Sophos XGS 118 Firewall Buying Guide (2026)

Sophos XGS 118 buying guide: what it is, what it costs, and how to buy

The Sophos XGS 118 is a compact desktop next-generation firewall for small offices and branch sites, with 15.5 Gbps firewall throughput and 1.1 Gbps of native TLS inspection. The 118w adds built-in Wi-Fi. In USD, the appliance with a 1-year Xstream Protection subscription is $2,245, dropping to an effective $95 a month over a 5-year term. You can also own the appliance and pay $55 a month for the Xstream licence, or take HWaaS at $95 a month with the appliance included, both managed by Nuformat as your MSP. Buy Xstream if you want to inspect encrypted traffic on the box; buy Standard for the base firewall.

A small office needs real protection without a rack, a noisy appliance, or an enterprise budget. The XGS 118 sits in the middle of the Sophos desktop range: more headroom than the entry models, quieter and cheaper than a rackmount. Here is what it does, how it performs, and what it costs in 2026.

Why the XGS 118 suits a small office

The 118 is a Gen 2 desktop model, built for small offices and branch sites. It runs the same Sophos Firewall operating system and the same Xstream architecture as the rackmount models, so a small team gets the same inspection engine and the same management experience as a much larger site, in a quiet desktop unit that sits on a shelf. The 118w version has Wi-Fi built in, so one device covers both the perimeter and the office wireless. Everything is managed from the Sophos cloud console, which is included at no extra cost and is now becoming Sophos Fusion. For an office with little or no dedicated IT, that single console is usually what makes it manageable.

The protection you get with Xstream Protection

The Xstream Protection bundle turns the 118 into a full next-generation firewall, not a basic one:

• TLS 1.3 inspection. Most malware now hides in encrypted traffic. The 118 decrypts and inspects it on the box, at up to 1.1 Gbps, closing a blind spot that trips up many small-office firewalls.
• Deep packet inspection and next-gen IPS. Streaming inspection scans traffic for known attacks and exploits before they reach a device.
• Zero-Day Protection. Suspicious files are checked by machine learning and a cloud sandbox through SophosLabs Intelix, catching threats that signatures miss.
• Web and application control. Filter web access and control which applications are allowed, to keep a small network productive and safer.
• SD-WAN and VPN. Link a second site or remote workers with built-in SD-WAN and VPN.
• Cloud management, included. Run it from the Sophos console at no extra cost, with scheduled firmware updates and zero-touch deployment.

Performance: the numbers that matter

These are Sophos-published figures for the Gen 2 XGS 118. Treat throughput as vendor-measured under set conditions, and size to your real traffic.

For a small office, the figure to note is the 1.1 Gbps of TLS inspection: the 118 can look inside encrypted traffic at the speeds a small network actually runs at, rather than waving it through.

How to buy the XGS 118 in 2026

There are three routes, and the right one depends on whether you value a locked price or lower upfront cost.

Buy outright (term licence), USD

All prices below are in USD, current at time of writing. The appliance and licence come together in each bundle.

The advantage of buying outright on a term licence is that your price is locked for the whole term, with no monthly increases, and you own the hardware. A 3 or 5-year term also brings the effective monthly cost right down.

Prefer Wi-Fi built in? The 118w adds a wireless radio: appliance only $1,539, or $2,404 with 1-year Xstream Protection.

Monthly licence (own the hardware, licence monthly)

You can own the appliance and pay for the licence month to month, billed and managed by Nuformat as your MSP through Sophos MSP Flex. The advantage is cash flow: no large upfront licence cost. The trade-off is that the monthly price is set by Sophos and is subject to change, where a term licence locks it.

The appliance is purchased separately at $1,381. Your MSP holds the licence access.

Hardware as a Service (HWaaS)

HWaaS puts the appliance and the Xstream Protection licence on a single monthly bill with no upfront cost. It runs on a 12-month minimum commitment, paid monthly, and payments continue until the subscription ends. The hardware is owned by the MSP, in this case Nuformat, rather than by you.

At $95 a month the appliance is included, which is why it costs more than the $50 monthly licence on its own. Compare the totals below before choosing.

Licence renewals, USD

The same firewall, three ways: a cost comparison

Important on monthly pricing: the monthly licence and HWaaS rates are set by Sophos and are subject to change. Only a term licence locks your price for the period you buy. Both monthly options are billed and managed by Nuformat as your MSP.

• HWaaS is cheapest in year one at $1,140, because there is no appliance to buy upfront. Over three years it reaches $3,420, and the hardware stays with the MSP.
• Hardware plus monthly licence is the lowest three-year total at $3,361, and you own the appliance. It needs $1,381 upfront for the hardware.
• The term licence costs the most upfront but locks your price for the whole term, with no monthly increases. Over three years it is $3,977.
• The monthly options are set by Sophos and can change. Only a term licence fixes your price. Both monthly routes are billed and managed by Nuformat as your MSP.

Add-on module and transceivers for the XGS 118

The XGS 118 has nine 2.5GbE copper ports, one SFP fibre port, and a single expansion bay. That bay takes a 5G module for cellular failover, and the SFP port takes a 1GbE transceiver. Being a desktop appliance, the 118 does not have the Flexi Port module bay that the rackmount models use.

Standard or Xstream: which bundle?

• Xstream Protection adds the full threat stack: TLS 1.3 inspection, cloud sandboxing, and the advanced IPS. For any office that browses the web, this is the bundle that inspects encrypted traffic. It is the usual choice, and it costs only $200 more than Standard on a 1-year term.
• Standard Protection covers the base firewall plus SD-WAN and ZTNA, without the full threat stack. Choose it only if you have a specific reason not to inspect encrypted traffic on the firewall.

Buy the XGS 118 from Nuformat

Nuformat is a Sophos partner serving Canada and the United States, with quick shipping and setup help. We can confirm whether the 118 or 118w is right for your office and quote it outright, on a monthly licence, or as HWaaS. Contact Nuformat for a Sophos XGS 118 quote.

Frequently asked questions

What is the Sophos XGS 118 firewall throughput?

Sophos publishes 15.5 Gbps firewall throughput for the Gen 2 XGS 118, with 3.5 Gbps IPS, 3.25 Gbps Threat Protection, and 1.1 Gbps TLS inspection. Treat these as vendor-published maximums and size to your real traffic.

What is the difference between the XGS 118 and 118w?

The 118w adds a built-in Wi-Fi radio, so one appliance provides both the firewall and the office wireless. The non-w 118 has the same firewall performance without the wireless, and costs $158 less.

Should I choose the XGS 118 or the XGS 128?

The 128 has higher throughput (19.1 Gbps firewall, 1.45 Gbps TLS) for a modest price step. If your office is growing or you inspect a lot of encrypted traffic, the 128 buys headroom. For a smaller or steady office, the 118 is the better value.

Can I pay for the XGS 118 monthly?

Yes. You can own the appliance and pay $55 a month for the Xstream licence (or $48 for Standard), billed and managed by Nuformat as your MSP. The monthly price is set by Sophos and can change, unlike a term licence which locks your price.

Does the XGS 118 include cloud management?

Yes. Central management is included at no extra cost with the Standard or Xstream bundle, run from the Sophos cloud console, which is now becoming Sophos Fusion.