Sophos XGS 118 vs Fortinet, Meraki & Palo Alto (2026)

Sophos XGS 118 vs Fortinet, Meraki and Palo Alto

A like-for-like look at the Sophos XGS 118 against the FortiGate 60F, Cisco Meraki MX67/68 and Palo Alto PA-415. The XGS 118 publishes 15.5 Gbps firewall throughput, 3.25 Gbps threat protection and 1.1 Gbps of TLS inspection. Where a competitor leads, the table below says so.

One caveat before the numbers: vendors measure throughput differently, so these figures are not laboratory-equivalent. Use them to narrow the shortlist, then test on your own traffic.

Most attacks now hide inside encrypted traffic. That single fact shapes how a 50-to-100-person office should shop for a firewall, because inspecting HTTPS is the one capability the entry models split on. The Sophos XGS 118 with Xstream Protection does it natively; some of the alternatives below do not. Here is how the 118 stacks up against the closest models from Fortinet, Cisco Meraki, and Palo Alto, with USD prices you can act on.

A note before the table: the vendors measure throughput with different traffic profiles, so the raw numbers are vendor-published and not a like-for-like race. Read each vendor’s security-enabled figure and your user count instead. Prices are USD as of September 7, 2026; the Nuformat figure includes a year of security, the others are hardware alone.

Sophos XGS 118 and its rivals at a glance

Vendor-published figures (sophos.com, fortinet.com, documentation.meraki.com, paloaltonetworks.com). USD, checked September 7, 2026.

Where the 118 earns its price

The XGS 118 sits near the top of the Sophos Gen 2 desktop range. Buy it with Xstream Protection and you get TLS 1.3 inspection, a cloud sandbox for zero-day files, IPS, and web and application control, all run from one console. The number that matters for a small office is the TLS inspection figure: 1.1 Gbps, and it happens on the box without a bolt-on. That is the gap to keep in mind as you read the rest.

The three alternatives, on their own terms

FortiGate 60F. This is the natural cross-shop. Fortinet bundles its security the way Sophos does, centralizes management in the cloud, and throws in native SD-WAN. Nuformat stocks it, so you can put a 60F and a 118 in the same quote and compare real totals. Its SSL inspection lands lower than the 118 on paper, by Fortinet’s own measurement.

Cisco Meraki MX67 or MX68. If you love the idea of running everything from a browser dashboard, Meraki is built for that. Two caveats decide it, though. The Meraki license is not optional and it recurs every year on top of the hardware, so that tempting $548 sticker is only the down payment. And the MX does not inspect HTTPS on its own at this tier; you would reach for the Umbrella extension or a third party. For an office that wants encrypted-traffic inspection in the box, that is a real gap.

Palo Alto PA-415. Palo Alto packs its application-aware engine into a desktop unit and manages it through Panorama. Its throughput is quoted with an application mix, which reads low next to Sophos’s UDP numbers even where the two would feel similar. Security is licensed service by service and the whole thing is quote-priced, so the hardware tag tells you little about the final bill.

So which one?

• Need HTTPS inspection and a single price you can budget: the XGS 118 at $1,589.98 is the straightforward pick.
• Want SD-WAN and a matching switch-and-Wi-Fi stack, quoted through the same shop: look at the FortiGate 60F.
• Set on dashboard-only management and fine with a yearly license: Meraki MX67/68, as long as you accept that TLS inspection is not native.
• Already a Palo Alto shop with the staff to run it: the PA-415.

Questions buyers actually ask

Does the XGS 118 inspect HTTPS by itself?

Yes. With Xstream Protection it runs TLS 1.3 inspection natively, rated at 1.1 Gbps. Cisco Meraki does not do this on the box at this tier.

What does the XGS 118 cost in USD?

$1,589.98 at Nuformat for the appliance plus a one-year Xstream subscription, as of September 7, 2026. Terms and region change the figure, so ask for a quote.

Is the lowest hardware price the lowest firewall price?

Rarely. Meraki and Palo Alto list hardware without the recurring security subscription they require. Add security for a year, then compare.

Which of these can I buy from Nuformat?

Sophos and Fortinet, so those two can share a quote. Meraki and Palo Alto appear here only for the comparison.

Three ways to buy a Sophos XGS firewall

Sophos now sells the XGS and its Xstream Protection in more than one way, which is worth weighing before you commit:

• Buy outright, term license. Purchase the appliance with a 1, 3, or 5-year Xstream Protection subscription paid upfront, and own the hardware. The 12-month Xstream figure quoted here is this option.
• Own the hardware, license monthly (MSP Flex). Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing instead of a multi-year term upfront. Billing is monthly, in arrears based on usage.
• Hardware as a Service (HWaaS). Launched July 1, 2026 for MSPs in the US and Canada, HWaaS combines the appliance, standard shipping, and Xstream Protection into a single monthly price billed through MSP Flex. It carries a mandatory 12-month initial term, then continues month to month, on select XGS models.

MSP Flex and HWaaS are delivered through a Sophos MSP partner. Ask Nuformat which fits your budgeting.

Get a quote

Drop the Sophos XGS 118 with Xstream Protection in your cart for a quote, or ask Nuformat to sanity-check the size for your office. Canada and the USA. Contact us.

Sources

• Sophos XGS datasheet and licensing: sophos.com
• Fortinet FortiGate 60F datasheet: fortinet.com
• Cisco Meraki MX67/MX68 datasheet: documentation.meraki.com
• Palo Alto PA-400 datasheet: paloaltonetworks.com
• Sophos XGS 118 (Xstream, 1-year) at Nuformat