SOPHOS UTM: Use hardware appliances with home / software license

This is not a supported configuration by Sophos πŸ˜‰

Normally when you get an old hardware Appliance, ex. UTM 220, 320 etc, you cannot use this in your home environment (With your free home license), without paying for a hardware license.

This can be “solved”, by making the hardware installation think, it’s going software πŸ™‚

The steps are listed here:

  1. Take a backup of your running UTM configuration in WebAdmin, if you have such running at the moment.
  2. Download the hardware image for appliances, theese starts with “SSI” in the file name. (Google “Download Sophos UTM”)
  3. Burn this to a CD-rom or to USB followingΒ this link.Β (This will format the harddrive of the appliance, so logs and stats are lost!)
  4. Install the hardware appliance as you would do normally.
  5. After installation, you now have a complete clean Sophos UTM 9 installation.
  6. Connect a VGA screen and a USB keyboard to the appliance.
  7. At the login prompt: login as root – it will tell you to change password, just do that (Old password is <blank>).
  8. When you’re logged in, do this:
    “viΒ /etc/asg”
    deleteΒ theΒ “ASG_ID….”-entry in the file and save and close
  9. Reboot

Now the UTM will boot running software license, and you can use your home license with it πŸ™‚

This workaround will not swap interface names, and if you have one of the bigger models, 220 and beyond, with LCD, then will this just work as it did with hardware config – software installations do not have support for the LCD driver – but this way it works.

Happy UTM’ing πŸ˜‰

Update: 15/11-2016

When replacing a harddrive with ex. a SSD or other drive, the hardware installer will not install, due to hardware replacement (It looks for specific harddrives with special firmware!), then you cannot use the installer above, you will then have to go with the SOFTWARE ISO instead of the HARDWARE ISO. Install will proceed as normal, but after install, the LCD display will no longer work, cause it’s now a “software” install and not hardware appliance install.

There have been written a lot here about a fix:

https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/10917/asg-425-display-with-homelicense

But the link above does only make the display work with one view “Sophos UTM %version% and uptime”, this is due to the missing /etc/lcd.data file, because this file is only generated on appliances (hardware install).

The main reason it does not work, is that the /etc/asg file is now missing, because this file tells the installer that it is running on an appliance, you cannot copy this from another appliance solely, because you need to modify it (Ex. remove ASG_id and ASG_Serial lines):

Do a “vi /etc/asg”

It creates a new file and then insert:

Ex. for SGΒ 210

ASG_VERSION=”210″
LCD4LINUX_HW=”LCD-SERIAL300″
ASG_SUBTYPE=”r1″

Ex. for UTM 220

ASG_VERSION=”220″
LCD4LINUX_HW=”LCM-162″
ASG_SUBTYPE=”r5″

As you see UTM and SG’s have different LCD controller.

Now reboot and watch the display cycle through the widgets, you can also see if /etc/lcd.data is being populated πŸ™‚

42 Comments

  1. user

    Great stuff!
    Appreciate that you shared it with us.
    Works well on Smoothwall S4 appliance when you set asg file to version 210

    Reply
    1. Martin (Post author)

      Thanks and thanks a lot for the Smoothwall appliance hint πŸ™‚

      Reply
  2. Andreas Neubauer

    Excellent Skills. I followed that way and it worked fine for me. Display is even working fine. Perfect!!

    Reply
    1. Martin (Post author)

      Thanks a lot! πŸ˜‰

      Reply
  3. Rob G

    Above you show
    – – –
    Ex. for UTM 320

    ASG_VERSION=”220β€³
    LCD4LINUX_HW=”LCM-162β€³
    ASG_SUBTYPE=”r5β€³
    – – –

    I have a UTM 220 (don’t wince but I’m running version 7).
    I’m mainly asking about the SUBTYPE line.
    My original UTM 220 /etc/asg file shows ASG_SUBTYPE=”none”
    Should I change it to r5? Or leave it as “none”?

    I want to make sure I have this right to give every chance that the LCD
    works correctly the FIRST TIME when I reboot it after saving my changes.

    Second, for the benefit of others who see this thread, is there a typo (320 vs. 220) that needs to be corrected? Do you need to deal with the fact that you’re listing

    “Ex for UTM 320”,

    but your

    ASG_VERSION shows “220” ?

    Reply
  4. Martin (Post author)

    Hi Rob, thanks for your reply πŸ˜‰ – Nice catch, there was a typo, you are correct, corrected πŸ˜‰
    read here about the ASG_SUBTYPE og how to find, in this case r5 is correct.

    https://community.sophos.com/kb/en-us/118143

    Reply
  5. Andres

    Any idea if it is possible to do a similar trick on an XG in order to use the XG hardware install (upgrading my SG device) on my appliance and use a home license?

    Reply
    1. Martin (Post author)

      Yes, just download ISO and follow my article with USB install on UTM appliance πŸ™‚

      https://www.sophos.com/en-us/support/utm-downloads.aspx

      Reply
  6. Jan

    Thanks for that nice & easy howto.
    Worked well on a UTM110/120.

    Reply
    1. Martin (Post author)

      thanks – glad to hear that πŸ™‚

      Reply
  7. Matze

    Hi, does not work for me with UTM320. While /etc/asg exist the webinterface does not start. After deleting it works (as before). Display does not work in either situation.
    Ok I put similar to the 220 in my asg:

    ASG_VERSION=”320β€³
    LCD4LINUX_HW=”LCM-162β€³
    ASG_SUBTYPE=”r5β€³

    So perhaps that was wrong?

    Reply
    1. Martin (Post author)

      Hi,

      Have you followed my guide completely point to point?
      ASG version, have you changed for 22o and not 320 when you used your 220?

      Regards Martin πŸ™‚

      Reply
  8. Stuart

    Hey,

    Anyone found a way to do this on the SG230 with XG software installed.

    Using XG Home v18 but just shows Sophos Protection.

    Don’t know if this trick is only for the UTM Software

    Reply
    1. Martin (Post author)

      XG cannot do this at the moment, it can just be rebooted and factory reset and so on. It’s the same on XG appliances, as the hw is the same πŸ™‚

      Reply
      1. nd

        Hello, but where is the display configured on XG Appliances?
        There must be any file to configure that – right? :/

        Regards,
        Andy.

        Reply
        1. Martin (Post author)

          Hi Andy,

          The XG cannot be modified in such ways, you need to do otherwise with XG:

          Just install the home license ISO on the hw device, that works πŸ™‚

          Reply
          1. Oliver

            I am using a SG230 with XG home v18.x but the display only shows Sophos Protection. You wrote, by using the home ISO file it will work. I habe installed XG via USB-Stick, configured with Rufus. Isn’t it the same?

          2. Martin (Post author)

            Hi, no the guide for the LCD is just for UTM, you cannot tamper with XG like the UTM, as it uses a lockdown Linux πŸ™‚

  9. Lou DeMartino

    How do you revert if you did not back up the ASG file

    Reply
    1. Martin (Post author)

      Hi, you need to reimage the appliance and it will be generated again πŸ™‚

      Reply
  10. Thomas

    Martin, I’ll be acquiring an SG 230 r1 with UTM 9.x. Will this be similar/same as may old ASG 220 UTM or will I need to use the home ISO?
    Thanks

    Reply
    1. Martin (Post author)

      Hi,
      Glad to hear about the HW upgrade πŸ˜‰

      The procedure is exactly the same πŸ˜‰

      Reply
  11. Daniel

    Hey, I’m about to get a used UTM425 rev5 shortly.

    Will ich be able to install XG home 18 on it?

    Reply
    1. Martin (Post author)

      Hi,
      No, only SG models will work with it πŸ™‚

      Reply
  12. Daniel Traum

    Just a clarification, I’m talking about the software image, not the hardware Image….. I thought this should go, but I have to wipe the ssd before I install?

    Reply
    1. Martin (Post author)

      Ahh! makes sense πŸ™‚
      Should work with the UTM hw chipset for nics, no need to disk wipe, the software installer will do it for you, just attach keyboard and monitor before you begin πŸ™‚

      Reply
  13. Ralf Schnele

    Martin,

    I just came accross your good how-to.

    I got my hans on a UTM220 and tried the trick to get the home license aktivated.

    The installer using die ssi_version says: it is not a appliance. the software asg_ Version says: hey, I am hardware !

    Where do I got wrong ?

    Sincerly,
    Ralf

    Reply
    1. Martin (Post author)

      Have you replaced the hardwar eog RAM or is it 100% like from the factory? πŸ™‚

      Regards Martin

      Reply
  14. CASTRO

    Hi, please someone tell me how to save and exit.. e try “q” but don’t leave.

    Reply
    1. Martin (Post author)

      You need to save first πŸ™‚

      :wr

      :q

      πŸ™‚

      Reply
  15. Castro

    Hooo yes…. “:” … πŸ™‚

    Reply
    1. Martin (Post author)

      Great πŸ™‚

      Reply
  16. aedi

    Tanks man, this still works.
    Just changed an already configured and licensed SG230 to a home license. A fresh install is actually not necessary.

    Reply
    1. Martin (Post author)

      Thanks πŸ™‚

      Reply
  17. Peter

    Hi, will this work also on SG310 and what are the parameters in /etc/asg?

    Regards Peter

    Reply
    1. Martin (Post author)

      YES πŸ™‚

      parameters are the same.

      Reply
  18. Joey

    Hi i get a UTM220 from my Friend an i will install the HomeLizenz. Which Version for UTM220 should i install.

    Can i Download and install this version
    9.711-5.1
    Sophos UTM

    Platform: UTM v9 hardware appliance

    Reply
    1. Martin (Post author)

      Yes you can πŸ™‚

      Reply
  19. Miraj

    Hi, Martin. I bought a UTM 110/120 Rev.5 from EBay. I would like to install XG Home on it , is it possible to do it? If so, how can I get this done?

    Reply
    1. Martin (Post author)

      Hi,

      have not tried with the 120, only 115.

      But register for the XG home and donwload the software image, put it on USB stick with “RUFUS”, attach a screen to the UTM and a keyboard, the try to boot it πŸ™‚

      Br. Martin

      Reply
  20. Miraj

    Hi Martin, I have tried it, it doesn’t work because, My UTM110/120 Has 2GB RAM. The minimum requirement is 4GB. So i got an error message saying :

    Error : Cannot install this firmware
    RAM size is lower than minimum requirement of 4GB, Error 4
    press y to reboot.

    Is it possible to install Pfsense on it? If so could you please advise me or send me a link. Thanks

    Reply
    1. Martin (Post author)

      Ahh yes that is not enough πŸ™

      See this:
      https://martinsblog.dk/pfsense-sophos-appliance-install/

      Br. Martin

      Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close