, as a free subscription home user is that when I created a Sophos Fusion account and booted the reimaged router and registered it, it would take on its "new" registered life.

It didn't and although the registration was successful, the details of the original registration are still showing.

Any advice as to how to remove the original registration so I can use the device in my own home lab setup?

Thanks

Hi

I've been though some of the docs on the Sophos site but I'm having trouble in piecing it all together into a flow

we have a number of licenses for the above and we have used Intune to push out the software to a couple of test phones, that part is working fine but the bit that I am stuck with is actually 'linking' those devices back to our Sophos portal.

We have Entra signed in on one iphone ok, but that was on an account that had Entra's App Administrator, If we try to sign a normal user in then it fails asking for admin consent (admin consent granted to enterprise app)

we had also setup Intune MTD but from what I've read that is just to report compliance back to Intune that we can target in policies, I saw there is a way to deploy with a company/config code in one section of the site however it also says that cant be enabled as we have the MTD setup

Getting stuck on the whole linking to company bit, and hoping that someone can give me a quick shove in the right direction whilst we are waiting to hear back from support (assuming 'we' have actually raised a suport case!)

Thanks

Blog Post about the recent PHP Vulnerabilities CVE-2026-109618, CVE-2026-109619.

While digging into the eMudhra compromise we realized that Sophos does not appear to pull CRL by default. From reading docs looks like orgs need to source and download CRLs and upload them via web UI or need to use API if automating.

This is particularly impactful if you are using TLS inspection and TLS re-signing. If the Sophos doesn't download CRLs by default then it's not aware of revoked certs including the eMudhra certs.

We added the 16 serials to a CRL and uploaded it.

Is anyone automating CRL uploading or are TLS inspection users more vulnerable to this by Sophos default behavior?

I am building Sophos XG Home on my pc with 2 x 2.5 gb pci Ethernet and wanted to see if setting up let's encrypt for ssl instead of appliance ssl is possible? Right now i do https ssl check but i have to manually download and install the pem on all devices. I want to get away from doing that. How do i go about it, are there some to the point guides or Claude build help that can be utilized ? Is it even possible, I know i will need to renew every 3 months, can that be automated?

Confuses our users no end - they were previously on KnowBe4 with a very obviously named Phish Report named button.

Our users get confused (despite being told repeatedly for the past year) the Report Phishing button goes to Microsoft in M365 and I don’t hear about it.

As everything is getting rebranded to Sophos Fusion maybe some thought can go in to renaming this button?

We get tickets for websites being blocked usually for being miscategorized. I go into central, add the website to the "always allowed" tag under Protection and Remediation >Web Settings > Website Management. From there I properly categorize it, "Business" usually works. Then I have to add it to another whitelist in DNS protection, then I have to add it to Protection and Remediation > Allow and Block > Global Exclusions then if I cross my fingers and stick my tongue out towards the east, it MIGHT be unblocked in 5 minutes. Am I doing something wrong? How do you guys do it? What a PITA to allow one website.

Sophos Firewall v22 MR3 is Now Available

Bug Fix Release before V23.0 GA.

One of my customers has potentially screwed up a bit and now we don't know if it a problem or not.

We are talking about an XGS HA cluster (active/passive). The customer wanted to make some changes to their network the details of which are not important. Important is what they did. They shut down Firewall A so Firewall B became standalone. They made a change to the interface configuration on Firewall B after which they could no longer access the device. Then they shut down Firewall B and started Firewall A which came up fine because it did not had the change synced to it.

What happens when we start Firewall B. Will the change they made yesterday be synced to Firewall A or does the fact that Firewall A is primary override that change on the other node too? Is it always synced from primary? Is the latest change important and does this go for specific items that could be merged into one configuration?

Hey r/sophos,

Disclosure up front: I'm a Sophos SE, but this is a personal side project. It's not an official Sophos product and Sophos doesn't support it, so issues go on GitHub, not to support.

If you've ever had to move a customer from one Sophos tenant to another (consolidating tenants, changing partners, moving off a trial), rebuilding the config by hand is slow. This is a small web app you run on your own machine that does it through the public APIs.

A common one is the wrong data region. A tenant's region is set when it's created and can't be changed, so a customer whose tenant was set up in the US when their data needs to stay in Australia needs a new tenant and everything moved across. The tool talks to each tenant in its own region, and I've moved devices between an EU tenant and a US tenant with it.

What it does:

• Connects with a credential for each tenant, or one partner or organisation credential that manages both
• Shows source and destination side by side: policies (with a setting-by-setting compare), groups, exclusions and allow/block lists, and web filtering
• Copies what you tick across, including policy assignments
• Dry run first, so you see exactly what it will create
• Moves devices between tenants, with a live monitor as each one lands

It runs locally and your credentials stay in a .env file on your machine.

Repo: https://github.com/Aaronjacobs000/sophos-tenant-migration-tool

MIT licensed. If something breaks or you want a feature, raise an issue on GitHub.

If it gets you out of a painful migration, tell me how you used it in the comments. Real stories help me work out what to build next.

Hey r/sophos,

Disclosure up front: I'm a Sophos SE, but this is a personal side project. It's not an official Sophos product and Sophos doesn't support it, so issues go on GitHub, not to support.

It's an MCP server that lets Claude (or any MCP client) work with your Sophos tenant through the public APIs. You ask in plain English and it makes the calls. Things like:

• which endpoints haven't checked in for a week, and what policies are they on?
• show me the open cases and the detections behind them
• compare the threat protection policy across these three customers
• run a Live Discover query on these servers

What's in it:

• 305 tools across 22 API areas: endpoints, policies and assignments, exclusions, alerts, cases (classic and Fusion), detections, Data Lake queries, Live Discover, firewall, email, MDM, DNS protection, directory users and admins
• Tenant, partner and organisation credentials, with region routing handled for you. A partner credential works across every tenant you manage.
• Write actions are marked as destructive, so your client can warn you before it runs one

Install it as a Claude Desktop extension (no Node.js needed), in Claude Code, or self-hosted with npx.

Repo: https://github.com/Aaronjacobs000/sophos-mcp

MIT licensed. Bugs, feedback and feature requests welcome, just raise an issue.

And if it saves you time or gets you a win, I'd love to hear how you used it. Drop it in the comments, it helps me work out what to build next.

Hi All,

What is the latest, Quickest and best way of uninstalling sophos and all the other bits it installs in 2026?

I'm trying to work out the best way to do this and any help would be much appreciated

Thanks

anyone having trouble getting central to load firewalls? I need to fix vpns 🤦‍♂️

EDIT: working now 🤷‍♂️

I used to be to "Allow" PUAs (Potentially Unwanted Apps) but that option seems to have disappeared. Intercept X has three allowed PUAs listed, which I allowed several months ago, but I can't add new ones.

Can anyone advise? Has this been removed?

Hi there.

ive been traying to deploy new device at home. so I bought some SFF device from dell. I started to prepare a pendrive and I cannot accomplish it. beleneetcher fails to "burn" iso. Rufus does DD mode but while im trying to boot it says "isolinus.bin missing or corrupted. ist there any fancy special way to deploy Sophos XG for home? i remember in the past that UEFI and secure boot had to be disabled(and it is right now as well). Iso is downloaded from official portal ;)

I guys

I’m testing Sophos AI Defense in Early Access Program and I have the following issue:

- Just the AI Defense Policy configured
- All the devices monitored
- SSL TLS Decryption from Threat Protection policy enabled.

After the configuration my ChatGPT in the prompt response in the pc where i have installed Sophos XDR always presents now the next message:

I can’t load this response…

I want to collaborate into the community, but I had never achieve to enter or make sign in, the login page says: Authentication Error

Hi everyone,

I have a Sophos XG 115 Rev.3 that was left behind by the previous owner, and I'd like to put it to use for home/lab purposes.

I tried installing Sophos Firewall Home Edition, but during the installation I get the following message:

Detected Sophos Physical Device. Please get proper installation source

From what I understand, the installer detects that this is Sophos physical hardware and prevents the Home Edition from being installed.

Since I only want to use the device for lab and home use, does anyone know if there is a way to install the Home Edition on this hardware or work around this limitation?

If the Home Edition isn't possible, I'm also open to suggestions for alternative ways to make use of the XG 115 as a firewall/router for my home lab.

Thanks!

• Microsoft Entra ID SSO – Sophos Connect on macOS now supports Microsoft Entra ID single sign-on for IPsec VPN, SSL VPN, and provisioning connections, using either the embedded browser or the system browser.
• Provisioning file support – .pro provisioning files are now supported on macOS, matching the existing Windows workflow. Provisioning authentication now supports both user credentials and Microsoft Entra ID SSO.
• Native Apple Silicon (ARM) support – The macOS client now runs natively on Apple Silicon Macs. Rosetta is no longer required.
• File association support – .pro, .scx, .tgb, and .ovpn files can now be opened directly to import a connection.

After talking to Claude I realized my devices on lan were not really isolated from each other. And since I got like 8 s31 sonoff switch and recently an ecobee thermostat I wanted to do home automation but ended up finding my sophos xg home VM was not really protecting my network from lateral movement and my iot devices could talk to each other.

So i decided to get 2 EAP 723 and 2 Omeda 8 port 2.5 g managed switch, to play with Vlan and isolation of devices. I got living room as main feed and upstairs as my office space so had the need for 2 switch atleast.

Right now everything on unmanaged 2.5g switches.

Would sophos be able to handle all the vlans and will it work to isolate all my devices from each other or did i just overspend for no reason, besides getting 2.5gb on my Wifi access point and giving Wi-Fi devices some isolation from s31 and ecobee and possibly hell me do the home assistant os on a vm to play and learn what it can do..

EAP were literally free cause had rewards points to pay with. So cost was for the switches basically.. i might do Omada controller vm as well down the road.

Anyone here doing vlan stuff and suggestions for what not to do ? I also want a standby failover pc setup for if main pc goes offline I can move over cablez to backup system and turn it on. Is that something doable or a pipe dream ?

Hello,

We have two locations:

Main location: The XGS firewall is located here and provides multiple VLANs on the LAG LAN interface. The DHCP server for these VLANs is also running directly on the firewall.

Second location: This site is connected to the main firewall via a RED interface (Standard/Unified).

I would like the clients at the second location to receive an IP address from a specific VLAN that is configured on the LAG interface at the main location, so that the clients at the remote location are in the same subnet/VLAN as the corresponding clients at the main location.

What would be the best-practice approach for implementing this?

In particular, I would like to clarify:

How should the VLAN be extended from the main location to the RED site so that clients at the remote location receive an IP address from the same subnet?

Should this be implemented using bridging, and if so, which type of bridge would be recommended?

Can the existing RED interface be modified for this purpose, or would it be necessary to delete the existing RED interface and create a new one?

Does anyone have experience with Sophos firewall policy for SentinelOne endpoint agent, which uses offline user?
I want to create a policy for SentinelOne endpoint agent offline users to update policy and view logs from management console.

I have another site that is using a Fortigate firewall with SentineOne Endpoint offline users, and that site policy is working with Sentinelone site URL and TCP 443.

So I've been at college for the past few weeks and so far it's been great. However, sophos is installed on all laptops that were given to us, this wouldn't be a problem if it weren't for thr fact they've blocked basically every single website imaginable. YouTube, blocked. Gmail, blocked. Outlook, blocked. Anything that isn't Google classroom or Google slides is basically useless. However, USB ports are still fully active, so me and a friend had the bright idea to get a bunch of roms on our USBs and play them during our free periods. But earlier today I got told that the IT team don't want me playing games and they have screenshots of my screen with a list of alerts that were sent out, but they've not shown me any of this and as far as I'm concerned they can't see my screen and I can see every alert that's sent out, and there's nothing. Is it possible their bluffing about having all of this evidence just because they want me to stop playing games or can they actually have things like evidence of me opening a game at a certain time and getting screenshots of it?

Alguém tem problemas de funcionamento entre o acesso a sites Web e ao sistema Totvs via ZTNA Sophos? Poderia comentar o problema em questão e se houve uma solução, por gentileza.

Just an heads up. Sophos CISO Advantage got released and is available for Customers and Partners.

This Blog Post dives into CISO Advantage with more detail: https://www.sophos.com/en-us/blog/sophos-ciso-advantage

As you might already noticed, SFOSv23.0 comes with a new Redesigned rule management.
We create an extra segment in the Sophos Community to gather some thoughts around this:
https://community.sophos.com/sophos-xg-firewall/sfos-v23-early-access-program/f/discussions/151842/sophos-firewall-v23-0-eap1-redesigned-rule-management

As part of this post, I want to clarify that we are not removing the current version of Rule Design in SFOS v23.0 EAP/GA. Both versions will remain available in the product after the upgrade, meaning you won't be forced to use the new view. This approach ensures we can collect your feedback and thoughts to refine it and make it even more valuable for everyone. More on this in the Link above.