Sophos XGS 138 Buying Guide (2026)
Posted by Saif Khan on 2026 Sep 10th
Sophos XGS 138 buying guide: what it is, what it costs, and how to buy
The Sophos XGS 138 is the top of the Sophos desktop range, and the only desktop model with two SFP+ fibre ports that run at 10 Gigabit plus built-in PoE. It delivers 18.1 Gbps firewall throughput, 4.75 Gbps threat protection, and 1.7 Gbps of TLS inspection. In USD, the appliance with a 1-year Xstream Protection subscription and the longer terms are priced on their product pages. You can also own the appliance at the price on its product page and pay $108 a month for the Xstream license, or take it all on Hardware as a Service at $155 a month. Buy the 138 if you need 10G uplinks, PoE, or the extra inspection headroom over the XGS 128.
Most small offices are well served by the XGS 118 or XGS 128. The 138 exists for the offices that are not: the ones with a fibre uplink to a core switch, a couple of access points to power, or enough encrypted traffic that 1.45 Gbps of TLS inspection is starting to feel tight. Here is what it does, what it costs, and when it is worth the step up.
What makes the 138 different from the rest of the desktop range
Three things, and they are the reason to buy it:
- Two SFP+ fibre ports at 10 Gigabit. No other Sophos desktop model has these. They let the firewall sit on a 10G fibre link, whether that is an uplink to a CS1010-8FP core switch, a fast fibre internet service, or a link to a second site.
- Built-in PoE on two ports. Two of the 2.5 GE copper ports supply Power over Ethernet at up to 30W each, enough to run a couple of access points or IP cameras directly from the firewall without a separate PoE switch.
- The most inspection headroom in the desktop range. 1.7 Gbps of TLS inspection and 4.75 Gbps of threat protection, against 1.45 and 4.0 on the 128.
If none of those three matter to you, the 128 does the same job for about $822 less. That is a real saving, and we would rather tell you than sell you the bigger box.
Performance: the numbers that matter
Sophos-published figures for the Gen 2 XGS 138. Treat throughput as vendor-measured under set conditions and size to your real traffic.
| Metric | Sophos XGS 138 |
|---|---|
| Firewall throughput | 18.1 Gbps |
| Firewall IMIX | 10.5 Gbps |
| IPS throughput | 5.85 Gbps |
| Threat protection throughput | 4.75 Gbps |
| NGFW throughput | 5.1 Gbps |
| TLS (SSL) inspection | 1.7 Gbps |
| IPsec VPN throughput | 6.6 Gbps |
| Concurrent connections | 6,350,000 |
| New connections per second | 105,000 |
| Storage | 64 GB M.2 |
Ports
| Interface | Count |
|---|---|
| GE copper | 4 |
| 2.5 GE copper | 2 |
| SFP+ fibre (10G) | 2 |
| Power over Ethernet | 2 x 2.5 GE, 30W max per port |
| Management | 1 x COM RJ45, 1 x Micro-USB |
Note that the SFP+ ports need transceivers, which are bought separately, priced on their product pages.
XGS 128 or XGS 138?
This is the decision most buyers are actually making, so here it is side by side.
| XGS 128 | XGS 138 | |
|---|---|---|
| Firewall throughput | 19.1 Gbps | 18.1 Gbps |
| Threat protection | 4.0 Gbps | 4.75 Gbps |
| TLS inspection | 1.45 Gbps | 1.7 Gbps |
| 10G SFP+ ports | None | 2 |
| Built-in PoE | No | 2 ports, 30W each |
| Built-in Wi-Fi option | Yes, 128w | No |
| Xstream 1-year | See price | See price |
The firewall throughput line looks odd at first: the 128 is marginally higher. That figure is measured with large UDP packets and is not the number that limits a real network. The lines that matter are threat protection and TLS inspection, where the 138 is ahead, and the port layout, where it is not close.
One trade-off worth knowing: there is no 138w. If you want Wi-Fi built into the firewall, that is the 128w. If you want the 138 and wireless, pair it with a Sophos access point, which the 138 can power over its PoE ports.
Where the XGS 138 sits in the range
Every desktop model, with the 138 highlighted.
| Model | FirewallMbps | IPSMbps | Threat prot.Mbps | TLSMbps | Price1-yr Xstream |
|---|---|---|---|---|---|
| XGS 88 | 9,900 | 2,000 | 2,000 | 600 | See price |
| XGS 108 | 12,500 | 2,500 | 2,500 | 800 | See price |
| XGS 118 | 15,500 | 3,500 | 3,250 | 1,100 | See price |
| XGS 128 | 19,100 | 4,650 | 4,000 | 1,450 | See price |
| XGS 138 you are here | 19,100 | 5,850 | 4,750 | 1,700 | See price |
Every model links to its product page, where the current price is shown. If the next model up is worth the difference for your site, buy that one instead. Size on the TLS column rather than firewall throughput, since almost all web traffic is encrypted.
How to buy the XGS 138 in 2026
Buy outright (term license), USD
All prices in USD, current at time of writing. The appliance and license come together in each bundle.
| Product and license | Price | Effective per month |
|---|---|---|
| XGS 138 appliance only | See price | Base license |
| XGS 138, Standard Protection, 1 year | See price | ~$222/mo |
| XGS 138, Standard Protection, 3 years | See price | ~$129/mo |
| XGS 138, Standard Protection, 5 years | See price | ~$110/mo |
| XGS 138, Xstream Protection, 1 year | See price | ~$247/mo |
| XGS 138, Xstream Protection, 3 years | See price | ~$154/mo |
| XGS 138, Xstream Protection, 5 years | See price | ~$135/mo |
Buying outright on a term license is the only option that locks your price for the whole term, with no monthly increases. A 3 or 5-year term also brings the effective monthly cost down sharply, from $349 to $191.
Monthly license (own the hardware, license monthly)
Buy the appliance at the price on its product page then pay for the license month to month, billed and managed by Nuformat as your MSP through Sophos MSP Flex. The advantage is cash flow: no large upfront license cost. The trade-off is that the monthly price is set by Sophos and is subject to change, where a term license locks it.
| Monthly license (month to month, USD) | Price per month |
|---|---|
| XGS 138 Standard license | $82/mo |
| XGS 138 Xstream license | $108/mo |
Hardware as a Service (HWaaS)
HWaaS puts the appliance and the Xstream Protection license on a single monthly bill with no upfront cost. It runs on a 12-month minimum commitment, paid monthly, and payments continue until the subscription ends. The hardware is owned by the MSP, in this case Nuformat, rather than by you.
| HWaaS (all-in monthly, USD) | Price per month |
|---|---|
| XGS 138 with Xstream Protection, HWaaS (12-month minimum) | $155/mo |
At $155 a month the appliance is included, which is why it costs more than the $108 monthly license on its own. Compare the totals below before choosing.
License renewals, USD
| Renewal | Price |
|---|---|
| Xstream license, 1-year renewal | See price |
| Xstream license, 3-year renewal | See price |
The same firewall, three ways: a cost comparison
Important on monthly pricing: the monthly license and HWaaS rates are set by Sophos and are subject to change. Only a term license locks your price. Both monthly options are billed and managed by Nuformat as your MSP.
| Route (Xstream) | Upfront | Monthly | You own the hardware | Cost over 1 year | Cost over 3 years |
|---|---|---|---|---|---|
| Term license (buy outright) | See current price | None | Yes | Price locked for the term you buy | |
| Hardware plus monthly license | Appliance price | $108/mo | Yes | Appliance + $1,296 | Appliance + $3,888 |
| Hardware as a Service (HWaaS) | $0 | $155/mo | No, the MSP owns it | $1,860 | $5,580 |
- HWaaS is cheapest in year one because there is no appliance to buy. The hardware stays with the MSP and the payments are perpetual.
- Hardware plus monthly license spreads the cost monthly and leaves you owning the appliance at the end.
- The term license is listed on the product page for year one and the price on its product page over three, the lowest three-year total, and it is the only option that fixes your price.
- All three land within $50 of each other over three years. At this model the decision is about cash flow and ownership, not total cost.
Add-ons for the XGS 138
The 138 is a desktop appliance, so it does not take the Flexi Port expansion modules used by the rackmount models. Its add-ons are the 5G module and SFP+ transceivers.
| Add-on | What it adds | Price (USD) |
|---|---|---|
| 5G module (118w, 128w, 138) | Cellular WAN failover so the site stays online if the main link drops | See price |
| 10GbE transceiver, short range | 10GBASE-SR multi-mode fibre for the SFP+ ports | See price |
| 10GbE transceiver, long range | 10GBASE-LR single-mode fibre for longer runs | See price |
Standard or Xstream: which bundle?
- Xstream Protection adds the full threat stack: TLS 1.3 inspection, cloud sandboxing, and the advanced IPS. For any office that browses the web, this is the bundle that inspects encrypted traffic. It costs $418 more than Standard on a 1-year term, which is modest for what it adds.
- Standard Protection covers the base firewall plus SD-WAN and ZTNA, without the full threat stack. Choose it only if you have a specific reason not to inspect encrypted traffic on the firewall.
Buy the XGS 138 from Nuformat
Nuformat is a Sophos partner serving Canada and the United States, with quick shipping and setup help. Tell us whether you need the 10G uplinks and PoE, and we will confirm whether the 138 or the 128 is the right call, then quote it outright, on a monthly license, or as HWaaS. Contact Nuformat for a Sophos XGS 138 quote.
Frequently asked questions
What is the Sophos XGS 138 firewall throughput?
Sophos publishes 18.1 Gbps firewall throughput for the XGS 138, with 5.85 Gbps IPS, 4.75 Gbps threat protection, and 1.7 Gbps TLS inspection. Concurrent connections are 6,350,000. Treat these as vendor-published maximums and size to your real traffic.
Does the Sophos XGS 138 have 10GbE ports?
Yes. It has two SFP+ fibre ports that run at 10 Gigabit, which no other Sophos desktop model offers. They need transceivers, bought separately, with short-range and long-range options priced on their product pages.
Does the XGS 138 have PoE?
Yes. Two of its 2.5 GE copper ports supply Power over Ethernet at up to 30W each, enough for a couple of access points or IP cameras without a separate PoE switch.
Should I choose the XGS 128 or the XGS 138?
Choose the 138 if you need 10G SFP+ uplinks, built-in PoE, or the extra inspection headroom (1.7 Gbps TLS against 1.45). Otherwise the 128 does the same job for about $822 less. If you want Wi-Fi built into the firewall, that is the 128w, since there is no 138w.
Is there a Sophos XGS 138w with Wi-Fi?
No. The 138 has no wireless variant. For built-in Wi-Fi choose the XGS 128w, or pair a 138 with a Sophos access point, which the firewall can power over its PoE ports.
Can I pay for the XGS 138 monthly?
Yes. You can own the appliance at the price on its product page and pay $108 a month for the Xstream license, or $82 for Standard, billed and managed by Nuformat as your MSP. The monthly price is set by Sophos and can change, unlike a term license which locks your price.
Is the XGS 138 the replacement for the XGS 136?
Yes. The XGS 136 reached end of sale on April 14, 2025 and reaches end of life on September 30, 2030. The 138 is its direct Gen 2 replacement. Note that the 136w has no 138w equivalent, so wireless sites move to the 128w or add a separate access point.
Compare every model, license, and payment option on our Sophos XGS firewall page.