Which Sophos XGS firewall should I buy?

Size on TLS inspection throughput, not firewall throughput. Almost all web traffic is encrypted, so TLS inspection is the figure that limits what the appliance can actually inspect. The XGS 88 starts at 600 Mbps of TLS inspection and the XGS 8500 reaches 24,000 Mbps.

What is the difference between Standard and Xstream Protection?

Standard Protection covers the base firewall features and SD-WAN. Xstream Protection adds full threat protection, sandboxing and TLS inspection. If you want encrypted traffic inspected, you need Xstream.

What is the smallest Sophos XGS firewall?

The XGS 88, delivering 9,900 Mbps firewall throughput and 600 Mbps of Xstream TLS inspection. A w variant adds Wi-Fi.

What is the largest Sophos XGS firewall?

The XGS 8500, delivering 190,000 Mbps firewall throughput, 24,000 Mbps TLS inspection and 93,000 Mbps IPS throughput in a 2U chassis.

Are the XGS 116 and XGS 136 still available?

No. Both are end of life. The current desktop range is the XGS 88, 108, 118, 128 and 138, with w variants adding Wi-Fi.

Compare Sophos XGS Firewall Models

Compare every Sophos XGS firewall

All fifteen models side by side, plus virtual licensing. Prices are USD for the appliance with a 1-year Xstream Protection subscription. Longer terms, monthly licensing and Hardware as a Service are available on most models.

Desktop and small office

No rack needed. The w models add built-in Wi-Fi.

Model	FirewallMbps	IPSMbps	Threat prot.Mbps	TLSMbps	Notes	From1-yr Xstream
XGS 88 88w	9,900	2,000	2,000	600	Entry desktop	$863
XGS 108 108w	12,500	2,500	2,500	800	More headroom	$1,150
XGS 118 118w	15,500	3,500	3,250	1,100	Common SMB pick	$1,590
XGS 128 128w	19,100	4,650	4,000	1,450	Most TLS per dollar	$2,143
XGS 138	19,100	5,850	4,750	1,700	2x SFP+ 10G, PoE on 2 ports	$2,965

1U rackmount, distributed edge

Rack mounted, Flexi Port expansion on most models.

Model	FirewallMbps	IPSMbps	Threat prot.Mbps	TLSMbps	Notes	From1-yr Xstream
XGS 2100	30,000	6,000	5,000	1,100	Entry rackmount	$5,442
XGS 2300	39,000	7,000	5,500	1,450	More throughput	$7,620
XGS 3100	47,000	10,500	7,400	2,470	Heavier inspection	$10,610
XGS 3300	58,000	14,000	10,000	3,130	Large single site	$14,174
XGS 4300	75,000	29,500	25,200	8,000	8 Gbps TLS, 4x SFP+	$21,210
XGS 4500	80,000	36,500	31,850	10,600	Top of the 1U range	$29,186

2U rackmount, enterprise edge

Highest throughput, campus core and data-centre edge.

Model	FirewallMbps	IPSMbps	Threat prot.Mbps	TLSMbps	Notes	From1-yr Xstream
XGS 5500	100,000	40,000	46,000	13,500	Campus edge	Quote
XGS 6500	120,000	50,750	53,500	16,000	Higher port density	Quote
XGS 7500	160,000	71,500	70,000	19,500	Large enterprise core	Quote
XGS 8500	190,000	93,000	92,500	24,000	Top of the range	Quote

Virtual and cloud

Same Sophos Firewall OS on your own hypervisor or in the cloud. Licensed by core rather than by appliance.

Licence	Performance	Notes	From1-yr Xstream
1-core	Performance depends on the host you run it on	Licensed by core count	$1,609
2-core	Performance depends on the host you run it on	Licensed by core count	$3,884
4-core	Performance depends on the host you run it on	Licensed by core count	$7,459
6-core	Performance depends on the host you run it on	Licensed by core count	$12,494
8-core	Performance depends on the host you run it on	Licensed by core count	$19,482
16-core	Performance depends on the host you run it on	Licensed by core count	$35,732

Not sure which one fits?

Size on TLS inspection rather than firewall throughput. Tell us your user count, internet speed and services and we will confirm the model, or tell you a smaller one will do.

Get a sizing recommendation Browse all firewalls

Modules and add-ons

What each model can be expanded with, and what fits where. Prices are USD.

Modules for desktop models

Desktop appliances have no Flexi Port bay. Their add-ons are the 5G module for cellular failover, a Wi-Fi module, and SFP transceivers for the fibre port.

Add-on	Type	Fits	PriceUSD
5G module for XGS 118(w)/128(w)/138	5G module	XGS 118(w), 128(w), 138 only	$798
802.11ac 2x2 single radio WiFi module	Wi-Fi module	See product page	$188

The 5G module fits the 118w, 128w and 138 only. Check your exact model before ordering.

Flexi Port modules for rackmount models

Rackmount models from the 2100 up have a Flexi Port bay. One module adds copper, fibre, PoE or 10G ports without replacing the appliance.

Add-on	Type	Fits	PriceUSD
2 port 10GE NBASE-T + 2 port 10GE SFP+ Flexi Port module	Flexi Port module	XGS 2xxx/3xxx/4xxx models only	$1,595
2 port 10GbE fiber (LC) Bypass + 4 port 10GbE SFP+ FleXi Port module	Flexi Port module	XGS 5500/6500 models only	$6,882
2 port 40GbE QSFP+ Flexi Port Module	Flexi Port module	XGS 5500/6500 models only	$2,243
2 port GbE fiber (LC) Bypass + 4 port GbE SFP FleXi Port module	Flexi Port module	all XGS Rackmount models	$4,211
4 port 10GbE SFP+ FleXi Port module	Flexi Port module	all XGS Rackmount models	$1,386
4 port 2.5GbE copper + 12 port GbE High-density Flexi Port module	Flexi Port module	XGS 5500/6500/7500/8500 models only	$3,368
4 port GbE copper - 2 Bypass groups FleXi Port module	Flexi Port module	all XGS Rackmount models	$696
4 port GbE copper PoE + 4 port GbE copper FleXi Port module	Flexi Port module	XGS 2xxx/3xxx/4xxx models only	$1,400
8 port 10GbE SFP+ FleXi Port module	Flexi Port module	XGS 5500/6500/7500/8500 models only	$2,524
8 port GbE SFP FleXi Port module	Flexi Port module	all XGS Rackmount models	$977
8 port GbE copper Flexi Port module	Flexi Port module	all XGS Rackmount models	$977

Bypass modules keep traffic flowing if the appliance loses power, which matters on an inline deployment.

Transceivers

SFP and SFP+ ports need a transceiver. Short range is multi-mode fibre for in-building runs; long range is single-mode for longer distances.

Add-on	Type	Fits	PriceUSD
10GbE Fiber Transceiver Long Range (10 Base-LR)	Transceiver	See product page	$1,096
10GbE Fiber Transceiver Short Range (10 Base-SR)	Transceiver	See product page	$840
1GbE Copper Transceiver (1000 Base-T)	Transceiver	See product page	$359
1GbE Fiber Transceiver Long Range (1000 Base-LX)	Transceiver	See product page	$615
1GbE Fiber Transceiver Short Range (1000 Base-SX)	Transceiver	See product page	$231

The XGS 138 SFP+ ports and every rackmount SFP or SFP+ port need one of these. They are not included with the appliance.

Not sure which module fits?

Fitment varies by model and some modules are rackmount only. Send us your model and what you need to connect, and we will confirm the right part before you order.

Check module fitment Browse all firewall SKUs

How to choose in one minute

Four questions, in the order that actually narrows it down.

Question	What it points to
Do you have a rack?	No rack means desktop (88 to 138). A rack means 1U or 2U.
How much encrypted traffic do you inspect?	This is the real limit, not firewall throughput. Compare the TLS column. The desktop XGS 128 inspects more TLS at 1,450 Mbps than the larger 2100 at 1,100 Mbps.
Do you need 10 Gigabit at the firewall?	Only the XGS 138 has SFP+ 10G among desktops. On rackmount, the 2100 upward take a 10G Flexi Port module.
Do you need Wi-Fi or PoE built in?	The w variants add Wi-Fi on the 88, 108, 118 and 128. The 138 supplies PoE on two ports. There is no 138w.

Sophos does not publish user counts per model, so we do not quote them. Tell us your user count, internet speed and which services you plan to run and we will size it against the Sophos sizing tool.

Model guides and comparisons

Buying guides and head-to-head comparisons for the models above.

Search articles

21 of 21 articles

See all articles

Ready to move?

Add a model to your cart, or send us your requirements and we will quote it outright, on a monthly licence, or as Hardware as a Service.

Browse all firewall SKUs Get a quote

Throughput figures are Sophos-published maximums measured under set conditions, so size to your real traffic. Licensing, support tiers and renewal detail are on the Sophos firewall page.