What is the difference between SG and XG?
The Sophos SG Series appliances with UTM 9 firmware is our leading and award-winning Unified Threat Management (UTM) platform. Sophos UTM has a long and successful history that extends back several years. We will continue to develop and support this platform. You can learn more about Sophos UTM 9 and the SG Series and what makes it so great here.
Sophos XG Firewall, is our new firewall platform, that combines some of the great technology from UTM 9 with a variety of new technology including support for the new Sophos Security Heartbeat™, a new user interface, improved user-based policies and reporting, and much more. It comes pre-installed on XG Series appliances but you can also upgrade your SG Series appliances (more on that below).
You can learn more about Sophos XG Firewall here.
What’s the difference between the SG Series and XG Series hardware appliances?
They are identical except that SG Series appliances come pre-installed with UTM 9 firmware while XG Series appliances come pre-installed with XG Firewall firmware.
Can I migrate from SG UTM to the new XG Firewall?
Yes. As a Sophos SG UTM customer with a valid license, you are entitled to migrate to XG Firewall when the timing is right for you. We strongly urge customers to be patient and wait for the automated migration tools for the best migration experience.
As an existing SG UTM customer wishing to upgrade, what should I do?
We suggest all SG UTM customers spend some time familiarizing themselves with the new XG Firewall using the free trial option while patiently awaiting the migration tools to make the transition as seamless as possible.
Do I have to migrate from SG UTM to XG Firewall?
No. While we are confident that most Sophos SG UTM customers will want to take advantage of many of the great new features and benefits of XG Firewall over time, there is certainly no rush, and you don’t have to migrate if you don’t want to.
Will you continue to develop and support UTM 9?
Yes. You are probably already enjoying the great new features of UTM Elevated 9.4 and the Sophos UTM 9 platform will see continued development and support with a couple of new releases already in the planning stages.
Will the new XG Firewall firmware run on my existing hardware or virtual environment?
Sophos XG Firewall runs perfectly on all Sophos SG Series hardware appliances, as well as the same Intel compatible hardware and the same virtual environments as UTM 9. XG Firewall is not currently compatible with Amazon Web Services, but we plan to add support for AWS and Azure cloud deployments soon.
Customers with UTM Series or ASG Series hardware (prior to the SG Series) interested in migrating to XG Firewall should talk to their Sophos Partner about doing a hardware refresh to one of the XG Series that come pre-installed with XG Firewall.
When can I migrate from SG UTM to XG Firewall?
We strongly recommend that customers wait until the migration tools are available for a smooth migration. We recommend working with your preferred Sophos Partner to plan your migration when the time is right.
Is there a license fee associated with migrating?
No. Sophos is pleased to switch your license from SG UTM to XG Firewall at no extra charge. Your license will be changed over automatically when you choose to migrate.
What are the various migration options and timelines?
In order to make migration as smooth as possible, we are developing a series of migration tools that will simplify and automate much of the migration process. Keep and eye on this site for migration news, tools and help, or contact your Sophos Partner.
Here are the migration options and timelines:
Manual Migration: While we strongly encourage existing customers to wait until the automated migration tools are available, early adopters who wish to migrate to XG Firewall sooner can do a manual migration. There will be no migration tools available during this phase so you will be setting up and configuring your XG Firewall from a fresh install.
Automated Migration: This is in planning and we anticipate being able to offer beta migration tools in early 2017 to enable automated migration. We’ll update this site with the latest news on the availability of automated migration tools.
Are there SG UTM features I need that are not in XG Firewall?
There are currently a few feature gaps you should be aware of but some of these will be addressed in the upcoming release of XG Firewall v16 (noted below).
Here are the most significant initial feature gaps today:
- Multi-node clustering of three or more appliances is not supported initially
(two appliance clustering for Active-Active or Active-Passive is supported) - Clustering of “w” (integrated wireless) models is not supported initially
- Site-to-Site RED Tunnels are not supported initially (addressed in v16)
(RED devices are fully supported in XG Firewall, but RED tunnels between firewalls are not yet supported) - A couple of Advanced Web Protection features are not supported initially, including block page override using a password and category-based quota time policies (global quotas are supported)
- Two-Factor Authentication is not supported initially (addressed in v16)
- Sophos Mobile Control integration is not supported initially
- Sophos Endpoint Deployment and Management from within the UTM is not supported (customers are encouraged to switch to Sophos Cloud Endpoint to take advantage of Security Heartbeat™)
Can I centrally manage both SG UTM and XG Firewall with the new Sophos Firewall Manager?
Sophos UTM Manager (SUM) is the centralized management platform for SG UTM and is still supported for managing multiple UTM 9 devices. It cannot manage XG Firewall devices.
Sophos Firewall Manager (SFM) is the new centralized management platform for XG Firewall. It cannot manage UTM 9 devices, so if you plan to run a mix of UTM 9 and XG Firewall devices, you will need both SUM and SFM for centralized management.
Can I centrally report on both SG UTM and XG Firewall with the new Sophos iView?
Yes. The new version of Sophos iView provides consolidated report for UTM 9, XG Firewall, and CyberoamOS devices.
How can I take advantage of the new Security Heartbeat™?
Sophos Security Heartbeat™ requires both Sophos XG Firewall and Sophos Cloud Endpoint. Learn more about Security Heartbeat and SG UTM.
Where can I get further information?
Please contact your Sophos Partner should you have any further questions and follow the Sophos Blog for ongoing news and updates related to your Sophos products. You can sign up for the Sophos Blog newsletter by entering your email address in the sign-up field in the upper right corner of the blog homepage. You can also sign up for our RSS feed.
