Sophos Firewall Migration Checklist for Small Business Networks

Before you touch any hardware: audit the existing rule set

Every migration starts with understanding what the current firewall is actually doing, not what the original install document says it should be doing. Export the full rule set, VPN configuration, NAT rules, and any site-to-site tunnels, then go through them line by line.

This step matters because rule sets accumulate clutter over years. A rule added for a vendor that left three years ago should not be copied forward blindly into the new device. If your rules have not been reviewed recently, our guide on how often firewall rules should be reviewed covers what a proper audit checks.

Document what depends on the firewall

• Site-to-site VPN tunnels to other offices or partners
• Remote access VPN accounts used by staff working from home or on the road
• Port forwards for any internet-facing service, such as a hosted phone system or remote camera feed
• Static IP assignments and DHCP scopes handled by the current appliance
• Any integration with Wi-Fi access points or switches for VLAN tagging

Build the new configuration in parallel

Configure the new Sophos appliance on a bench or in a lab VLAN before it ever touches production traffic. Rebuild rules deliberately rather than importing everything wholesale, since this is the natural point to drop stale rules and tighten anything overly permissive.

This is also the right time to plan segmentation properly if it has not been done already. Separating guest Wi-Fi, staff devices, and any point-of-sale or camera systems onto distinct zones is far easier to set up correctly during a migration than to retrofit later. See our article on what a Sophos firewall actually does for a plain-language breakdown of segmentation, filtering, and VPN capability.

Plan the VPN cutover carefully

Remote access VPN is usually the piece that causes the most disruption if handled poorly, because staff working from home or on the road will not notice a problem until they try to connect. Reissue VPN client profiles ahead of the cutover where possible, and schedule the change for a low-traffic window such as early morning or a weekend.

For site-to-site tunnels to partners or other offices, coordinate the exact cutover time with the other side in advance. A tunnel that comes up on one end and not the other will look like a network outage rather than a configuration mismatch, which wastes time troubleshooting the wrong problem.

Schedule the cutover window

1. Confirm a maintenance window with the least business impact, ideally outside normal hours.
2. Back up the configuration of the old firewall in full before disconnecting it.
3. Physically or virtually stage the new firewall so swap time is minimized.
4. Bring up core connectivity first: internet access and internal routing.
5. Bring up VPN tunnels and remote access second, and test each one individually.
6. Verify any port-forwarded or internet-facing service last, since these are lower priority than internal connectivity.

Test before declaring success

• Confirm internet access works from each VLAN or network segment, not just one test laptop.
• Test remote access VPN from an external network, not from inside the office.
• Verify site-to-site tunnels pass traffic in both directions, not just that the tunnel shows as up.
• Check that guest Wi-Fi still cannot reach internal resources if segmentation is in place.
• Confirm logging and alerting are active on the new device before you consider the migration finished.

Keep a rollback plan ready

No matter how carefully a migration is planned, keep the old firewall physically available and configured to be reinserted quickly if something goes wrong that cannot be resolved within the maintenance window. Losing internet connectivity for a full business day because a migration could not be reversed quickly is a preventable failure, not bad luck.

After the cutover: decommission properly

Once the new Sophos firewall has run cleanly for a week or two, retire the old device properly rather than leaving it plugged in as a spare with stale credentials still active. If the old appliance held any VPN certificates or shared secrets, confirm those have been revoked rather than just replaced on the new device.

This is also a sensible point to schedule the next rule review, since a freshly migrated firewall is the cleanest a rule set will ever be. Letting six months pass before the first review keeps that discipline in place rather than drifting back into clutter.

Frequently asked questions