License expiration - what happens

I know this is an old thread, and sorry for bringing it up again, but when the license expires are you still able to log into the appliance? I've no issue with the services stopping when the license expire (although dropping VPN's is questionable give any other hardware device that uses VPN's doesn't need to be renewed to keep them up - but I accept that's the way this one works.)

You can still login to WebAdmin, but you are left with only the services that are a part of the free Essential Firewall license.  You are correct that that does not included site-to-site VPNs.  It does include PPTP and L2TP/IPsec remote access.

EDIT 2017-04-13: Please see my revised answer below.

Cheers - Bob

You can still login to WebAdmin, but you are left with only the services that are a part of the free Essential Firewall license.  You are correct that that does not included site-to-site VPNs.  It does include PPTP and L2TP/IPsec remote access.

EDIT 2017-04-13: Please see my revised answer below.

Cheers - Bob

Cheers Bob, that clarified things. Ultimately, I think the UTM should act like a normal firewall if the license has run out eg firewall rules, interfaces, vpn's whereas I understand anything that requires frequent updates would probably stop eg AV, IDS etc

In my opinion it ACTs as a firewall without a license, no more and no less.

Site2Site VPN is not necessarily default job of a firewall.

I agree with you, and companies should be used to pay for subscriptions today for other licenses. Still I have been involved in supporting hundreds of small companies 1-5 employees that usually don't have any IT budget and all IT cost is considered an evil unessecary expence disrupting their business.

Perhaps they have a backup software sending offsite copoy to a NAS via VPN to the home office of the owner or to a branch office. In a lot of these cases I would sell another Firewall, will not mention brand, and sometimes buy no support or extra licensing. The firewall can still be used for IPsec site to site. 

I like Sophos products very much but i don't like the fact that it does not function wih IPsec after license expire. Perhaps Sophos are not interested in these customers anyway as their not repeat business, but I can't get all my collegues onboard for selling Sophos partly beacause of this. So we usually sell the other brand. We have probably sold 500 appliances the last years of the other brand, and only aprox 10 Sophos. 

In many cases a Sophos RED would do the trick but they are sized wrong for my Norwegian customers. Basically all companies and homes have 100 Mbit or more internet speed today. and that means they have to go for a RED50 that ends up being to expensive for the home office of for example a hair dresser or a small shop.

Stig
IT consultant, Norway

I'd like to know if there's any notification made by UTM before the license is due to expire.  It's fair enough paying for services, but as a busy sysadmin I'm not automatically going to know if a license is due, so a reminder would be nice.  yes, I know I could set up a reminder in  my calendar, but what if I was ill?  At least an email notification could tell my collegues...

There's a warning at 15 days, 7 days and 1 day, Shaun.  Your reseller should get a notice two months or more from Sophos to get your renewal going.  Note that you can renew at any time as these are extensions of your license, not a new license.

CORRECTING MY POST ABOVE: If the license is set to expire and you want to continue with the free Essential Firewall functionality, those services will continue to function after expiration.  You will need to get a Free Essentials License to be able to login to WebAdmin to make changes though.

Cheers - Bob

Indeed you may get notices and the reseller, but the back Sophos process takes ages to go through and it can impact the service as a result

I'm sorry Max, but I don't understand the issue.

Cheers - Bob

Sophos are really slow at getting the new licences through, even with a months notice!

I can't remember the last time a renewal license key didn't appear in our inbox within 24 hours after we'd placed an order for one of our clients.  I understand that Sophos does things differently in the EMEA region than in the Americas region, but I don't know the details.

Cheers - Bob

I agree here,  I have had problems even with my sophos reseller portal not showing all the devices correctly and email notifications to the client are not always bullet proof.

Another comment I would add is that SOPHOS seems to be the only commercial subscription based security appliance I have run into that kills the VPN connection.  So I would disagree that VPN is NOT a part of a standard firewall.  The majority of firewalls are routers,  and a router is a industry standard to have VPN (especially IPSEC) functionality.   (Sonicwall, WatchGaurd, FortiGate allow you to use VPN IPSEC functions with no license)     

I have deployed a multi WAN client with Sophos UTMs and we stopped installing them after realizing we would loose VPN function after the initial 3 year license.  Since we migrated to sophos software based endpoint filtering too we only wanted basic router functions.  So now we are pulling all the sophos and putting the old sonicwalls back in place for the small remote offices.  Sad and disappointing on sophos part.

Alternate would be to pickup some Ubiquiti EdgeMAX or USG routers for small offices,  Mikrotik work well for this purpose too.  Just depends on what kind of management you would like to do.