Sophos Firewall · Virtual & Cloud

The full Sophos firewall, without the hardware.

Sophos Firewall VM runs the same firewall software as software, for your hypervisor or the public cloud. Same protection and management, sized by cores and memory instead of an appliance.

Buy now ↓ Get a quote

Looking for a specific model or SKU? Use the search bar at the top of the page. Or browse the options below.

Sophos Firewall VM runs the same software as the appliances. It is not a fixed model, it is sized by virtual cores and RAM for your workload.

Sized by	Detail
Cores & RAM	You pick the virtual cores and memory to match your throughput, rather than choosing a fixed appliance.
Hypervisors	VMware ESXi, Microsoft Hyper-V, KVM, and Nutanix AHV.
Public cloud	Deploy from the AWS and Microsoft Azure marketplaces.
Same features	The full Sophos Firewall feature set and the same licensing bundles as the hardware.

Not sure how many cores you need? Tell us your throughput and environment. Ask us to size it.

Buy a virtual firewall ↓Get a quote

Four ranges cover every size. Pick the one that matches your network, or jump between them here.

Desktop & Small Office

XGS 88, 108, 118, 128, 138 (w = Wi‑Fi)

Silent, compact desktop firewalls for small and branch offices.

Shop desktop XGS →

1U Distributed Edge

XGS 2100, 2300, 3100, 3300, 4300, 4500

Rackmount firewalls for mid-market and busier sites that need more throughput and ports.

Shop 1U XGS →

2U Enterprise Edge

XGS 5500, 6500, 7500, 8500

High-capacity firewalls for enterprise cores and campus edges, up to 100 Gbps.

Shop 2U XGS →

Virtual & CloudYou are here

Sophos Firewall VM

The same Sophos firewall as software, for your hypervisor or the public cloud.

Shop virtual firewalls →

Get a quote below Pick a model to add to cart, or request a quote for sizing and volume pricing.

Capability	What it does
Xstream performance	Accelerates trusted traffic and inspects encrypted TLS 1.3 traffic at speed, so protection stays on without choking the network.
Synchronized Security	The firewall and your Sophos endpoints share a Security Heartbeat, isolating a compromised device automatically before a threat spreads.
Deep threat protection	Intrusion prevention, deep packet inspection, sandboxing, and AI-driven threat intelligence stop ransomware and zero-day attacks at the edge.
SD-WAN	Built-in SD-WAN links multiple sites with automatic failover and application-based routing.
Managed in Sophos Fusion	Every XGS is managed alongside your endpoints, switches, and Wi-Fi from one console.

Buy a firewall ↓Get a quote

Bundle	What is included
Standard Protection	Intrusion prevention, application control, web protection, and Synchronized Security, with support included.
Xstream Protection	Everything in Standard, plus Xstream TLS inspection, sandboxing, and AI threat intelligence. The bundle most businesses choose.
Add-on modules	Add ZTNA, extra sandboxing, or other modules on top of a base bundle when you need them.

Buy a licence ↓Get a quote

There are three ways to buy a Sophos XGS firewall. One locks your price; the two monthly options trade that certainty for a lower upfront cost.

Option	How you pay	Price locked?
Term license (buy outright)	Appliance plus a 1, 3, or 5-year Xstream Protection subscription, paid upfront. You own the hardware.	Yes, for the term you buy
Monthly license (MSP Flex)	Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing.	No, so the monthly price is set by Sophos and can change
Hardware as a Service (HWaaS)	Appliance, standard shipping, and Xstream Protection in one monthly price via MSP Flex. Mandatory 12-month initial term, then month to month.	No, so the monthly price is set by Sophos and can change

Monthly vs term, in short: a term license fixes your price for the years you buy it. The monthly options, MSP Flex and Hardware as a Service, remove or reduce the upfront cost and bill monthly, but the monthly license price is set by Sophos and is subject to change. MSP Flex and HWaaS are delivered through a Sophos MSP partner on select models in the US and Canada.

Ask which option fits Buy a firewall ↓

Support level	What you get
Standard (included)	Included with every protection bundle: business-hours technical support, firmware and security updates, and hardware RMA.
Enhanced Support	24/7 technical support by phone and email, faster response targets, and advance hardware replacement.
Enhanced Plus	Everything in Enhanced, plus a named technical contact and the fastest response and replacement targets.
Managed firewall	Prefer to hand off the day-to-day? We run and support your firewalls for you. Ask about Nuformat Managed Firewall.

Ask about support Managed firewall

Renewal	What it covers
Standard Protection renewal	Renews intrusion prevention, application and web control, and Synchronized Security, plus support, for a new term.
Xstream Protection renewal	Renews the full Xstream bundle (TLS inspection, sandboxing, AI threat intelligence) plus support.
Support renewal	Renews Enhanced or Enhanced Plus support where it was purchased separately.
Term options	Available in 1, 2, or 3 year terms. We match the renewal to your appliance and remind you before it lapses.

Shop renewals Get a quote

Which Sophos XGS model do I need?+

It depends on your users, sites, and throughput with full inspection enabled. Desktop models suit small and branch offices, 1U suits mid-market, and 2U suits enterprise cores and data-center edges. Tell us your environment and we will size it.

What is the difference between Standard and Xstream Protection?+

Standard covers intrusion prevention, application and web control, and Synchronized Security. Xstream adds Xstream TLS inspection, sandboxing, and AI threat intelligence, and is the bundle most businesses choose.

Is the old XG series still available?+

No. The XG series reached end of life on 31 March 2025. All current Sophos firewalls are the XGS series.

Can I run Sophos Firewall in the cloud?+

Yes. The same Sophos firewall software runs as a virtual appliance on your hypervisor or in the public cloud. See the Virtual and Cloud range.