Sophos UTM 9 is reaching end of life.
Your firewall needs a replacement now.

1. What's happening and why

Sophos announced the end-of-life for Sophos UTM 9 on SG-series hardware in 2023. The decision follows a strategic shift by Sophos toward their next-generation Firewall OS (SFOS) platform, which runs on the newer XGS-series hardware.

UTM 9 was an excellent product in its time. It combined stateful packet inspection, intrusion prevention, web filtering, email security, application control, and site-to-site VPN in a single appliance. But it was built on an architecture that predates cloud-native security concepts, and Sophos has invested their engineering resources in the SFOS platform instead.

What this means for organizations still running UTM 9:

• June 30, 2025 — last date to renew existing UTM licenses. If you missed this, your appliance may already have reduced functionality.
• June 30, 2026 — complete end-of-life. No software updates, no security patches, no support from Sophos. The SG hardware becomes officially unsupported.
• After June 30, 2026 — any vulnerability discovered in UTM 9 will not be patched. Your firewall, sitting at the perimeter of your network, becomes permanently exploitable.

The urgency here is real. Unlike a project management tool or a chat platform, your firewall processes every single packet entering and leaving your network. An exploited firewall means full network visibility for an attacker, not just data loss in one application.

2. End-of-life timeline

3. Why running UTM 9 past EOL is dangerous

Every network security professional knows this, but it bears stating clearly for anyone who needs to make the business case internally: running an unpatched firewall is categorically different from running any other unpatched software.

Perimeter exposure

Your firewall sits at the edge of your network, directly exposed to the public internet. It processes every connection attempt — from legitimate users, partners, and remote workers, and from automated scanners, botnet traffic, and targeted attacks. A vulnerability in the firewall code itself (not just the traffic it processes) means an attacker can exploit the appliance directly, bypassing all downstream security controls.

Sophos UTM vulnerabilities have been exploited before. CVE-2022-1040 (a critical auth bypass affecting Sophos Firewall) was actively exploited in the wild within days of disclosure. Once UTM 9 is past EOL, similar vulnerabilities will not receive patches — and attackers know exactly which firmware versions are unpatched.

Compliance impact

If your organization operates under any of the following frameworks, running unsupported software at the network perimeter is a direct violation:

• PCI DSS: Requirement 6.3 — all system components must be protected from known vulnerabilities by installing applicable security patches. Running past EOL fails this requirement.
• ISO 27001: Control A.12.6.1 requires management of technical vulnerabilities. Running known-unsupported software is a reportable finding.
• SOC 2: Common Criteria CC7.1 — monitoring for vulnerabilities. Auditors will flag unsupported perimeter devices.
• HIPAA: Security Rule §164.312(a)(2)(iv) — technical safeguards. Unpatched network security controls are a finding.
• Cyber insurance: Many cyber insurance policies now explicitly exclude coverage for incidents involving software running past its vendor-supported EOL date. Check your policy now.

Hardware failure risk

SG-series hardware is aging. Sophos will not help you RMA a failed unit after June 30, 2026. If your SG appliance suffers a hardware failure after EOL — failed power supply, disk failure, corrupted firmware — you are on your own. Sourcing replacement hardware or restoring a backup onto new hardware becomes your problem with no vendor assistance.

4. How to export your UTM 9 configuration

Before you decommission your UTM 9 appliance, capture everything. This is your reference for rebuilding on the new platform — and your safety net if something goes wrong mid-migration.

Full system backup (recommended first step)

1. Log in to the UTM 9 web admin interface (WebAdmin)
2. Navigate to Management → Backup/Restore
3. Click Download Backup — this downloads a full encrypted backup of your UTM 9 configuration
4. Store this backup in at least two locations: local server + off-site (cloud storage or tape)
5. Verify the backup is complete and not corrupted — check the file size is reasonable for your config

The backup includes: firewall rules, network objects, NAT policies, routing table, VPN configurations, web filtering profiles, email gateway settings, authentication settings, DHCP leases, and certificates.

Document your firewall rule inventory

Even with a backup, you should create a human-readable inventory of your firewall rules. This is your migration reference and will also surface technical debt (rules for decommissioned systems, overly permissive rules, orphaned objects):

1. Navigate to Network Protection → Firewall — review and export the rule list (screenshot or use the API)
2. Navigate to Network Protection → NAT — document all DNAT and SNAT rules
3. Navigate to Definitions & Users → Network Definitions — list all custom network objects
4. Navigate to Definitions & Users → Service Definitions — list all custom service objects
5. For each firewall rule, note: source zone, destination zone, service, action, schedule, logging setting, and any linked IPS/application control policy

Export VPN configurations

VPN is often the most complex part of a UTM 9 migration. Export and document everything:

1. Site-to-site IPsec: Navigate to Site-to-site VPN → IPsec — document each tunnel: remote gateway IP, pre-shared key, IKE/ESP settings, phase 1 and phase 2 proposals, local and remote networks
2. SSL VPN (remote access): Navigate to Remote Access → SSL — export the server configuration, user group assignments, and the CA certificate
3. RED tunnels: Navigate to RED Management — document each RED device serial number, tunnel configuration, and assigned network
4. PPTP/L2TP (if in use): Document user assignments and network settings
5. Export your CA and any site certificates from Site-to-site VPN → Certificate Management

Export web and email filtering settings

1. Web Filtering: Navigate to Web Protection → Web Filtering Profiles — document each profile's categories, exceptions, and HTTPS inspection settings
2. Application Control: Navigate to Network Protection → Application Control — list all application control rules and policies
3. Email Protection: Navigate to Email Protection → SMTP — document routing, antispam thresholds, quarantine settings, and allowed/blocked senders
4. Exceptions and whitelists: These are almost always the hardest thing to recreate — export them all

Network topology documentation

Before starting migration, document your current network topology:

• All physical interfaces and their assignments (LAN, WAN, DMZ, additional zones)
• VLANs and trunk ports
• Routing table (static routes and any dynamic routing protocols in use)
• DHCP scopes and reservations
• DNS forwarder settings
• HA configuration (if running two appliances in active-passive)

5. Alternative firewall comparison

Five realistic migration targets for Sophos UTM 9, evaluated on feature parity, migration effort, licensing model, and fit for different organization sizes.

Detailed review: each alternative

Recommendation by use case

6. Migration checklist

A practical step-by-step plan for migrating from Sophos UTM 9. Adjust timeline based on your environment's complexity. Start immediately — June 30, 2026 is a firm deadline.

7. Frequently asked questions