Sophos XGS 2100 Firewall: Specs, Price, Buying Guide

Sophos XGS 2100 buying guide: full specs, pricing, and what it replaces

The Sophos XGS 2100 is the entry point to the 1U rackmount range. It delivers 30 Gbps firewall throughput, 5 Gbps threat protection, and 1.1 Gbps of TLS inspection, with 8 GbE copper ports, 2 SFP fibre ports, and one Flexi Port bay for expansion. In USD, the appliance alone and the 1-year Xstream Protection bundle are both priced on their product pages. If you are replacing an end-of-life XG 210, this is its successor.

This guide is specs-first, because that is what most people searching for the 2100 actually want. The full datasheet table is below, followed by pricing, expansion options, and an honest note about where the 2100 is weaker than you might expect.

Sophos XGS 2100 full specifications

Sophos-published figures for the XGS 2100. Treat throughput as vendor-measured under set conditions and size to your real traffic.

Performance

Metric	XGS 2100
Firewall throughput	30,000 Mbps (30 Gbps)
Firewall IMIX	16,500 Mbps
Firewall latency (64 byte UDP)	6 µs
IPS throughput	6,000 Mbps
Threat protection throughput	5,000 Mbps
NGFW throughput	5,200 Mbps
Xstream TLS (SSL) inspection	1,100 Mbps
TLS concurrent connections	18,432
IPsec VPN throughput	17,000 Mbps
IPsec VPN concurrent tunnels	5,000
SSL VPN concurrent tunnels	2,500
Concurrent connections	6,500,000
New connections per second	134,700

Interfaces and hardware

Item	XGS 2100
Fixed Ethernet interfaces	8 x GE copper, 2 x SFP fibre
Bypass port pairs	1
Flexi Port bay	1, for an optional expansion module
Management ports	1 x RJ45 MGMT, 1 x COM RJ45, 1 x Micro-USB
Other I/O	2 x USB 3.0 front, 1 x USB 2.0 rear
Storage	Integrated, minimum 120 GB SATA-III
Form factor	1U rackmount

The SFP ports need transceivers, bought separately. A 1GbE short-range transceiver and the long-range version are priced on their product pages, and a 1GbE copper transceiver is $359.

The counterintuitive thing about the XGS 2100

Its TLS inspection figure is 1,100 Mbps. The desktop XGS 128 does 1,450 Mbps, and the XGS 138 does 1,700 Mbps. Both are smaller, cheaper desktop units.

This surprises people, and it matters, because nearly all web traffic is encrypted. If your constraint is inspecting encrypted traffic rather than moving raw volume, a desktop model may genuinely serve you better.

So why buy the 2100? Three reasons the desktop models cannot match:

• Raw throughput. 30 Gbps firewall and 17 Gbps IPsec VPN, against 19.1 Gbps and far less VPN capacity on the 128.
• Connection capacity. 6.5 million concurrent connections and 134,700 new connections per second, which is what matters for a site with many users and many sessions.
• The Flexi Port bay. You can add 10G, PoE, or high-density ports later without replacing the appliance. No desktop model can be expanded.

Buy the 2100 for capacity, expandability and VPN concurrency. If you only need more TLS inspection, look at the 138 first and save the money.

Replacing an XG 210

The Sophos XG series reached end of life on March 31, 2025. If you are still running an XG 210, you are on hardware with no support and no firmware updates, and the XGS 2100 is its direct successor in the current lineup.

What changes when you move:

• SFOS carries over. The XGS runs the same Sophos Firewall OS, so the console and policy model are familiar. Configuration migration tooling exists, and we can handle it as part of the deployment.
• Xstream architecture is new to you. The XGS hardware includes a dedicated Xstream Flow Processor that offloads trusted traffic, which is why TLS inspection can stay switched on.
• Licensing model. The bundles are Standard and Xstream Protection, rather than the older module-based structure.
• The Flexi Port bay is the same idea as the XG expansion module, so any port planning you did before still applies.

If you are running an XG 210 today, the honest question is not whether to replace it but whether the 2100 is the right size now. Traffic and user counts change over five years. Tell us what the site looks like today and we will size it rather than assume a like-for-like swap.

Where the XGS 2100 sits in the range

Every 1U rackmount model, with the 2100 highlighted.

Every model links to its product page, where the current price is shown. If the next model up is worth the difference for your site, buy that one instead. Size on the TLS column rather than firewall throughput, since almost all web traffic is encrypted.

Sophos XGS 2100 pricing in USD

All prices USD, current at time of writing. The appliance and licence come together in each bundle.

Buy outright, term licence

Product	Price	Effective per month
XGS 2100 appliance only	See price	Base licence
Standard Protection, 1 year	See price	~$428/mo
Standard Protection, 3 years	See price	~$247/mo
Standard Protection, 5 years	See price	~$217/mo
Xstream Protection, 1 year	See price	~$454/mo
Xstream Protection, 3 years	See price	~$307/mo
Xstream Protection, 5 years	See price	~$278/mo

A term licence is the only option that locks your price for the whole period. Longer terms also cut the effective monthly cost sharply, from $454 down to $278.

Monthly licence, own the hardware

Buy the appliance at the price on its product page then pay for the licence month to month, billed and managed by Nuformat as your MSP through Sophos MSP Flex.

Monthly licence	Price per month
XGS 2100 Standard Protection	$190/mo
XGS 2100 Xstream Protection	$250/mo

Hardware as a Service

HWaaS, all-in	Price per month
XGS 2100 with Xstream Protection	$355/mo

HWaaS includes the appliance and the Xstream subscription on one monthly bill with nothing upfront. It runs on a twelve-month minimum, then continues month to month. The hardware stays owned by Nuformat, and the payments are perpetual: there is no final instalment after which the appliance becomes yours.

Renewals

Renewal	Price
Xstream Protection, 12-month renewal	See price
Xstream Protection, 36-month renewal	See price

The same firewall, three ways

Xstream Protection, compared over one and three years.

Route (Xstream)	Upfront	Monthly	You own the hardware	Cost over 1 year	Cost over 3 years
Term licence (buy outright)	See current price	None	Yes	Price locked for the term you buy
Hardware plus monthly licence	Appliance price	$250/mo	Yes	Appliance + $3,000	Appliance + $9,000
Hardware as a Service (HWaaS)	$0	$355/mo	No, the MSP owns it	$4,260	$12,780

• HWaaS is cheapest in year one because there is no appliance to buy.
• The term licence is cheapest over three years and it fixes your price for the term.
• HWaaS becomes the most expensive at around month 31, and the payments never stop. If you keep firewalls until they die, buy outright. If you refresh every three or four years, the cash-flow advantage is real.
• Monthly rates are set by Sophos and can change. Only a term licence locks your price.

Flexi Port expansion modules

The 2100 has one Flexi Port bay. These modules fit all XGS rackmount models, so anything below works in a 2100.

Module	What it adds	Price
4 port GbE copper, 2 bypass groups	More copper ports with bypass, for inline deployments	$696
8 port GbE copper	Highest copper port count	$977
8 port GbE SFP	Fibre density	$977
4 port 10GbE SFP+	10 Gigabit fibre, the common upgrade	See price
4 port GbE copper PoE + 4 port GbE copper	Power access points or cameras from the firewall	See price
2 port 10GE NBASE-T + 2 port 10GE SFP+	Mixed 10G copper and fibre	See price
2 port GbE fibre bypass + 4 port GbE SFP	Fibre with bypass for inline deployments	See price

All the modules above fit a 2100. Note that the PoE and NBASE-T modules are rated for XGS 2xxx, 3xxx and 4xxx models only, so they fit the 2100 but not the 5500 and above. Only one module fits at a time, so choose based on what the site actually needs. The 4 port 10GbE SFP+ is the usual choice when a business outgrows Gigabit uplinks.

Standard or Xstream Protection?

• Xstream Protection adds TLS 1.3 inspection, cloud sandboxing and the advanced IPS. For any site whose users browse the web, this is the bundle that inspects encrypted traffic. On a 1-year term it costs $310 more than Standard.
• Standard Protection covers the base firewall plus SD-WAN and ZTNA, without the full threat stack. Choose it only if you have a specific reason not to inspect encrypted traffic here.

Get a Sophos XGS 2100 quote from Nuformat

Nuformat is a Sophos partner serving Canada and the United States. Tell us your user count, internet speed and which services you plan to run, and we will confirm whether the 2100 is right, or tell you a different model fits better. Contact Nuformat for a Sophos XGS 2100 quote.

Frequently asked questions

What are the Sophos XGS 2100 specifications?

The XGS 2100 delivers 30 Gbps firewall throughput, 6 Gbps IPS, 5 Gbps threat protection, and 1.1 Gbps TLS inspection. It supports 6,500,000 concurrent connections and 134,700 new connections per second, with 17 Gbps IPsec VPN throughput. Fixed ports are 8 x GE copper and 2 x SFP fibre, plus one Flexi Port bay.

What does the Sophos XGS 2100 cost?

Current pricing is on the product page. The 1-year and 3-year Xstream bundles are priced on their product pages. You can also own the appliance and pay $250 a month for the Xstream licence, or take Hardware as a Service at $355 a month with nothing upfront.

Does the XGS 2100 have 10 Gigabit ports?

Not as standard. Fixed ports are 8 x GE copper and 2 x SFP fibre. You add 10 Gigabit by fitting a Flexi Port module in the expansion bay, most commonly the 4 port 10GbE SFP+ module, priced on its product page.

Is the XGS 2100 the replacement for the XG 210?

Yes. The Sophos XG series reached end of life on March 31, 2025, and the XGS 2100 is its successor in the current 1U range. It runs the same Sophos Firewall OS, so the console and policy model are familiar, and migration tooling exists. Size the replacement against today's traffic rather than assuming a like-for-like swap.

Why does the XGS 2100 inspect less TLS than a desktop XGS 128?

The 2100 publishes 1,100 Mbps of TLS inspection against 1,450 Mbps on the desktop XGS 128. TLS inspection capacity does not track firewall throughput. The 2100 is built for raw volume, connection capacity and VPN concurrency, where the 128 is tuned differently. If encrypted inspection is your constraint rather than volume, compare that column specifically.

How many users does the XGS 2100 support?

Sophos does not publish user counts per model, so we do not quote them. Sizing depends on your internet speed, how many services you enable, and how much traffic you inspect. Send us those three things and we will size it against the Sophos sizing tool.

Can I expand the XGS 2100 later?

Yes. It has one Flexi Port bay that takes any module rated for XGS rackmount models, including 10GbE fibre, PoE, and high-density copper or SFP options. Only one module fits at a time. This is the main advantage over the desktop range, which cannot be expanded.