Sophos XG / SG Firewalls Maintenance
side by side.
TechCare TPM vs. Sophos Hardware-Garantieverlängerung (an Subscription gekoppelt). Cost range, EOSL advantages, migration path and DACH compliance at a glance — for IT leadership and procurement.
Cost comparison
Example 40 XGS 2300 in HA pairs at 20 sites with NBD replacement: TechCare roughly 30–45 % below the hardware extension, for XG fleets without manufacturer option up to 70 % below a new purchase.
Which XG and SG models we service
- XG desktop · rev. 1–3
- XG 85 · XG 85w · XG 86 · XG 86w · XG 105 · XG 105w · XG 106 · XG 106w · XG 115 · XG 115w · XG 125 · XG 125w · XG 135 · XG 135w
- XG 1U / 2U rack
- XG 210 · XG 230 · XG 310 · XG 330 · XG 430 · XG 450 · XG 550 · XG 650 · XG 750
- SG desktop · UTM 9
- SG 105 · SG 105w · SG 115 · SG 115w · SG 125 · SG 125w · SG 135 · SG 135w
- SG 1U / 2U rack · UTM 9
- SG 210 · SG 230 · SG 310 · SG 330 · SG 430 · SG 450 · SG 550 · SG 650
- RED / SD-RED · remote Ethernet devices
- RED 10 · RED 15 · RED 15w · RED 20 · RED 50 · RED 60 · SD-RED 20 · SD-RED 60
Manufacturer support status of major generations
| Generation | Released | End of vendor support | TechCare TPM |
|---|---|---|---|
| SG-Serie (UTM 9) | 2014 | beendet | Recommended |
| XG-Serie Rev. 1 / 2 | 2015 | beendet | Recommended |
| XG-Serie Rev. 3 | 2018 | beendet | Recommended |
| RED 15 / 50 | 2013 | beendet | Recommended |
| SD-RED 20 / 60 | 2019 | aktiv | Supported |
Why TPM for XG and SG fleets
Sophos has ended hardware support for the XG series and the SG series; licences can partly still be renewed, but the manufacturer no longer supplies replacement units. Anyone who wants to keep the appliance — because rule set, integrations and staff are established — carries the outage risk alone.
We bridge this phase: replacement unit from our pool per SLA, power supplies and SSDs, configuration restore from backup and guidance for licence transfer, until hardware EOL. You gain time for a planned generation change to XGS — instead of having it forced by a hardware defect.
OEM vs. TechCare — where the switch pays off
The full OEM-vs-TPM matrix (spare parts, SLA tiers, language, sub-outsourcing, compliance docs, reporting) is the same for every Sophos line — see the Sophos battle card.
Stays with Sophos
- Firewall licence incl. transfer in Sophos Central, signatures, Xstream Protection
- Hardware base licence (ends with Sophos hardware EOL)
- Firmware releases (SFOS, UTM 9)
Moves to TechCare
- Appliance replacement or spare part per SLA (Parts Only, NBD, 24×7×4)
- Cold spares for HA pairs and critical sites
- Configuration restore from backup, guidance for licence transfer
- One contract for Sophos plus all other manufacturers
DACH compliance by design.
BAIT/MaRisk documentation package, DORA Art. 28 contract template, ISO 27001 and GDPR-compliant media handling apply identically to every Sophos line — details on the Sophos battle card.
Migration path from first contact to hand-over.
Same four steps for every Sophos line: inventory → fixed-price quote in 48 h → contract (BAIT/MaRisk/DORA hooks) → hand-over with spare-parts provisioning. Details on the Sophos battle card.
FAQ on XG / SG maintenance
- Is it worthwhile when the series is discontinued at the manufacturer?
- Yes, until the hardware end-of-life set by Sophos. Until then the base licence applies, and the contract costs a fraction of a new purchase. On the EOL date the base licence on the hardware ends — the appliance no longer filters, so we plan the move to XGS with you beforehand.
- What happens to the Sophos licence when a unit is replaced — and what applies to XG and SG?
- Sophos allows licence transfer to an identical or equivalent model in your own Sophos Central account; the old unit is deregistered and then works only as a router. We deliver the replacement unit and guide the step; you or your Sophos partner perform the transfer. For XG and SG, additionally: the Sophos base licence ends with the hardware end-of-life in the Sophos retirement calendar, after which the appliance no longer filters. We therefore keep XG/SG under SLA until that date and plan the change with you. Our core business is hardware break-fix — licence, signatures and firmware stay with Sophos.
- Where do the replacement units come from?
- From our tested pool and via our sourcing partners. Every replacement unit is tested before delivery and brought to the matching firmware level.
- How long will you keep XG and SG under SLA?
- Until the hardware EOL date of each model in the Sophos retirement calendar, as long as replacement units can be sourced. After that the Sophos base licence on the hardware ends; operation as a firewall is then no longer possible.
- Which SLA tiers do you offer?
- Parts Only, 5×9 NBD and 24×7×4 — selectable per device and site. For 4-hour commitments we keep cold spares at the site.
- How quickly do we get a quote?
- 48 hours after receipt of your inventory with model, serial number and site.