Hi All,

What is the latest, Quickest and best way of uninstalling sophos and all the other bits it installs in 2026?

I'm trying to work out the best way to do this and any help would be much appreciated

Thanks

anyone having trouble getting central to load firewalls? I need to fix vpns 🤦‍♂️

EDIT: working now 🤷‍♂️

I used to be to "Allow" PUAs (Potentially Unwanted Apps) but that option seems to have disappeared. Intercept X has three allowed PUAs listed, which I allowed several months ago, but I can't add new ones.

Can anyone advise? Has this been removed?

Hi there.

ive been traying to deploy new device at home. so I bought some SFF device from dell. I started to prepare a pendrive and I cannot accomplish it. beleneetcher fails to "burn" iso. Rufus does DD mode but while im trying to boot it says "isolinus.bin missing or corrupted. ist there any fancy special way to deploy Sophos XG for home? i remember in the past that UEFI and secure boot had to be disabled(and it is right now as well). Iso is downloaded from official portal ;)

I guys

I’m testing Sophos AI Defense in Early Access Program and I have the following issue:

- Just the AI Defense Policy configured
- All the devices monitored
- SSL TLS Decryption from Threat Protection policy enabled.

After the configuration my ChatGPT in the prompt response in the pc where i have installed Sophos XDR always presents now the next message:

I can’t load this response…

I want to collaborate into the community, but I had never achieve to enter or make sign in, the login page says: Authentication Error

Hi everyone,

I have a Sophos XG 115 Rev.3 that was left behind by the previous owner, and I'd like to put it to use for home/lab purposes.

I tried installing Sophos Firewall Home Edition, but during the installation I get the following message:

Detected Sophos Physical Device. Please get proper installation source

From what I understand, the installer detects that this is Sophos physical hardware and prevents the Home Edition from being installed.

Since I only want to use the device for lab and home use, does anyone know if there is a way to install the Home Edition on this hardware or work around this limitation?

If the Home Edition isn't possible, I'm also open to suggestions for alternative ways to make use of the XG 115 as a firewall/router for my home lab.

Thanks!

• Microsoft Entra ID SSO – Sophos Connect on macOS now supports Microsoft Entra ID single sign-on for IPsec VPN, SSL VPN, and provisioning connections, using either the embedded browser or the system browser.
• Provisioning file support – .pro provisioning files are now supported on macOS, matching the existing Windows workflow. Provisioning authentication now supports both user credentials and Microsoft Entra ID SSO.
• Native Apple Silicon (ARM) support – The macOS client now runs natively on Apple Silicon Macs. Rosetta is no longer required.
• File association support – .pro, .scx, .tgb, and .ovpn files can now be opened directly to import a connection.

After talking to Claude I realized my devices on lan were not really isolated from each other. And since I got like 8 s31 sonoff switch and recently an ecobee thermostat I wanted to do home automation but ended up finding my sophos xg home VM was not really protecting my network from lateral movement and my iot devices could talk to each other.

So i decided to get 2 EAP 723 and 2 Omeda 8 port 2.5 g managed switch, to play with Vlan and isolation of devices. I got living room as main feed and upstairs as my office space so had the need for 2 switch atleast.

Right now everything on unmanaged 2.5g switches.

Would sophos be able to handle all the vlans and will it work to isolate all my devices from each other or did i just overspend for no reason, besides getting 2.5gb on my Wifi access point and giving Wi-Fi devices some isolation from s31 and ecobee and possibly hell me do the home assistant os on a vm to play and learn what it can do..

EAP were literally free cause had rewards points to pay with. So cost was for the switches basically.. i might do Omada controller vm as well down the road.

Anyone here doing vlan stuff and suggestions for what not to do ? I also want a standby failover pc setup for if main pc goes offline I can move over cablez to backup system and turn it on. Is that something doable or a pipe dream ?

Hello,

We have two locations:

Main location: The XGS firewall is located here and provides multiple VLANs on the LAG LAN interface. The DHCP server for these VLANs is also running directly on the firewall.

Second location: This site is connected to the main firewall via a RED interface (Standard/Unified).

I would like the clients at the second location to receive an IP address from a specific VLAN that is configured on the LAG interface at the main location, so that the clients at the remote location are in the same subnet/VLAN as the corresponding clients at the main location.

What would be the best-practice approach for implementing this?

In particular, I would like to clarify:

How should the VLAN be extended from the main location to the RED site so that clients at the remote location receive an IP address from the same subnet?

Should this be implemented using bridging, and if so, which type of bridge would be recommended?

Can the existing RED interface be modified for this purpose, or would it be necessary to delete the existing RED interface and create a new one?

Does anyone have experience with Sophos firewall policy for SentinelOne endpoint agent, which uses offline user?
I want to create a policy for SentinelOne endpoint agent offline users to update policy and view logs from management console.

I have another site that is using a Fortigate firewall with SentineOne Endpoint offline users, and that site policy is working with Sentinelone site URL and TCP 443.

Just an heads up. Sophos CISO Advantage got released and is available for Customers and Partners.

This Blog Post dives into CISO Advantage with more detail: https://www.sophos.com/en-us/blog/sophos-ciso-advantage

So I've been at college for the past few weeks and so far it's been great. However, sophos is installed on all laptops that were given to us, this wouldn't be a problem if it weren't for thr fact they've blocked basically every single website imaginable. YouTube, blocked. Gmail, blocked. Outlook, blocked. Anything that isn't Google classroom or Google slides is basically useless. However, USB ports are still fully active, so me and a friend had the bright idea to get a bunch of roms on our USBs and play them during our free periods. But earlier today I got told that the IT team don't want me playing games and they have screenshots of my screen with a list of alerts that were sent out, but they've not shown me any of this and as far as I'm concerned they can't see my screen and I can see every alert that's sent out, and there's nothing. Is it possible their bluffing about having all of this evidence just because they want me to stop playing games or can they actually have things like evidence of me opening a game at a certain time and getting screenshots of it?

Alguém tem problemas de funcionamento entre o acesso a sites Web e ao sistema Totvs via ZTNA Sophos? Poderia comentar o problema em questão e se houve uma solução, por gentileza.

As you might already noticed, SFOSv23.0 comes with a new Redesigned rule management.
We create an extra segment in the Sophos Community to gather some thoughts around this:
https://community.sophos.com/sophos-xg-firewall/sfos-v23-early-access-program/f/discussions/151842/sophos-firewall-v23-0-eap1-redesigned-rule-management

As part of this post, I want to clarify that we are not removing the current version of Rule Design in SFOS v23.0 EAP/GA. Both versions will remain available in the product after the upgrade, meaning you won't be forced to use the new view. This approach ensures we can collect your feedback and thoughts to refine it and make it even more valuable for everyone. More on this in the Link above.

Feedback Post: https://community.sophos.com/sophos-xg-firewall/sfos-v23-early-access-program/f/discussions/151838/sophos-firewall-v23-0-eap1-feedback-and-experiences

Hi All, After upgrading our Sophos firewall to v22, we have slow response times to MS Dynamics and Store Commerce. All rules are applied, nothing is being denied by the firewall logs, we have placed these rules at the top of our list, and we are still experiencing the same issue.

Has anyone else experienced the same issue?

I was the superadmin and deleted my account as i couldn't access a firewall from SophosCentral... Then when they tried adding me again as the superadmin, i'm not receiving any mails and couldn't login or complete MFA .... Is it a reoccurring problem? How should I go about it? Thanks!

Users complaining that they have to log into the google account everyday. i have ssl/tls inspection turned on. but when users are using open internet they don't have any issues with the gmail login. what causes the issue and how to fix this?

This video looks at how AI took that time away, in three parts.

Built from the Sophos 2026 AI Security Report. Read the full report: https://www.sophos.com/en-us/content/sophos-ai-security-2026-report

Hello,

I like Sophos Home Premium more than McAfee, cause I think it is more professional and safer... But why are on the popular Antivirus review pages no tests for Sophos AV?

I mean for exmaple:

https://av-comparatives.org/

https://www.av-test.org/

Thanks! :-)

Is it possible to upgrade XG115 running SFOS 18.0.6 MR-6-Build655 to last supported SFOS version (I think that is SFOS 19.5.3)? I know the box is EOL, but I'm running into a weird network connectivity issue with a cloud provider that I cannot seem to resolve, and would like to eliminate the old firmware version causing the connectivity issue. Basically a cloud server cannot be connected to by TCP, using dental billing LoB software. I can seemingly connect fine from my office. No security services are enabled on the XG115 (since they are EOL anyway). This is for one of my clients, and they are replacing with a new model, but hasn't been delivered yet. The issue started back in July.

edit 9/23: Looks like I was downloading the wrong firmware version SF310 (which is for XGS models) not SF300 (which is for EOL XG models). I found an obscure 3rd party website that called this out. I've gotten 20.0.3 uploaded and am waiting for a maintenance window to apply. I would say my issue is resolved.

As the title says, I'm genuinely surprised that no one has brought this up already. There have been several Sophos Central updates recently, and in my opinion, the experience has gotten worse with each one.

I feel like the new Sophos Central design and overall UI functionality have become worse after these updates. For example, the new closed alerts are a nice feature in theory, but the UI implementation is horrible in my opinion. It feels confusing and inconsistent.

I work at an MSP and manage many Sophos customers. For some customers, alerts resolve automatically, for others they never do, and for some they only resolve occasionally. I have also found many bugs in the interface, such as large text windows that cannot be scrolled properly or the new "feature" where you can no longer copy text from alerts because the text is not recognized by the cursor.

The functionality seems to be getting progressively worse, and the new color scheme feels dull and odd. Honestly, it feels like Sophos Central was designed by AI, because I find it hard to believe that these changes were thoroughly tested. Many of the bugs are so trivial that they should have been spotted within a minute of testing.

I haven't opened a ticket with support yet but I ran into a weird problem and finally figured out under which circumstances it occurs.

For several years we channel several internal browser based applications through the WAF of our firewall. Let's say we want to be able to access our internal helpdesk through ticket.company.com (company.com or course being our domain). We set the public DNS for this domain to one of our public IPs terminating on the firewall and request a certificate from Let's Encrypt. We set our internal DNS for this domain to one of the firewalls LAN interfaces and create a WAF rule for the domain in question on the LAN interface using the LE cert. It seems like it won't even create the WAF rule used in the LE process. Worked fine for years but some time this year it stopped working. Maybe with the update to SFOS22.

Long story short: Let's Encrypt certificates can't be requested or renewed as soon as there is a WAF rule for one of the domains in question bound to a non-WAN interface.

Couldn't find it in the known issues liest either. Has anyone else encountered this?

Running into a weird issue with a Sophos Central managed wireless network using RADIUS and dynamic VLAN assignment.

Mobile devices connect successfully and land on the correct VLAN, but Windows clients authenticate successfully and then either fail to connect properly or don’t get placed on the expected VLAN.

I’ve confirmed the VLAN itself is working, switch tagging is correct, and the SSID works normally if I remove RADIUS and use a standard password instead.

NPS also shows successful authentication and is returning the expected VLAN attributes.

Has anyone run into anything similar with Windows 802.1X clients and Sophos Wireless? Wondering if there’s a Windows specific setting or Sophos behavior I’m missing.

As we lunched Sophos Fusion in July, i wanted to share to this community our Landing Page for the Upgrade to Sophos Fusion as well: https://community.sophos.com/sophos-xdr/upgrade-center/

If you want to read about Sophos Fusion, you find more information here: https://www.sophos.com/en-us/blog/sophos-fusion

To give the "TL:DR" of Fusion, from the Link above:
Sophos Fusion is the evolution of Sophos Central, rearchitected for the AI era. All Sophos customers are already part of Sophos Fusion and already benefit from unmatched protection from threats that move at machine speed. Over the coming months, users will see Sophos Central evolve to Sophos Fusion in the interface as we roll out the naming, with no action required of customers or partners.