Sophos XGS 138 vs Fortinet, Meraki, Palo Alto
Posted by Saif Khan on 2026 Sep 10th
The Sophos XGS 138 makes a deliberate trade. It drops the built-in Wi-Fi of its smaller siblings and spends that room on more ports, including SFP+, plus the highest inspected throughput in the desktop range. That tells you who it is for: an office that runs Wi-Fi from separate access points and wants its firewall focused on inspecting a heavier, mostly encrypted traffic load. Below, the XGS 138 with Xstream Protection is measured against the nearest Fortinet, Cisco Meraki, and Palo Alto models, in USD.
One reminder that applies to every row: throughput here is vendor-published under different test conditions, so treat the numbers as directional and weigh them against your own traffic. Nuformat prices include a year of security; the competitor prices are hardware on its own.
XGS 138 versus the field
| Model | Firewall throughput | Security throughput | TLS inspection | Ports / Wi-Fi | Price (USD) |
|---|---|---|---|---|---|
| Sophos XGS 138 (Xstream, 1-yr) | 18.1 Gbps | 4.75 Gbps Threat Protection | 1.7 Gbps, native | 4x GE + 2x 2.5GbE (PoE) + 2x SFP+ 10G | $4,187 |
| Fortinet FortiGate 80F | 10/10/7 Gbps | 900 Mbps Threat Protection | 715 Mbps SSL | 10x GE, FortiWiFi option | $2,254.43 (1-yr UTP) |
| Cisco Meraki MX85 / MX95 | 1-3 Gbps stateful | 750 Mbps (MX85 Advanced Security) | Not native (add-on) | WAN SFP, no Wi-Fi | Hardware + Meraki license (quote) |
| Palo Alto PA-460 | 4.6 Gbps appmix | 3.0 Gbps Threat Prevention | Yes (licensed) | No Wi-Fi | Quote-based (hardware + subscriptions) |
Vendor-published figures (sophos.com, fortinet.com, documentation.meraki.com, paloaltonetworks.com). USD, checked September 7, 2026.
What the 138 is really for
Two hardware details separate the 138 from everything else in this table. It is the only unit here with two SFP+ ports that run at 10 Gigabit, which matters when the firewall has to sit on a fibre uplink to a core switch or a fast fibre service. It also supplies Power over Ethernet on two ports at 30W each, enough to run a couple of access points directly. The FortiGate 80F, Meraki MX85, and PA-460 all need a separate PoE switch for that.
Of the three Sophos desktop models, the 138 lists the highest TLS inspection throughput at 1.7 Gbps, and the SFP+ ports give you a fibre uplink option the Wi-Fi models lack. If your office already has dedicated access points and your firewall’s job is to inspect a lot of encrypted traffic and connect cleanly to the rest of the network, the 138 is the desktop model that fits. The Xstream bundle is identical to its siblings; you are paying for headroom and connectivity, not a different feature set.
The alternatives, weighed
FortiGate 80F. Fortinet’s 80F is the same appliance we would compare against the 128, and it holds up here too, with native SD-WAN, a strong VPN figure, and the option of built-in Wi-Fi if you decide you want it after all. Nuformat can quote it next to the 138. Its SSL inspection sits below the 138’s TLS figure, measured each vendor’s way.
Cisco Meraki MX85 or MX95. At this level Meraki still leads with cloud management and now offers more headroom, especially on the MX95. The pattern from the smaller models repeats: a mandatory recurring license, and no native HTTPS inspection. If the 138 appeals because of its TLS inspection, that is precisely where Meraki asks you to add an extension.
Palo Alto PA-460. The top of Palo Alto’s desktop line and the closest it comes to the 138 on paper. It suits an organization that has standardized on Palo Alto and staffs the operations to match. Its numbers use an application mix and its pricing comes by quote, so budget accordingly rather than from the hardware figure.
Best fit
- Wi-Fi handled elsewhere, heavy encrypted traffic, one bundled price: the XGS 138 at $4,187.
- Want SD-WAN, a Fortinet fabric, and the option of Wi-Fi: the FortiGate 80F, quotable alongside.
- Cloud-dashboard management with room to grow: Meraki MX85/95, license and inspection caveats noted.
- Palo Alto estate at the top of the desktop range: the PA-460.
Common questions
Why does the XGS 138 have no Wi-Fi?
The 138 trades the Wi-Fi radio for more ports, including SFP+, and higher inspected throughput. It is aimed at offices that run Wi-Fi from separate access points.
Does the Sophos XGS 138 have 10GbE ports?
Yes. It has two SFP+ fibre ports that run at 10 Gigabit, which no other Sophos desktop model offers, and none of the comparable FortiGate, Meraki, or Palo Alto desktop units in this comparison match. Transceivers are bought separately.
What is the XGS 138 price in USD?
The XGS 138 with a 1-year Xstream Protection subscription is $4,187 USD at Nuformat, or $7,817 for three years. You can also own the appliance at $2,373 and pay $108 a month for the Xstream licence, or take it all on Hardware as a Service at $155 a month with a 12-month minimum.
Does the 138 inspect more encrypted traffic than the 128?
Yes, its TLS inspection figure is higher (1.7 Gbps versus 1.45 Gbps), which is the main reason to pick it over the 128 when Wi-Fi is not needed on the firewall.
Which of these does Nuformat sell?
Sophos and Fortinet. Meraki and Palo Alto are included for comparison only.
Three ways to buy the XGS 138
Sophos sells the XGS and its Xstream Protection more than one way, and the right choice depends on whether you value a locked price or a lower upfront cost. USD figures for the 138:
| Route | Upfront | Monthly | 1 year | 3 years |
|---|---|---|---|---|
| Term licence, buy outright | $4,187 (1-yr) | None | $4,187 | $7,817 |
| Own the hardware, licence monthly | $2,373 | $108/mo | $3,669 | $6,261 |
| Hardware as a Service | $0 | $155/mo | $1,860 | $5,580 |
HWaaS is the cheapest on both horizons because there is no appliance to buy, though the hardware stays with the MSP and it carries a 12-month minimum. Owning the appliance and licensing monthly costs more but leaves you with the hardware. Only the term licence locks your price: the monthly rates are set by Sophos and can change. Both monthly routes are billed and managed by Nuformat as your MSP.
Get a quote
Add the Sophos XGS 138 with Xstream Protection to your cart for a quote, or ask Nuformat to confirm it suits your setup. Canada and the USA. Contact us.
Sources
- Sophos XGS datasheet and licensing: sophos.com
- Fortinet FortiGate 80F datasheet: fortinet.com
- Cisco Meraki MX85/MX95 datasheet: documentation.meraki.com
- Palo Alto PA-400 datasheet: paloaltonetworks.com
- Sophos XGS 138 (Xstream, 1-year) at Nuformat