-
Sophos XGS 118w Gen2 Security Appliance
BUY$943.59MSRP: $1,092.69 -
Sophos XGS 108 Gen2 Security Appliance only
BUY$663.85MSRP: $768.93 -
Sophos XGS 138 Gen2 Security Appliance
BUY$1,455.50MSRP: $1,684.83 -
Sophos XGS 128 Gen2 Security Appliance, XG128Z00ZZPCUS
BUY$1,150.91MSRP: $1,332.67 -
Sophos XGS 118 Gen2 Security Appliance
BUY$846.32MSRP: $980.51 -
Sophos XGS 108w Gen2 Security Appliance only
BUY$761.12MSRP: $881.82 -
Sophos XGS 88w Gen2 Security Appliance only
BUY$591.43MSRP: $684.44 -
Sophos XGS 88 Gen 2 Security Appliance only
BUY$505.52MSRP: $585.04 -
-
-
802.11ac 2x2 single radio WiFi module
BUY$162.59MSRP: $188.15 -
8 port GbE SFP FleXi Port module (for all XGS Rackmount models), XSBZTCHF8
BUY$846.32MSRP: $980.51 -
8 port 10GbE SFP+ FleXi Port module (for XGS 5500/6500/7500/8500 models only), XSAZTCHF8
BUY$2,185.38MSRP: $2,530.44 -
-
-
2 port 40GbE QSFP+ Flexi Port Module (for XGS 5500/6500 models only) , XSBZTCHF2
BUY$1,941.85MSRP: $2,248.57
Sophos XGS Firewall · Sophos Silver Partner
Sophos XGS firewalls, sized for any business.
Sophos XGS is the hardware line for Sophos Firewall: 15 appliances, from the desktop XGS 88 to the 2U XGS 8500. Every model runs the same Sophos Firewall OS and the same protection, so you pick on size, ports, and inspection speed. Compare the range below, or ask us to size it.
In plain terms: size an XGS on its TLS inspection figure, not the headline firewall number. Most traffic is encrypted, and TLS inspection is what limits how much of it the firewall can actually check.
Looking for a specific model or SKU? Use the search bar at the top of the page. Or browse the options below.
Four ranges cover every size. Pick the one that matches your network, or jump between them here.
Desktop & Small Office
XGS 88, 108, 118, 128, 138 (w = Wi‑Fi)
Silent, compact desktop firewalls for small and branch offices.
Shop desktop XGS →1U Distributed Edge
XGS 2100, 2300, 3100, 3300, 4300, 4500
Rackmount firewalls for mid-market and busier sites that need more throughput and ports.
Shop 1U XGS →2U Enterprise Edge
XGS 5500, 6500, 7500, 8500
High-capacity firewalls for enterprise cores and campus edges, up to 190 Gbps firewall throughput.
Shop 2U XGS →Virtual & Cloud
Sophos Firewall VM
The same Sophos firewall as software, for your hypervisor or the public cloud.
Shop virtual firewalls →Buy Sophos XGS below Pick a model to add to cart, or request a quote for sizing and volume pricing.
Every Sophos XGS model at a glance
| Model | Firewall | TLS inspection | Buy |
|---|---|---|---|
| Desktop | |||
| XGS 88 / 88w | 9.9 Gbps | 600 Mbps | Shop XGS 88 → |
| XGS 108 / 108w | 12.5 Gbps | 800 Mbps | Shop XGS 108 → |
| XGS 118 / 118w | 15.5 Gbps | 1,100 Mbps | Shop XGS 118 → |
| XGS 128 / 128w | 19.1 Gbps | 1,450 Mbps | Shop XGS 128 → |
| XGS 138 | 19.1 Gbps | 1,700 Mbps | Shop XGS 138 → |
| 1U rackmount | |||
| XGS 2100 | 30 Gbps | 1,100 Mbps | Shop XGS 2100 → |
| XGS 2300 | 39 Gbps | 1,450 Mbps | Shop XGS 2300 → |
| XGS 3100 | 47 Gbps | 2,470 Mbps | Shop XGS 3100 → |
| XGS 3300 | 58 Gbps | 3,130 Mbps | Shop XGS 3300 → |
| XGS 4300 | 75 Gbps | 8,000 Mbps | Shop XGS 4300 → |
| XGS 4500 | 80 Gbps | 10,600 Mbps | Shop XGS 4500 → |
| 2U rackmount | |||
| XGS 5500 | 100 Gbps | 13,500 Mbps | Shop XGS 5500 → |
| XGS 6500 | 120 Gbps | 16,000 Mbps | Shop XGS 6500 → |
| XGS 7500 | 160 Gbps | 19,500 Mbps | Shop XGS 7500 → |
| XGS 8500 | 190 Gbps | 24,000 Mbps | Shop XGS 8500 → |
Maximum throughput figures from Sophos datasheets. Watch the TLS column: the rackmount XGS 2100 inspects 1,100 Mbps of encrypted traffic, less than the desktop XGS 128 (1,450 Mbps) or XGS 138 (1,700 Mbps). Choose the 2100 for rack mounting and its FleXi Port expansion bay, not for inspection speed.
Full side-by-side comparisons
Each comparison adds IPS and threat protection throughput, ports, and add-on modules for the range.
Compare all XGS models
XGS 88 to XGS 8500, plus virtual
Full specification table across every range, with modules and add-ons.
Open the comparison →Compare desktop models
XGS 88, 108, 118, 128, 138
Side by side for small and branch offices, including the Wi-Fi variants.
Open the comparison →Compare 1U models
XGS 2100 to XGS 4500
Rackmount models for mid-market and multi-site networks.
Open the comparison →Compare 2U models
XGS 5500 to XGS 8500
Enterprise and campus edge, up to 190 Gbps firewall throughput.
Open the comparison →Compare Sophos switches
CS101 to CS1010
Port counts and PoE budgets for the switches behind the firewall.
Open the comparison →| Capability | What it does |
|---|---|
| Xstream performance | Accelerates trusted traffic and inspects encrypted TLS 1.3 traffic at speed, so protection stays on without choking the network. |
| Synchronized Security | The firewall and your Sophos endpoints share a Security Heartbeat, isolating a compromised device automatically before a threat spreads. |
| Deep threat protection | Intrusion prevention, deep packet inspection, sandboxing, and AI-driven threat intelligence stop ransomware and zero-day attacks at the edge. |
| SD-WAN | Built-in SD-WAN links multiple sites with automatic failover and application-based routing. |
| Managed in Sophos Fusion | Every XGS is managed alongside your endpoints, switches, and Wi-Fi from one console. |
| Bundle | What is included |
|---|---|
| Base License | Included with every appliance: firewall, networking, SD-WAN, wireless, unlimited remote-access and site-to-site VPN, and reporting. |
| Standard Protection | Base License plus Network Protection (intrusion prevention, advanced threat protection, Security Heartbeat) and Web Protection (web filtering and application control), with Enhanced Support. |
| Xstream Protection | Everything in Standard, plus Zero-Day Protection (machine learning and sandboxing), Central Orchestration (SD-WAN orchestration, cloud reporting, and the XDR/MDR connector), and DNS Protection. The bundle most businesses choose. |
| Add-on modules | Email Protection and Web Server Protection (a web application firewall) can be added to either bundle. |
There are four ways to pay for a Sophos XGS firewall. A term license locks your price; the monthly options spread the cost.
| Option | How you pay | Price locked? |
|---|---|---|
| Term license (buy outright) | Appliance plus a 1 or 3-year Xstream Protection subscription (5 years on selected models), paid upfront. You own the hardware. | Yes, for the term you buy |
| Monthly license (MSP Flex) | Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing. | No, so the monthly price is set by Sophos and can change |
| Nuformat payment plan | The appliance cost is split over 12 monthly payments, and you own the hardware after the twelfth. Protection (Standard, Xstream, or Xstream with Web Server and Email Protection) is billed monthly and separately, and continues after the hardware is paid off. Available on every current XGS model. | Hardware payments are fixed for the 12 months |
| Hardware as a Service (HWaaS) | Appliance, standard shipping, and Xstream Protection in one monthly price via MSP Flex. Mandatory 12-month initial term, then month to month. | No, so the monthly price is set by Sophos and can change |
Monthly vs term, in short: a term license fixes your price for the years you buy it. The monthly options, MSP Flex and Hardware as a Service, remove or reduce the upfront cost and bill monthly, but the monthly license price is set by Sophos and is subject to change. MSP Flex and HWaaS are delivered through a Sophos MSP partner on select models in the US and Canada. The Nuformat payment plan is our own financing, not Sophos HWaaS: you end up owning the appliance. HWaaS vs buying outright, explained.
| Support level | What you get |
|---|---|
| Enhanced Support (included) | Included with Standard and Xstream Protection: 24/7 technical support, firmware and security updates, and advance hardware replacement for the subscription term. |
| Enhanced Plus (upgrade) | Everything in Enhanced, plus calls routed to senior Sophos engineers, up to 8 hours a year of remote consulting, and priority analysis of malware samples you submit. |
| Managed firewall | Prefer to hand off the day-to-day? We run and support your firewalls for you. Ask about Nuformat Managed Firewall. |
| Renewal | What it covers |
|---|---|
| Standard Protection renewal | Renews Network Protection, Web Protection, and Enhanced Support for a new term. |
| Xstream Protection renewal | Renews the full Xstream bundle (Zero-Day Protection, Central Orchestration, DNS Protection) plus Enhanced Support. |
| Enhanced Plus renewal | Renews the Enhanced Plus upgrade where you added it. |
| Term options | 1 or 3 years on every model, 5 years on selected models, or monthly. We match the renewal to your appliance and remind you before it lapses. |
Sophos XGS FAQ
What is Sophos XGS?+
Sophos XGS is the current hardware line for Sophos Firewall. It covers 15 appliances in three form factors: desktop (XGS 88 to 138), 1U rackmount (XGS 2100 to 4500), and 2U rackmount (XGS 5500 to 8500). Every model runs Sophos Firewall OS with the same protection features and is managed in Sophos Fusion.
Which Sophos XGS model do I need?+
It depends on your users, sites, and how much encrypted traffic you need to inspect. Size on the TLS inspection figure, not firewall throughput. Desktop models suit small and branch offices, 1U suits mid-market sites, and 2U suits enterprise cores and data-center edges. Tell us your environment and we will size it.
What is the difference between Standard and Xstream Protection?+
Both include Network Protection, Web Protection, and Enhanced Support. Xstream adds Zero-Day Protection (machine learning and sandboxing), Central Orchestration (SD-WAN orchestration, cloud reporting, and the XDR/MDR connector), and DNS Protection. Xstream is the bundle most businesses choose.
How is a Sophos XGS firewall licensed?+
Every appliance includes a Base License for firewall, networking, SD-WAN, VPN, and wireless. Protection comes from a Standard or Xstream Protection subscription, bought for 1 or 3 years on every model, 5 years on selected models, or monthly. Email Protection and Web Server Protection are optional add-ons.
Can I pay for a Sophos XGS firewall monthly?+
Yes, three ways. Buy the appliance and pay for protection monthly, use the Nuformat payment plan to split the appliance cost over 12 months and own it afterward, or use Sophos Hardware as a Service, which bundles the appliance and Xstream Protection into one monthly price on a 12-month initial term.
What support comes with Sophos XGS?+
Standard and Xstream Protection both include Enhanced Support: 24/7 technical support, firmware and security updates, and advance hardware replacement for the subscription term. Enhanced Plus is an upgrade that adds senior engineers, up to 8 hours a year of remote consulting, and priority malware analysis.
Is the old Sophos XG series still available?+
No. XG Series hardware reached end of life on March 31, 2025 and no longer receives firmware, security, or pattern updates. The XGS series replaced it.
Are the first-generation XGS desktop models end of life?+
Sophos has announced end of life for the first-generation desktop models: XGS 87, 107, 116, 126, and 136. Their Gen 2 replacements are the XGS 88, 108, 118, 128, and 138. See our XGS end-of-life guide for dates and upgrade paths.
Can I run Sophos Firewall in the cloud?+
Yes. The same Sophos Firewall software runs as a virtual appliance on your hypervisor or in the public cloud. See Sophos virtual firewalls.
Does Nuformat sell Sophos XGS in Canada and the USA?+
Yes. Nuformat is a Sophos Silver Partner that sells, ships, and supports Sophos XGS firewalls across Canada and the USA, and quotes in Canadian or US dollars.
