Sophos XGS · 2U Enterprise Edge
2U firewalls for enterprise cores and campus edges.
The XGS 5500 through 8500 are 2U high-capacity firewalls for enterprise cores and campus edges, built for high-availability pairs and heavy inspection, up to 100 Gbps.
Looking for a specific model or SKU? Use the search bar at the top of the page. Or browse the options below.
All four 2U models run the same protection. Compare across the columns and buy the right fit.
| XGS 5500 | XGS 6500 | XGS 7500 | XGS 8500 | |
|---|---|---|---|---|
| Firewall | 100 Gbps | 120 Gbps | 160 Gbps | 190 Gbps |
| TLS inspection | 13.5 Gbps | 16 Gbps | 19.5 Gbps | 24 Gbps |
| Best for | Enterprise core | Large core | Data center | Maximum |
| Buy → | Buy → | Buy → | Buy → |
Specs are vendor published maximums. Not sure which fits? Ask us to size it.
Four ranges cover every size. Pick the one that matches your network, or jump between them here.
Desktop & Small Office
XGS 88, 108, 118, 128, 138 (w = Wi‑Fi)
Silent, compact desktop firewalls for small and branch offices.
Shop desktop XGS →1U Distributed Edge
XGS 2100, 2300, 3100, 3300, 4300, 4500
Rackmount firewalls for mid-market and busier sites that need more throughput and ports.
Shop 1U XGS →2U Enterprise EdgeYou are here
XGS 5500, 6500, 7500, 8500
High-capacity firewalls for enterprise cores and campus edges, up to 100 Gbps.
Shop 2U XGS →Virtual & Cloud
Sophos Firewall VM
The same Sophos firewall as software, for your hypervisor or the public cloud.
Shop virtual firewalls →Buy 2U XGS below Pick a model to add to cart, or request a quote for sizing and volume pricing.
| Capability | What it does |
|---|---|
| Xstream performance | Accelerates trusted traffic and inspects encrypted TLS 1.3 traffic at speed, so protection stays on without choking the network. |
| Synchronized Security | The firewall and your Sophos endpoints share a Security Heartbeat, isolating a compromised device automatically before a threat spreads. |
| Deep threat protection | Intrusion prevention, deep packet inspection, sandboxing, and AI-driven threat intelligence stop ransomware and zero-day attacks at the edge. |
| SD-WAN | Built-in SD-WAN links multiple sites with automatic failover and application-based routing. |
| Managed in Sophos Focus | Every XGS is managed alongside your endpoints, switches, and Wi-Fi from one console. |
| Bundle | What is included |
|---|---|
| Standard Protection | Intrusion prevention, application control, web protection, and Synchronized Security, with support included. |
| Xstream Protection | Everything in Standard, plus Xstream TLS inspection, sandboxing, and AI threat intelligence. The bundle most businesses choose. |
| Add-on modules | Add ZTNA, extra sandboxing, or other modules on top of a base bundle when you need them. |
There are three ways to buy a Sophos XGS firewall. One locks your price; the two monthly options trade that certainty for a lower upfront cost.
| Option | How you pay | Price locked? |
|---|---|---|
| Term license (buy outright) | Appliance plus a 1, 3, or 5-year Xstream Protection subscription, paid upfront. You own the hardware. | Yes, for the term you buy |
| Monthly license (MSP Flex) | Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing. | No, so the monthly price is set by Sophos and can change |
| Hardware as a Service (HWaaS) | Appliance, standard shipping, and Xstream Protection in one monthly price via MSP Flex. Mandatory 12-month initial term, then month to month. | No, so the monthly price is set by Sophos and can change |
Monthly vs term, in short: a term license fixes your price for the years you buy it. The monthly options, MSP Flex and Hardware as a Service, remove or reduce the upfront cost and bill monthly, but the monthly license price is set by Sophos and is subject to change. MSP Flex and HWaaS are delivered through a Sophos MSP partner on select models in the US and Canada.
| Support level | What you get |
|---|---|
| Standard (included) | Included with every protection bundle: business-hours technical support, firmware and security updates, and hardware RMA. |
| Enhanced Support | 24/7 technical support by phone and email, faster response targets, and advance hardware replacement. |
| Enhanced Plus | Everything in Enhanced, plus a named technical contact and the fastest response and replacement targets. |
| Managed firewall | Prefer to hand off the day-to-day? We run and support your firewalls for you. Ask about Nuformat Managed Firewall. |
| Renewal | What it covers |
|---|---|
| Standard Protection renewal | Renews intrusion prevention, application and web control, and Synchronized Security, plus support, for a new term. |
| Xstream Protection renewal | Renews the full Xstream bundle (TLS inspection, sandboxing, AI threat intelligence) plus support. |
| Support renewal | Renews Enhanced or Enhanced Plus support where it was purchased separately. |
| Term options | Available in 1, 2, or 3 year terms. We match the renewal to your appliance and remind you before it lapses. |
Which Sophos XGS model do I need?+
It depends on your users, sites, and throughput with full inspection enabled. Desktop models suit small and branch offices, 1U suits mid-market, and 2U suits enterprise cores and data-center edges. Tell us your environment and we will size it.
What is the difference between Standard and Xstream Protection?+
Standard covers intrusion prevention, application and web control, and Synchronized Security. Xstream adds Xstream TLS inspection, sandboxing, and AI threat intelligence, and is the bundle most businesses choose.
Is the old XG series still available?+
No. The XG series reached end of life on 31 March 2025. All current Sophos firewalls are the XGS series.
Can I run Sophos Firewall in the cloud?+
Yes. The same Sophos firewall software runs as a virtual appliance on your hypervisor or in the public cloud. See the Virtual and Cloud range.
