Sophos VPN Alternative 2026: UTM End-of-Life – What Now?

Since June 30, 2026, the Sophos SG UTM has been end-of-life: no security patches, no signature updates, no support. Thousands of businesses in Germany now face the question: migrate to the XGS series – with a new license jungle, SFOS stability issues and five-figure costs? Or dare the architectural shift and decouple VPN from the firewall? NetBird offers a modern way out: open-source mesh VPN built on WireGuard, as a managed service hosted in Germany – no appliance, no license tiers, from €99.90/month.

Also worth reading: OpenVPN Alternative 2026 · Setting Up a Business Network for Remote Employees · NetBird vs. Tailscale 2026

Quick Comparison: Sophos XGS VPN vs. NetBird

Table of Contents

• Sophos UTM End-of-Life: What Happens Now
  • The Key Deadlines
  • Why the XGS Migration Isn't the Answer for Everyone
• SFOS v21.5 and v22: Stability Issues in Daily Operations
• The Structural Problem: VPN on the Firewall
• The Alternative Approach: Decouple VPN from the Firewall
• Architecture: Sophos SSL VPN vs. NetBird Mesh VPN
  • Sophos SSL VPN: How It Works Today
  • NetBird: How the Mesh VPN Works
  • Architecture Comparison
• Security: SSL VPN Vulnerabilities vs. WireGuard
• Setup and Operations: License Bundles vs. Self-Service Portal
  • Sophos: What an XGS Migration Really Costs
  • NetBird via birdhost: Ready in Minutes
• Cost Comparison
  • 3-Year Cost Comparison for an SMB (20–50 Employees)
  • birdhost Volume Pricing
• GDPR and Compliance
• Migration: From Sophos SSL VPN to NetBird
• Full Comparison at a Glance
• Decision Guide: When XGS, When NetBird?
  • Migrating to the XGS series makes sense if you:
  • NetBird / birdhost is the better choice if you:
  • The Combination: Firewall + NetBird
• Conclusion
• Sources

Sophos UTM End-of-Life: What Happens Now

The Key Deadlines

• June 30, 2024: Last order date for 2-year renewals
• June 30, 2025: Last order date for 1-year renewals
• June 30, 2026: Full end-of-life for SG UTM software and SG hardware, this date has now passed
• Since July 1, 2026: No more AV and IPS signature updates, no SXL URL classification, no support

Since July 1, 2026, there are no security patches, no signature updates, no support. Anyone still running an SG UTM now does so without a safety net. Sophos also points out that continuing to use an EoL product can impact your compliance status and jeopardize cyber insurance claims. Sophos isn't alone here: just two months later, on August 31, 2026, Cisco support for the ASA 5506-X, 5508-X and 5516-X ends as well, the same appliance dilemma, the same forced decision.

Sophos has been aggressively pushing existing customers to the XGS series, most recently with a 50% discount on XGS appliances including Xstream Protection with a minimum 3-year term. The message is clear: switch to XGS, and do it now.

Why the XGS Migration Isn't the Answer for Everyone

The Sophos promos sound tempting. But a closer look reveals: the hardware is just the beginning.

1. License costs keep running – and rising

XGS hardware comes cheap with promo discounts. But the annual subscription licenses (Standard Protection, Xstream Protection) are the real cost driver. For a small business, total costs for hardware plus 3-year license quickly reach €2,000–5,000. For mid-sized companies with XGS 2100/3100, it's €8,000–15,000+ for three years.

2. The migration isn't a click

Migrating from UTM to SFOS means switching not just hardware but the entire operating system. Configurations can't be transferred 1:1. VPN profiles, firewall rules, NAT configurations, user groups – everything must be reconfigured or migrated. Sophos offers migration aids, but the time investment is substantial.

3. SFOS v22 isn't mature yet

More on this in the next section – but the current firmware quality gives justified cause for caution.

4. Do you really need a new firewall for VPN?

Many businesses use their Sophos UTM primarily for two things: firewall/perimeter protection and VPN. If the existing firewall function can be covered by a simpler solution (OPNsense, pfSense) or a managed firewall service, you don't need an XGS just for VPN.

SFOS v21.5 and v22: Stability Issues in Daily Operations

The XGS appliances with SFOS were supposed to be the successor to the proven UTM. In practice, admins struggle with stability issues that cost time and trust in daily operations.

Documented issues in v21.5 and v22:

• SSL VPN profiles broken after upgrade: After updating to v22 (Build 411), admins report that SSL VPN profiles can no longer be created
• WebAdmin unreachable via bridge interfaces with VLAN filtering
• DNAT traffic broken with rules using specific outbound interfaces
• SSL/TLS dashboard and session charts show incorrect or empty data
• SNMP configuration cannot be added
• Let's Encrypt renewal doesn't work reliably
• HA setups unstable

The v22 GA had to be re-released in January 2026 (Build 411) to fix the worst regression bugs. For admins this means: every firmware update is a risk. You delay upgrades – and thereby worsen security.

An experienced Sophos admin put it well: "When your operations are shaky, security automatically gets worse. You upgrade later because you're afraid of the next regression bug."

SSL VPN-specific issues:

• Sophos Connect client supports only Windows – macOS requires Tunnelblick, Linux and mobile require OpenVPN
• Cipher mismatches after updates break existing VPN connections
• .ovpn configuration files must be redistributed when changes are made
• Connection problems with DS-Lite (cable internet) require IPv6 adjustments
• Special characters in usernames cause authentication errors

The Structural Problem: VPN on the Firewall

Sophos (and Fortinet, WatchGuard, Lancom) bundle VPN as a function on the firewall appliance. It sounds efficient – one box for everything. In practice, it creates problems:

The appliance is simultaneously firewall, VPN gateway and attack target. The SSL VPN portal must be reachable from the internet so remote employees can connect. That very reachability makes the appliance a target – as the Fortinet CVEs impressively demonstrate.

VPN traffic competes with firewall processing. IDS/IPS, TLS inspection, web filtering and VPN encryption all run on the same hardware. Under load, VPN performance drops.

Hardware lifecycle forces VPN migrations. When the appliance is replaced after 3–5 years, the entire VPN must be migrated – profiles, certificates, client configurations.

Every vulnerability in the firewall is a VPN vulnerability. And vice versa.

The Alternative Approach: Decouple VPN from the Firewall

The core idea: Your firewall stays responsible for perimeter security. VPN is operated as a separate, modern service.

This doesn't mean throwing away your Sophos firewall. If your XGS (or OPNsense, pfSense, whatever) does good work as a firewall – keep it. But free it from the VPN load and associated attack surfaces.

NetBird handles the VPN part, optionally as managed NetBird hosting: encrypted connections between devices, identity-based access control, automatic on-/offboarding. The firewall can focus on what it was built for: perimeter protection, traffic inspection, web filtering.

Architecture: Sophos SSL VPN vs. NetBird Mesh VPN

Sophos SSL VPN: How It Works Today

Remote Laptop ──► Internet ──► Sophos XGS (Port 443/8443) ──► LAN
                                 │ Decrypt SSL VPN
                                 │ Check firewall rules
                                 │ Forward traffic

• Client: Sophos Connect (Windows), Tunnelblick (macOS), OpenVPN (Linux/mobile)
• Authentication: Username + password, optional TOTP/MFA
• Configuration: Download .ovpn files from user portal
• Access control: SSL VPN policy with allowed networks

NetBird: How the Mesh VPN Works

Remote Laptop ◄────── WireGuard Tunnel ──────► Routing Peer (Office)
                   (direct, peer-to-peer)              │
                                                   LAN Devices

• Client: NetBird (Windows, macOS, Linux, iOS, Android – one client for all)
• Authentication: SSO via identity provider (Azure AD, Google Workspace, Okta, Keycloak)
• Configuration: No .ovpn files, no user portal – install client, SSO login
• Access control: Graphical web UI, identity- and resource-based

Architecture Comparison

Security: SSL VPN Vulnerabilities vs. WireGuard

Sophos SSL VPN is based on OpenVPN – a proven but complex protocol with over 100,000 lines of code. SSL VPN portals are by design reachable from the internet and thus a preferred attack target. Cipher mismatches after updates, certificate problems and client incompatibilities are everyday occurrences.

Fortinet – the direct competitor – is currently impressively demonstrating what happens when SSL VPN gateways are compromised: admin accounts created, VPN configurations exported, networks infiltrated. Sophos isn't currently affected, but the architecture is identical. The leak of more than 73,000 FortiGate credentials shows how large that concentration risk becomes in a worst case: when a vendor ecosystem tips over, it tips over across the entire installed base at once.

NetBird with WireGuard takes a radically different approach:

• No open ports: NetBird peers don't need any port reachable from the internet. The connection is coordinated via NAT traversal and the signal server – data traffic flows directly between peers.
• Minimal codebase: WireGuard consists of ~4,000 lines of code – formally verifiable, easily auditable.
• Cryptography without configuration: ChaCha20, Poly1305, Curve25519, BLAKE2s – no selectable cipher suites, no misconfiguration possible.
• Post-quantum option: Rosenpass offers optional protection against future quantum computer attacks.
• Posture checks: Device state verification before connection (firewall active? OS current? Endpoint security agent running?). Integrations with Microsoft Intune and SentinelOne.
• SCIM provisioning: Automatic on-/offboarding via identity provider. No forgotten VPN account, no manually revoked certificates.

Setup and Operations: License Bundles vs. Self-Service Portal

Sophos: What an XGS Migration Really Costs

The Sophos license model for the XGS series consists of:

• Hardware (one-time): XGS 87 (€300–500), XGS 126/136 (€600–1,200), XGS 2100 (~€2,500–4,000)
• Base license (perpetual): Included in hardware price. Covers IPsec VPN, SSL VPN, wireless protection and Sophos Central management.
• Standard Protection Bundle (annual): Network Protection + Web Protection + Enhanced Support
• Xstream Protection Bundle (annual): Standard Protection + Zero-Day Protection + Sophos Central Orchestration + Enhanced Plus Support

For a small business (XGS 107/108 + 3 years Xstream Protection), total costs are €2,000–3,500 for three years. For a mid-sized company (XGS 2100 + Xstream), it's €8,000–15,000+ for three years.

Add to that: labor for migration, configuration and ongoing management. Sophos expertise (internal or partner). And the uncertainty whether the next SFOS version won't break the VPN configuration again.

NetBird via birdhost: Ready in Minutes

1. Create account on portal.merkaio.com
2. Deploy instance – choose plan, region Germany
3. Open NetBird dashboard – your dedicated instance is ready
4. Install routing peer in office (one command)
5. Onboard employees (client + SSO login)

7 days free trial, own dedicated instance.

Cost Comparison

3-Year Cost Comparison for an SMB (20–50 Employees)

Sophos prices: estimate based on MSRP with typical promo discounts. Actual prices vary by partner and configuration. Admin personnel costs not included.

For businesses that use their Sophos only or primarily for VPN, the gap to a monthly flat rate without hardware is substantial.

birdhost Volume Pricing

All plans: No per-user fees, no add-on licenses, hosted in Germany, 24/7 monitoring, updates and patches included.

GDPR and Compliance

Sophos (Self-Hosted): GDPR responsibility lies with the operator. The appliance sits in your network – good for data sovereignty, but you're responsible for patches, hardening and TOMs. Sophos Central (cloud management) processes metadata in the cloud.

NetBird / birdhost: The entire infrastructure runs in German ISO 27001 certified data centers. No metadata with US providers. DPA available directly in the merkaio portal. WireGuard encryption end-to-end – even birdhost cannot decrypt the traffic.

Migration: From Sophos SSL VPN to NetBird

Migration can happen gradually. NetBird and Sophos SSL VPN run alongside each other without issues.

Phase 1 – Test (Day 1): Deploy birdhost instance via portal.merkaio.com. 7 days free. Install routing peer in office, add office network as resource.

Phase 2 – Pilot (Week 1–2): Onboard small group (5–10 employees) onto NetBird in parallel. Configure SSO, define access rules. Sophos SSL VPN stays active as fallback.

Phase 3 – Rollout (Week 3–4): Migrate all employees to NetBird. Translate access rules from Sophos SSL VPN policies to NetBird policies – switching from network-based to identity-based rules.

Phase 4 – Decommission SSL VPN: Disable Sophos SSL VPN. The firewall stays active for perimeter security – without VPN load and without the SSL VPN portal as attack surface.

Result: Your Sophos firewall (whether UTM successor or alternative solution) continues doing firewall – but VPN is decoupled, more modern and more secure.

Full Comparison at a Glance

Decision Guide: When XGS, When NetBird?

Migrating to the XGS series makes sense if you:

• Use the Sophos firewall as a complete perimeter security solution (IDS/IPS, TLS inspection, web filtering, email protection)
• Are already invested in the Sophos ecosystem (Intercept X, Central Management, Synchronized Security)
• VPN is just a side aspect next to the firewall function
• Have a Sophos-certified partner handling migration and ongoing operations

NetBird / birdhost is the better choice if you:

• Used your Sophos UTM primarily for VPN
• Want to avoid the license and operational overhead of a new appliance
• Want modern access control with SSO, MFA and automatic provisioning
• Need predictable costs without hardware refresh cycles and license tiers
• Prefer GDPR-compliant managed hosting in Germany
• Want to decouple VPN from the firewall and reduce the attack surface
• Are looking for a solution that's ready in minutes – not weeks

The Combination: Firewall + NetBird

For many businesses, the smartest solution is: a lean firewall (OPNsense, pfSense, or even a small XGS) for perimeter security – and NetBird for VPN. This way, each component gets the job it was built for.

Conclusion

The Sophos UTM end-of-life isn't cause for panic – but it is a reason to fundamentally rethink your VPN strategy. The automatic answer "we'll just buy an XGS" isn't the only option – and for many businesses, it's not the best one either.

NetBird offers a modern alternative: faster, more secure and cheaper than SSL VPN on a firewall appliance. Combined with managed hosting from birdhost, businesses get a VPN that's ready in minutes, offers identity-based access control and is hosted in Germany at a predictable flat rate.

Try it now: Start your own NetBird instance via the merkaio self-service portal – 7 days free.

Recommended reading: OpenVPN Alternative 2026 · Business Network for Remote Employees · NetBird vs. Tailscale 2026 · Twingate Alternative 2026

Sources

• Sophos UTM/SG End-of-Life: Frequently Asked Questions (community.sophos.com)
• Sophos SG UTM End-of-Life: Deadlines and Licenses (firewalls24.de)
• Sophos SFOS v22 GA Re-Release (Build 411) – Sophos Community
• Sophos Firewall: Bugs in v21.5 to v22 (truenetlab.com)
• Sophos SSL VPN Troubleshooting (docs.sophos.com)
• Sophos XGS Firewall Pricing (sophos.com)
• Sophos Promo Offers (firewalls24.de)
• Firewall for SMBs: The Big Comparison 2026 (cyber-shop.eu)
• NetBird GitHub Repository
• NetBird Documentation
• NetBird Series A – EU-Startups (January 2026)
• WireGuard Protocol Specification
• birdhost.de – Managed NetBird Hosting