Sophos XGS 138 Firewall Buying Guide (2026)
Posted by Saif Khan on 2026 Sep 10th
Sophos XGS 138 buying guide: what it is, what it costs, and how to buy
The Sophos XGS 138 is the top of the Sophos desktop range, and the only desktop model with two SFP+ fibre ports that run at 10 Gigabit plus built-in PoE. It delivers 18.1 Gbps firewall throughput, 4.75 Gbps threat protection, and 1.7 Gbps of TLS inspection. In USD, the appliance with a 1-year Xstream Protection subscription is $4,187, or $11,446 over five years, which works out to about $191 a month. You can also own the appliance at $2,373 and pay $108 a month for the Xstream licence, or take it all on Hardware as a Service at $155 a month. Buy the 138 if you need 10G uplinks, PoE, or the extra inspection headroom over the XGS 128.
Most small offices are well served by the XGS 118 or XGS 128. The 138 exists for the offices that are not: the ones with a fibre uplink to a core switch, a couple of access points to power, or enough encrypted traffic that 1.45 Gbps of TLS inspection is starting to feel tight. Here is what it does, what it costs, and when it is worth the step up.
What makes the 138 different from the rest of the desktop range
Three things, and they are the reason to buy it:
- Two SFP+ fibre ports at 10 Gigabit. No other Sophos desktop model has these. They let the firewall sit on a 10G fibre link, whether that is an uplink to a CS1010-8FP core switch, a fast fibre internet service, or a link to a second site.
- Built-in PoE on two ports. Two of the 2.5 GE copper ports supply Power over Ethernet at up to 30W each, enough to run a couple of access points or IP cameras directly from the firewall without a separate PoE switch.
- The most inspection headroom in the desktop range. 1.7 Gbps of TLS inspection and 4.75 Gbps of threat protection, against 1.45 and 4.0 on the 128.
If none of those three matter to you, the 128 does the same job for about $1,160 less. That is a real saving, and we would rather tell you than sell you the bigger box.
Performance: the numbers that matter
Sophos-published figures for the Gen 2 XGS 138. Treat throughput as vendor-measured under set conditions and size to your real traffic.
| Metric | Sophos XGS 138 |
|---|---|
| Firewall throughput | 18.1 Gbps |
| Firewall IMIX | 10.5 Gbps |
| IPS throughput | 5.85 Gbps |
| Threat protection throughput | 4.75 Gbps |
| NGFW throughput | 5.1 Gbps |
| TLS (SSL) inspection | 1.7 Gbps |
| IPsec VPN throughput | 6.6 Gbps |
| Concurrent connections | 6,350,000 |
| New connections per second | 105,000 |
| Storage | 64 GB M.2 |
Ports
| Interface | Count |
|---|---|
| GE copper | 4 |
| 2.5 GE copper | 2 |
| SFP+ fibre (10G) | 2 |
| Power over Ethernet | 2 x 2.5 GE, 30W max per port |
| Management | 1 x COM RJ45, 1 x Micro-USB |
Note that the SFP+ ports need transceivers, which are bought separately: $1,078 for short range, $1,407 for long range.
XGS 128 or XGS 138?
This is the decision most buyers are actually making, so here it is side by side.
| XGS 128 | XGS 138 | |
|---|---|---|
| Firewall throughput | 19.1 Gbps | 18.1 Gbps |
| Threat protection | 4.0 Gbps | 4.75 Gbps |
| TLS inspection | 1.45 Gbps | 1.7 Gbps |
| 10G SFP+ ports | None | 2 |
| Built-in PoE | No | 2 ports, 30W each |
| Built-in Wi-Fi option | Yes, 128w | No |
| Xstream 1-year | $3,027 | $4,187 |
The firewall throughput line looks odd at first: the 128 is marginally higher. That figure is measured with large UDP packets and is not the number that limits a real network. The lines that matter are threat protection and TLS inspection, where the 138 is ahead, and the port layout, where it is not close.
One trade-off worth knowing: there is no 138w. If you want Wi-Fi built into the firewall, that is the 128w. If you want the 138 and wireless, pair it with a Sophos access point, which the 138 can power over its PoE ports.
How to buy the XGS 138 in 2026
Buy outright (term licence), USD
All prices in USD, current at time of writing. The appliance and licence come together in each bundle.
| Product and licence | Price | Effective per month |
|---|---|---|
| XGS 138 appliance only | $2,373 | Base licence |
| XGS 138, Standard Protection, 1 year | $3,769 | ~$314/mo |
| XGS 138, Standard Protection, 3 years | $6,562 | ~$182/mo |
| XGS 138, Standard Protection, 5 years | $9,355 | ~$156/mo |
| XGS 138, Xstream Protection, 1 year | $4,187 | ~$349/mo |
| XGS 138, Xstream Protection, 3 years | $7,817 | ~$217/mo |
| XGS 138, Xstream Protection, 5 years | $11,446 | ~$191/mo |
Buying outright on a term licence is the only option that locks your price for the whole term, with no monthly increases. A 3 or 5-year term also brings the effective monthly cost down sharply, from $349 to $191.
Monthly licence (own the hardware, licence monthly)
Buy the appliance at $2,373, then pay for the licence month to month, billed and managed by Nuformat as your MSP through Sophos MSP Flex. The advantage is cash flow: no large upfront licence cost. The trade-off is that the monthly price is set by Sophos and is subject to change, where a term licence locks it.
| Monthly licence (month to month, USD) | Price per month |
|---|---|
| XGS 138 Standard licence | $82/mo |
| XGS 138 Xstream licence | $108/mo |
Hardware as a Service (HWaaS)
HWaaS puts the appliance and the Xstream Protection licence on a single monthly bill with no upfront cost. It runs on a 12-month minimum commitment, paid monthly, and payments continue until the subscription ends. The hardware is owned by the MSP, in this case Nuformat, rather than by you.
| HWaaS (all-in monthly, USD) | Price per month |
|---|---|
| XGS 138 with Xstream Protection, HWaaS (12-month minimum) | $155/mo |
At $155 a month the appliance is included, which is why it costs more than the $108 monthly licence on its own. Compare the totals below before choosing.
Licence renewals, USD
| Renewal | Price |
|---|---|
| Xstream licence, 1-year renewal | $1,815 |
| Xstream licence, 3-year renewal | $5,444 |
The same firewall, three ways: a cost comparison
Important on monthly pricing: the monthly licence and HWaaS rates are set by Sophos and are subject to change. Only a term licence locks your price. Both monthly options are billed and managed by Nuformat as your MSP.
| Model (Xstream) | Upfront | Monthly | You own the hardware | Cost over 1 year | Cost over 3 years |
|---|---|---|---|---|---|
| Term licence (buy outright) | $4,187 (1-yr) / $7,817 (3-yr) | None | Yes | $4,187 | $7,817 |
| Hardware plus monthly licence | $2,373 (appliance) | $108/mo | Yes | $3,669 | $6,261 |
| Hardware as a Service (HWaaS) | $0 | $155/mo | No, the MSP owns it | $1,860 | $5,580 |
- HWaaS is the cheapest route on both horizons, at $1,860 in year one and $5,580 over three years, because there is no appliance to buy. The hardware stays with the MSP.
- Hardware plus monthly licence costs $3,669 in year one and $6,261 over three, and you own the appliance outright at the end.
- The term licence is the most expensive over three years at $7,817, but it is the only option that fixes your price for the whole term.
- The monthly options are set by Sophos and can change. Only a term licence locks your price. Both monthly routes are billed and managed by Nuformat as your MSP.
Add-ons for the XGS 138
The 138 is a desktop appliance, so it does not take the Flexi Port expansion modules used by the rackmount models. Its add-ons are the 5G module and SFP+ transceivers.
| Add-on | What it adds | Price (USD) |
|---|---|---|
| 5G module (118w, 128w, 138) | Cellular WAN failover so the site stays online if the main link drops | $1,126 |
| 10GbE transceiver, short range | 10GBASE-SR multi-mode fibre for the SFP+ ports | $1,078 |
| 10GbE transceiver, long range | 10GBASE-LR single-mode fibre for longer runs | $1,407 |
Standard or Xstream: which bundle?
- Xstream Protection adds the full threat stack: TLS 1.3 inspection, cloud sandboxing, and the advanced IPS. For any office that browses the web, this is the bundle that inspects encrypted traffic. It costs $418 more than Standard on a 1-year term, which is modest for what it adds.
- Standard Protection covers the base firewall plus SD-WAN and ZTNA, without the full threat stack. Choose it only if you have a specific reason not to inspect encrypted traffic on the firewall.
Buy the XGS 138 from Nuformat
Nuformat is a Sophos partner serving Canada and the United States, with quick shipping and setup help. Tell us whether you need the 10G uplinks and PoE, and we will confirm whether the 138 or the 128 is the right call, then quote it outright, on a monthly licence, or as HWaaS. Contact Nuformat for a Sophos XGS 138 quote.
Frequently asked questions
What is the Sophos XGS 138 firewall throughput?
Sophos publishes 18.1 Gbps firewall throughput for the XGS 138, with 5.85 Gbps IPS, 4.75 Gbps threat protection, and 1.7 Gbps TLS inspection. Concurrent connections are 6,350,000. Treat these as vendor-published maximums and size to your real traffic.
Does the Sophos XGS 138 have 10GbE ports?
Yes. It has two SFP+ fibre ports that run at 10 Gigabit, which no other Sophos desktop model offers. They need transceivers, bought separately at $1,078 short range or $1,407 long range.
Does the XGS 138 have PoE?
Yes. Two of its 2.5 GE copper ports supply Power over Ethernet at up to 30W each, enough for a couple of access points or IP cameras without a separate PoE switch.
Should I choose the XGS 128 or the XGS 138?
Choose the 138 if you need 10G SFP+ uplinks, built-in PoE, or the extra inspection headroom (1.7 Gbps TLS against 1.45). Otherwise the 128 does the same job for about $1,160 less. If you want Wi-Fi built into the firewall, that is the 128w, since there is no 138w.
Is there a Sophos XGS 138w with Wi-Fi?
No. The 138 has no wireless variant. For built-in Wi-Fi choose the XGS 128w, or pair a 138 with a Sophos access point, which the firewall can power over its PoE ports.
Can I pay for the XGS 138 monthly?
Yes. You can own the appliance at $2,373 and pay $108 a month for the Xstream licence, or $82 for Standard, billed and managed by Nuformat as your MSP. The monthly price is set by Sophos and can change, unlike a term licence which locks your price.
Is the XGS 138 the replacement for the XGS 136?
Yes. The XGS 136 reached end of sale on April 14, 2025 and reaches end of life on September 30, 2030. The 138 is its direct Gen 2 replacement. Note that the 136w has no 138w equivalent, so wireless sites move to the 128w or add a separate access point.