Sophos Firewall SFOS 22: Current Features and Upgrade Controls

SFOS 22 is a product family with general-availability and maintenance releases, fixed issues, known issues, platform requirements, and upgrade constraints. Administrators should base decisions on the current release notes for the intended build and appliance—not only a launch summary.

Understand the current release line

The Sophos SFOS 22 launch article highlighted health checks, an updated control plane, privilege separation, HA self-healing, and other Secure by Design changes. Maintenance releases add features and fixes, so the launch article does not replace build-specific release notes.

Resolve prerequisites and blockers

• Supported XGS, virtual, software, or cloud platform.
• Current and target build and approved migration path.
• Disk-space and appliance requirements.
• Legacy remote-access IPsec and legacy VLAN constraints.
• HA, RED, wireless, VPN, authentication, certificate, and interface dependencies.
• Backup compatibility and an independently stored configuration export.

Plan a bounded upgrade

1. Review current release notes, known issues, and advisories.
2. Capture configuration, health, licenses, interfaces, routing, VPN, HA, policies, logs, and performance.
3. Test a representative lab or lower-risk device.
4. Approve maintenance window, communications, validation, and rollback.
5. Upgrade in waves and pause on defined failures.
6. Verify the exact build and all critical functions.

Validate security and operations

Check management access, authentication, certificates, routing, NAT, filtering, IPS, web protection, VPN, SD-WAN, HA, logging, backups, monitoring, and business applications. Review health-check findings as decisions requiring context; do not make broad configuration changes automatically without traffic and business-owner evidence.

Next step for your environment

Create a per-firewall upgrade worksheet using the current SFOS 22 release notes and configuration evidence before scheduling a change. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.

Record the accountable owner, current baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, model availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.

Sources and update trigger

• Sophos — SFOS 22 release notes
• Sophos — SFOS 22 general availability overview

Review trigger: Review on every SFOS maintenance release, known issue, advisory, hardware, configuration, or support change.