Sophos XGS 128 vs Fortinet, Meraki, Palo Alto

When a small office grows past the entry firewalls, the questions change. It is less about whether the box can keep up and more about headroom, more users behind it, more encrypted traffic to inspect, more sites to link. The Sophos XGS 128 with Xstream Protection is built for that step up, and this guide sets it beside the closest models from Fortinet, Cisco Meraki, and Palo Alto, priced in USD.

Keep one thing in mind throughout. Vendors do not measure throughput the same way, so the figures below are each vendor’s own published numbers and cannot be ranked directly. What is comparable is intent: all four target a busier small business, and all four differ on how security is licensed and managed.

How does the Sophos XGS 128 compare?

The Sophos XGS 128 is a compact desktop firewall for small offices, with 19.1 Gbps firewall throughput and 1.45 Gbps of native TLS inspection. Against the nearest units: the FortiGate 80F is a capable rival backed by the Fortinet fabric; the Cisco Meraki MX75 is cloud-managed but does not inspect HTTPS natively at this tier; the Palo Alto PA-450 posts strong threat-prevention numbers but needs Panorama and per-service licensing. The 128’s case is native TLS inspection, one bundled Xstream license, and cloud management. Nuformat quotes the Sophos and Fortinet options for Canada and the USA.

The four models, side by side

Vendor-published figures (sophos.com, fortinet.com, documentation.meraki.com, paloaltonetworks.com). USD, checked September 7, 2026. Nuformat prices include a year of security; competitor prices are hardware only.

Why step up to the 128

Compared with the 118 below it, the 128 gives you more inspected throughput and a higher TLS ceiling, 1.45 Gbps, while keeping the built-in Wi-Fi option (128w) and the same cloud console. For an office pushing more encrypted traffic through the perimeter, that extra inspection headroom is the reason to move up a model rather than a marketing line. Everything else in the Xstream bundle, the sandbox, IPS, and web and app control, comes along unchanged.

How the alternatives line up

FortiGate 80F. Again the closest cross-shop, and again quotable through Nuformat alongside the Sophos. The 80F carries a strong VPN figure and native SD-WAN, and its SSL inspection (715 Mbps) is respectable, though it still trails the 128’s TLS figure by each vendor’s method. If a switch-and-Wi-Fi fabric is on your roadmap, Fortinet’s Security Fabric is a point in its favour.

Cisco Meraki MX75. The MX75 moves Meraki into 200-user territory and keeps the dashboard-first approach that makes it easy to run without a specialist. The trade-offs from the entry tier still apply: a recurring license is required, and HTTPS inspection is not something the MX does natively. Budget for the license, and plan around the inspection gap if encrypted traffic is a concern.

Palo Alto PA-450. A genuine step up in Palo Alto’s desktop line, with more sessions and throughput than the 415. It suits a business that has chosen Palo Alto’s platform and has the operational depth for Panorama and per-service licensing. As always with Palo Alto, the real cost arrives by quote, not by hardware sticker.

Best fit

• Busier office that wants native TLS inspection and one bundled price: the XGS 128 at $2,424.74.
• Same office that also wants SD-WAN and a Fortinet fabric, on one quote: the FortiGate 80F.
• Growing team committed to cloud-dashboard management: Meraki MX75, license and inspection caveats included.
• Palo Alto shop scaling up: the PA-450.

Common questions

What is the difference between the XGS 118 and 128?

The 128 offers higher inspected throughput and a higher TLS inspection ceiling (1.45 Gbps versus 1.1 Gbps), while both keep a Wi-Fi option and the same security bundle. Choose the 128 when your encrypted-traffic load justifies the headroom.

How much is the XGS 128 in USD?

$2,424.74 at Nuformat with a one-year Xstream subscription, as of September 7, 2026. Ask for a quote for other terms or Canadian pricing.

Does Cisco Meraki MX75 inspect HTTPS?

Not natively at this tier. It relies on the Umbrella SD-WAN extension or a third party, whereas the XGS 128 inspects TLS on the appliance.

Which can Nuformat quote?

Sophos and Fortinet. Meraki and Palo Alto are here for comparison only.

Three ways to buy a Sophos XGS firewall

Sophos now sells the XGS and its Xstream Protection in more than one way, which is worth weighing before you commit:

• Buy outright, term license. Purchase the appliance with a 1, 3, or 5-year Xstream Protection subscription paid upfront, and own the hardware. The 12-month Xstream figure quoted here is this option.
• Own the hardware, license monthly (MSP Flex). Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing instead of a multi-year term upfront. Billing is monthly, in arrears based on usage.
• Hardware as a Service (HWaaS). Launched July 1, 2026 for MSPs in the US and Canada, HWaaS combines the appliance, standard shipping, and Xstream Protection into a single monthly price billed through MSP Flex. It carries a mandatory 12-month initial term, then continues month to month, on select XGS models.

MSP Flex and HWaaS are delivered through a Sophos MSP partner. Ask Nuformat which fits your budgeting.

Get a quote

Add the Sophos XGS 128 with Xstream Protection to your cart for a quote, or have Nuformat confirm the sizing. Serving Canada and the USA. Contact us.

Sources

• Sophos XGS datasheet and licensing: sophos.com
• Fortinet FortiGate 80F datasheet: fortinet.com
• Cisco Meraki MX75 datasheet: documentation.meraki.com
• Palo Alto PA-400 datasheet: paloaltonetworks.com
• Sophos XGS 128 (Xstream, 1-year) at Nuformat