Sophos XGS 128 Firewall Buying Guide (2026)
Posted by Saif Khan on 2026 Sep 8th
Sophos XGS 128 buying guide: what it is, what it costs, and how to buy
The Sophos XGS 128 is a compact desktop next-generation firewall for small offices, with 19.1 Gbps firewall throughput and 1.45 Gbps of native TLS inspection, managed from the Sophos cloud console (now evolving to Sophos Fusion). The 128w variant adds built-in Wi-Fi 6. It is bought outright with Xstream or Standard Protection: in USD, the appliance with a 1-year Xstream subscription is $2,424.74, dropping to an effective $95 a month over a 5-year term. You can also pay monthly: an Xstream license at $90 a month (managed by Nuformat as your MSP), or Hardware as a Service at $150 a month all-in on a 12-month minimum, where Nuformat owns the hardware. Monthly pricing is set by Sophos and can change; a term license locks your price. Buy Xstream if you want to inspect encrypted traffic on the box; buy Standard for the base firewall.
A small office needs real security, but it does not need a rack, a noisy appliance, or an enterprise budget to get it. The Sophos XGS 128 is built for exactly that: a compact desktop firewall with enterprise-grade inspection, an optional built-in Wi-Fi 6 radio, and one cloud console to run it from. Here is what it does, how it performs, and what it costs in 2026.
Why the XGS 128 suits a small office
The 128 sits at the top of the Sophos XGS desktop range, the Gen 2 models built for small offices and branch sites. It runs the same Sophos Firewall operating system and the same Xstream architecture as the rackmount models, so a small team gets the same inspection engine and the same management experience as a much larger site, in a quiet desktop unit that fits on a shelf. The 128w version has Wi-Fi 6 built in, so one device can cover the perimeter and the office Wi-Fi. Everything is managed from the Sophos cloud console, which is included at no extra cost and is now evolving into Sophos Fusion. For an office with little or no dedicated IT, that single console is often what makes it manageable.
The protection you get with Xstream Protection
The Xstream Protection bundle turns the 128 into a full next-generation firewall, not a basic one:
- TLS 1.3 inspection. Most malware now hides in encrypted traffic. The 128 decrypts and inspects it on the box, at up to 1.45 Gbps, closing a blind spot that trips up many small-office firewalls.
- Deep packet inspection and next-gen IPS. Streaming inspection scans traffic for known attacks and exploits before they reach a device.
- Zero-Day Protection. Suspicious files are checked by machine learning and a cloud sandbox through SophosLabs Intelix, catching threats that signatures miss.
- Web and application control. Filter web access and control which applications are allowed, to keep a small network productive and safer.
- SD-WAN and VPN. Link a second site or remote workers with built-in SD-WAN and VPN.
- Cloud management, included. Run it all from the Sophos console at no extra cost, with scheduled firmware updates and zero-touch deployment.
Performance: the numbers that matter
These are Sophos-published figures for the Gen 2 XGS 128. Treat throughput as vendor-measured under set conditions, and size to your real traffic.
| Metric | Sophos XGS 128 (published) |
|---|---|
| Firewall throughput | 19.1 Gbps |
| IPS throughput | 4.65 Gbps |
| Threat Protection throughput | 4.0 Gbps |
| TLS (SSL) inspection | 1.45 Gbps |
| IPsec VPN throughput | 15.05 Gbps |
| Concurrent connections | 6 million |
| Wireless | Wi-Fi 6 on the 128w variant |
| Form factor | Compact desktop |
For a small office, the number to note is the 1.45 Gbps of TLS inspection: it means the 128 can actually look inside encrypted traffic at the speeds a small network runs at, rather than waving it through.
How to buy the XGS 128 in 2026
The 128 is most often bought outright, appliance plus a term license, and there is also a monthly license option managed by Nuformat.
Buy outright (term license), USD
All prices below are in USD, current at time of writing. The appliance and the license come together in each bundle. Ask Nuformat for the latest quote.
| Product and license | Price | Effective per month over term |
|---|---|---|
| XGS 128w, Standard Protection, 1 year | $2,236.96 | ~$186/mo |
| XGS 128w, Standard Protection, 3 years | $3,492.38 | ~$97/mo |
| XGS 128w, Standard Protection, 5 years | $4,746.98 | ~$79/mo |
| XGS 128w, Xstream Protection, 1 year | $2,424.74 | ~$202/mo |
| XGS 128w, Xstream Protection, 3 years | $4,054.90 | ~$113/mo |
| XGS 128w, Xstream Protection, 5 years | $5,685.06 | ~$95/mo |
The big advantage of buying outright on a term license is that your price is locked for the whole term, with no monthly increases, and you own the hardware. A 3 or 5-year term also brings the effective monthly cost right down.
Monthly license (own the hardware, license monthly)
Prefer to avoid a large upfront outlay? You can own the appliance and pay for the license month to month, billed and managed by Nuformat as your MSP through Sophos MSP Flex. The advantage is cash flow: no big CAPEX to get protected. The trade-off is that the monthly license price is set by Sophos and is subject to change, where a term license locks it.
| Monthly license (month to month, USD) | Price per month |
|---|---|
| XGS 128 Standard license | $60/mo |
| XGS 128 Xstream license | $90/mo |
The appliance is purchased separately (available on request). Ask Nuformat for a monthly quote.
Hardware as a Service (HWaaS)
The XGS 128 with Xstream Protection is available on HWaaS: the appliance and the subscription on one monthly price, with no upfront cost. It runs on a 12-month minimum commitment and then continues month to month until you cancel. Nuformat Cyber Shop owns the hardware as your MSP; if you cancel, the device is returned to Nuformat. As with the monthly license, the price is set by Sophos and is not fixed long-term.
| HWaaS (all-in monthly, USD) | Price per month |
|---|---|
| XGS 128 with Xstream Protection, HWaaS (12-month minimum) | $150/mo |
License renewals, USD
| Renewal | Price |
|---|---|
| Xstream license, 1-year renewal | $815.08 |
| Xstream license, 3-year renewal | $2,445.24 |
| Standard license renewal | Contact for quote |
Important on monthly pricing: the monthly license and HWaaS rates are set by Sophos and are subject to change. Only a term license locks your price for the period you buy. Both monthly options are billed and managed by Nuformat as your MSP.
The same firewall, three ways: a cost comparison
Here is the same XGS 128 with Xstream Protection bought three ways. The term figure is a current store price; HWaaS is a fixed monthly rate; the hardware-plus-monthly row shows the appliance (quoted separately) plus the monthly license.
| Model (Xstream) | Upfront | Monthly | You own the hardware | Cost over 1 year | Cost over 3 years |
|---|---|---|---|---|---|
| Term license (buy outright) | $2,424.74 (1-yr) / $4,054.90 (3-yr) | None | Yes | $2,424.74 | $4,054.90 |
| Hardware plus monthly license | Appliance (on request) | $90/mo | Yes | Appliance + $1,080 | Appliance + $3,240 |
| Hardware as a Service (HWaaS) | $0 | $150/mo | No, Nuformat owns it | $1,800 | $5,400 |
- HWaaS is the lowest cost in year one at $1,800, because you are not paying for hardware you own; Nuformat owns it, and you can cancel after 12 months and return the device.
- The term license costs more in year one ($2,424.74) but you own the hardware and your price is locked. Over three years, at $4,054.90, it is the lowest total here.
- Hardware plus monthly license frees you from the upfront license cost while you still own the box, at $90 a month managed by Nuformat, with the monthly rate set by Sophos and able to change.
Standard or Xstream: which bundle?
- Xstream Protection adds the full threat stack: TLS 1.3 inspection, cloud sandboxing, and the advanced IPS. For any office that browses the web (which is nearly all of them), this is the bundle that inspects encrypted traffic. It is the usual choice.
- Standard Protection covers the base firewall plus features like SD-WAN and ZTNA, without the full threat stack. Choose it only if you have a specific reason not to inspect encrypted traffic on the firewall.
Add-on module and transceivers for the XGS 128
The XGS 128 has nine 2.5GbE copper ports, one SFP fibre port, and a single expansion bay. That bay takes a 5G module for cellular failover, and the SFP port takes a 1GbE transceiver. Being a desktop appliance, the 128 does not have the Flexi Port module bay that the rackmount models use, so the multi-port Flexi Port expansion modules do not apply here. Prices are in USD.
Expansion module
| Module | Adds | Price (USD) |
|---|---|---|
| 5G module (for XGS 118w, 128w, 138w) | Cellular (5G) WAN failover, so the office stays online if the main link drops | $797.86 |
Transceivers for the SFP port
The 128 has one 1GbE SFP fibre port. These 1GbE transceivers fit it. The 10GbE SFP+ transceivers used by the 138 and the rackmount models do not, since the 128 SFP port is 1G.
| Transceiver (1GbE SFP) | Price (USD) |
|---|---|
| 1GbE copper (1000BASE-T) | $359.16 |
| 1GbE fibre short range (1000BASE-SX) | $231.24 |
| 1GbE fibre long range (1000BASE-LX) | $615.00 |
If you need more ports than the 128 offers, or 10GbE, PoE, or Flexi Port expansion, that calls for a rackmount model such as the XGS 2100 or 2300. Ask Nuformat and we will size it.
Buy the XGS 128 from Nuformat
Nuformat is a Sophos partner serving Canada and the United States, with quick shipping and setup help. We can confirm whether the 128 or 128w is the right fit for your office and quote it outright or on a monthly license. Contact Nuformat for a Sophos XGS 128 quote.
Frequently asked questions
What is the Sophos XGS 128 firewall throughput?
Sophos publishes 19.1 Gbps firewall throughput for the Gen 2 XGS 128, with 4.65 Gbps IPS, 4.0 Gbps Threat Protection, and 1.45 Gbps TLS inspection. Treat these as vendor-published maximums and size to your real traffic.
What is the difference between the XGS 128 and 128w?
The 128w adds a built-in Wi-Fi 6 radio, so one appliance can provide both the firewall and the office Wi-Fi. The non-w 128 has the same firewall performance without the wireless.
Does the XGS 128 include cloud management?
Yes. Central management is included at no extra cost with the Standard or Xstream bundle, run from the Sophos cloud console (Sophos Central, now evolving to Sophos Fusion).
Can I pay for the XGS 128 monthly?
Yes. You can own the appliance and pay for the license month to month, billed and managed by Nuformat as your MSP. For the XGS 128 with Xstream, the monthly license is $90 a month (you buy the appliance separately) or HWaaS is $150 a month all-in on a 12-month minimum, with Nuformat owning the hardware. The monthly price is set by Sophos and can change, unlike a term license which locks your price. All prices USD.
Is the XGS 128 sold in Canada and the USA?
Yes. Nuformat sizes, quotes, and supports the Sophos XGS 128 for businesses across Canada and the United States.