I had an XGS126 on 19.5.x to move to 21.5. The SSD firmware was already sorted on that box, which removed one thing from the list. What follows is the prep I used, the upgrade path I followed, the pitfalls I watched for, and the checks I ran afterwards.
First, confirm the exact firmware on the appliance from the admin console. Export a full configuration backup and keep it off-box. I take two copies: one on a USB stick and one on an internal file server. Check the release notes for the 21.5 series and for any required upgrade path. If Sophos call for an intermediate install, do that rather than skipping it. Their release notes cover the required steps and compatibility, so read them before starting the upgrade.
Check that the XGS126 has the SSD firmware level the later SFOS releases expect. Sophos advise a specific SSD firmware update for some 19.5/20.x upgrade scenarios, so that needs checking first. If the SSD firmware is missing, the firewall can fail to boot after the OS upgrade [https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html] [https://support.sophos.com/support/s/article/KBA-000009132]. Book a maintenance window. For a single-site XGS126, 30 to 60 minutes is a fair starting point. Leave extra time for checks after the reboot. Have direct console access or a local keyboard and monitor path ready. Remote GUI access on its own is asking for trouble if it goes sideways.
On the day, confirm the backup still restores and that the configuration file size looks normal. If an intermediate firmware is needed, upload that first and let the appliance settle. I upload the firmware file to the device, start the installer from the admin UI and watch the bootstrap messages on the console. Do not interrupt power. The serial or local console will show errors the web UI can miss. The upgrade reboots the appliance once or twice. Once it comes back, give it a few minutes for services to restart. Check that the management interface is reachable. Verify HA peers if the box is in HA. On an XGS126, check that VLANs, firewall rules and VPNs come back intact. Test a few real flows: ping the gateway from a workstation, browse a site that uses the firewall policy you care about, and test any site-to-site VPNs or authentication proxies. If you use SFP+ ports, check link speed and throughput on a known-good link. Write down pass or fail results and timestamps.
The usual firmware problems are skipped intermediate upgrades that leave services mismatched, missing SSD firmware that stops the box booting, and changed defaults in the new firmware that alter packet flow. If something breaks, capture the serial log, export the system logs and keep the configuration backup close by. Only restore the backup after the firmware has settled, and do not restore a config from a much older major version without checking compatibility. If the appliance will not boot, use the Sophos recovery instructions and the installer images from Sophos support. If you need to open a case, include the serial number, model, exact original firmware and target firmware.
Keep notes as you go. Record filenames, checksums, timestamps and the result of each smoke test. That is what saves time when you have to pick through a failed upgrade at the end of the window. The short version is still the same: read the release notes, verify SSD firmware first, back up twice, have console access, and test real traffic after the reboot.
