How Much Does a Business Firewall Cost?
Posted by Saif Khan on 2026 Sep 14th
A business firewall costs between about $860 and $29,000, and most small and mid-sized businesses land between $1,500 and $8,000. The spread is that wide because a firewall is sized to the traffic it inspects, not to the number of people in the building.
Almost no reseller publishes prices. Here are ours, with the sizing logic that explains them.
Sophos XGS prices, appliance plus one year of Xstream Protection
Live prices from our store in USD. Each includes the appliance and a one-year Xstream Protection subscription, which is the bundle that inspects encrypted traffic.
| Model | Price | TLS inspection | Typical fit |
|---|---|---|---|
| XGS 88 | $863 | 600 Mbps | Smallest office or branch |
| XGS 108 | $1,150 | 800 Mbps | Small office |
| XGS 118 | $1,590 | 1,100 Mbps | Growing small business |
| XGS 128 | $2,143 | 1,450 Mbps | Busy small office |
| XGS 138 | $2,965 | 1,700 Mbps | Small site needing 10GbE |
| XGS 2100 | $5,442 | 1,100 Mbps | Mid-sized single site |
| XGS 2300 | $7,620 | 1,450 Mbps | Mid-market office |
| XGS 3100 | $10,610 | 2470 Mbps | Large site or campus |
| XGS 3300 | $14,174 | 3,130 Mbps | Large campus |
| XGS 4300 | $21,210 | 8,000 Mbps | Data-centre edge |
| XGS 4500 | $29,186 | 10,600 Mbps | Top of the 1U range |
Three and five year subscriptions cost more upfront and less per year, and they fix your price for the period. Monthly licensing is available through an MSP if you would rather not commit.
What actually drives the price
Not user count. Sophos does not publish user counts per model, and any vendor quoting you a simple number of users is estimating.
The figure that matters is TLS inspection throughput. Almost all web traffic is encrypted, so that number sets how much traffic the firewall can actually examine. Raw firewall throughput assumes unencrypted traffic you will rarely see.
The comparison that shows why
Two models with the same TLS inspection figure, at very different prices:
| Metric | XGS 118 | XGS 2100 |
|---|---|---|
| Price | $1,590 | $5,442 |
| TLS inspection | 1,100 Mbps | 1,100 Mbps |
| Firewall throughput | 15,500 Mbps | 30,000 Mbps |
| Threat protection | 3,250 Mbps | 5,000 Mbps |
| Concurrent connections | 5,500,000 | 6,500,000 |
| New connections per second | 62,650 | 134,700 |
| Form factor | Desktop, not expandable | 1U rack, one Flexi Port bay |
The XGS 2100 costs 3.4 times more and inspects the same amount of encrypted traffic. What you are paying for is new connections per second, which more than doubles, plus the rack form factor and the expansion bay. If your users open a lot of short-lived connections, which is what busy web and SaaS use looks like, that is the figure that matters. If they do not, the 118 does the same inspection work for a third of the price.
This is the kind of thing a datasheet will not tell you and a sizing tool will not explain. It is also why "how many users" is the wrong first question.
What else you will pay for
| Item | When you need it |
|---|---|
| Flexi Port module | More ports, 10GbE fibre or PoE. Rackmount models only, one bay each |
| SFP transceivers | SFP ports ship empty. One per link, at each end |
| High availability pair | A second appliance if the firewall must not be a single point of failure |
| Managed firewall services | If nobody in-house wants to own policy, firmware and renewals |
| Installation | Migration from an existing appliance, quoted as a fixed-scope project |
Standard or Xstream, and what it costs you to choose wrong
Standard Protection covers the base firewall plus SD-WAN and ZTNA. Xstream adds TLS 1.3 inspection, cloud sandboxing and the advanced IPS.
Standard is cheaper. It also leaves most of your traffic uninspected, because most of your traffic is encrypted. For any business whose staff browse the web, Standard is a false economy rather than a saving.
Three ways to pay
- Term subscription. Appliance and license together for 1, 3 or 5 years. The only route that fixes your price.
- Own the hardware, license monthly. Buy the appliance, pay the subscription month to month through an MSP.
- Hardware as a Service. Appliance and subscription on one monthly bill, nothing upfront. The MSP owns the hardware and payments are perpetual.
Frequently asked questions
How much does a business firewall cost?
A Sophos XGS firewall with one year of Xstream Protection ranges from about $863 for the XGS 88 to $29,186 for the XGS 4500. Most small and mid-sized businesses land between $1,500 and $8,000. Price tracks the traffic the appliance can inspect, not the number of users.
How much does a Sophos firewall cost?
Appliance plus one-year Xstream Protection, in USD: XGS 88 $863, XGS 108 $1,150, XGS 118 $1,590, XGS 128 $2,143, XGS 138 $2,965, XGS 2100 $5,442, XGS 2300 $7,620, XGS 3100 $10,610, XGS 3300 $14,174, XGS 4300 $21,210, XGS 4500 $29,186. Three and five year terms cost less per year.
What makes one firewall more expensive than another?
TLS inspection throughput mainly, plus new connections per second, port count and form factor. An XGS 2100 costs 3.4 times more than an XGS 118 while inspecting the same 1,100 Mbps of encrypted traffic. The difference is that it handles 134,700 new connections per second against 62,650, and it takes an expansion module.
How do I know which model I need?
Size on TLS inspection throughput against your internet speed and how much traffic you intend to inspect. Sophos does not publish user counts per model, so any vendor quoting a simple user number is estimating. Tell us your connection speed, user count and which services you plan to enable, and we will size it against the Sophos sizing tool.
Is Standard Protection worth the saving over Xstream?
Rarely. Standard covers the base firewall plus SD-WAN and ZTNA but does not inspect TLS traffic. Since almost all web traffic is encrypted, choosing Standard to save money means most of your traffic passes uninspected.
Can I pay monthly instead of buying outright?
Yes, two ways. You can own the appliance and license it monthly through an MSP, or take Hardware as a Service where appliance and subscription come on one monthly bill with nothing upfront. Only a term subscription fixes your price for the period.
What costs are not in the appliance price?
Expansion modules if you need more ports, SFP transceivers since SFP ports ship empty, a second appliance for high availability, managed services if nobody in-house will run it, and installation if you are migrating from an existing firewall.
Get a firewall priced for your site
Nuformat is a Sophos partner serving Canada and the United States. Tell us your internet speed, user count and which services you plan to run, and we will confirm the model, price the three payment routes side by side, and reply in two to three business days. Request a quote.
All Sophos XGS firewalls · Compare models · Expansion modules
Prices in USD, current at the time of writing and subject to change. Specifications as published by Sophos.