A Sophos SG replacement starts with the UTM functions actually in use. Alongside firewall rules, VPNs, proxies, certificates and external peers may be affected. A configuration export is an important basis, but does not replace checking required connections.
Current estate
Record rules, services and peers
Target
Map functions and test connections
Transition
Migrate site by site and verify operations
Check the actual remaining support period
Check the current support status of your appliance, software and subscriptions against Sophos lifecycle information and your contract. Extensions or transition arrangements may differ from the original schedule. This determines the time actually available for selection, procurement and testing.
Record dependencies before choosing a product
The new firewall need not inherit every historical rule. It must, however, permit all connections still required. Assign each rule and service a business purpose and an owner.
- Record site-to-site VPNs and remote access, including authentication.
- Check NAT, published services, DNS, certificates and proxy functions where applicable.
- Involve external providers early if peer systems need changes.
Plan the target platform and cutover together
Whether Sophos Firewall, OPNsense or another product fits also depends on support, operational expertise and additional features. Test the most important connections in advance and agree a cutover test record. Rollback must account for addressing, routing and external peers.
Questions to resolve
- Which UTM functions need a separate replacement?
- Who can change external VPN peers in time?
- Which connections must demonstrably work after cutover?