1U firewalls for mid-market and busier sites.

The XGS 2100 through 4500 are 1U rackmount firewalls for mid-market and multi-site businesses that have outgrown a desktop unit and need more throughput and ports.

Buy now ↓ Get a quote

Looking for a specific model or SKU? Use the search bar at the top of the page. Or browse the options below.

All six 1U models run the same protection. Compare across the columns and buy the right fit.

	XGS 2100	XGS 2300	XGS 3100	XGS 3300	XGS 4300	XGS 4500
Firewall	30 Gbps	39 Gbps	47 Gbps	58 Gbps	75 Gbps	80 Gbps
TLS inspection	1.1 Gbps	1.45 Gbps	2.47 Gbps	3.13 Gbps	8 Gbps	10.6 Gbps
Best for	Mid-market entry	Growing	Larger	Multi-site	Distributed	High-throughput
	Buy →	Buy →	Buy →	Buy →	Buy →	Buy →

Specs are vendor published maximums. Not sure which fits? Ask us to size it.

Four ranges cover every size. Pick the one that matches your network, or jump between them here.

Desktop & Small Office

XGS 88, 108, 118, 128, 138 (w = Wi‑Fi)

Silent, compact desktop firewalls for small and branch offices.

Shop desktop XGS →

1U Distributed EdgeYou are here

XGS 2100, 2300, 3100, 3300, 4300, 4500

Rackmount firewalls for mid-market and busier sites that need more throughput and ports.

Shop 1U XGS →

2U Enterprise Edge

XGS 5500, 6500, 7500, 8500

High-capacity firewalls for enterprise cores and campus edges, up to 100 Gbps.

Shop 2U XGS →

Virtual & Cloud

Sophos Firewall VM

The same Sophos firewall as software, for your hypervisor or the public cloud.

Shop virtual firewalls →

Buy 1U XGS below Pick a model to add to cart, or request a quote for sizing and volume pricing.

Capability	What it does
Xstream performance	Accelerates trusted traffic and inspects encrypted TLS 1.3 traffic at speed, so protection stays on without choking the network.
Synchronized Security	The firewall and your Sophos endpoints share a Security Heartbeat, isolating a compromised device automatically before a threat spreads.
Deep threat protection	Intrusion prevention, deep packet inspection, sandboxing, and AI-driven threat intelligence stop ransomware and zero-day attacks at the edge.
SD-WAN	Built-in SD-WAN links multiple sites with automatic failover and application-based routing.
Managed in Sophos Focus	Every XGS is managed alongside your endpoints, switches, and Wi-Fi from one console.

Buy a firewall ↓Get a quote

Bundle	What is included
Standard Protection	Intrusion prevention, application control, web protection, and Synchronized Security, with support included.
Xstream Protection	Everything in Standard, plus Xstream TLS inspection, sandboxing, and AI threat intelligence. The bundle most businesses choose.
Add-on modules	Add ZTNA, extra sandboxing, or other modules on top of a base bundle when you need them.

Buy a licence ↓Get a quote

There are three ways to buy a Sophos XGS firewall. One locks your price; the two monthly options trade that certainty for a lower upfront cost.

Option	How you pay	Price locked?
Term license (buy outright)	Appliance plus a 1, 3, or 5-year Xstream Protection subscription, paid upfront. You own the hardware.	Yes, for the term you buy
Monthly license (MSP Flex)	Buy the appliance outright, then pay for the Xstream Protection license monthly through a Sophos MSP partner’s MSP Flex billing.	No, so the monthly price is set by Sophos and can change
Hardware as a Service (HWaaS)	Appliance, standard shipping, and Xstream Protection in one monthly price via MSP Flex. Mandatory 12-month initial term, then month to month.	No, so the monthly price is set by Sophos and can change

Monthly vs term, in short: a term license fixes your price for the years you buy it. The monthly options, MSP Flex and Hardware as a Service, remove or reduce the upfront cost and bill monthly, but the monthly license price is set by Sophos and is subject to change. MSP Flex and HWaaS are delivered through a Sophos MSP partner on select models in the US and Canada.

Ask which option fits Buy a firewall ↓

Support level	What you get
Standard (included)	Included with every protection bundle: business-hours technical support, firmware and security updates, and hardware RMA.
Enhanced Support	24/7 technical support by phone and email, faster response targets, and advance hardware replacement.
Enhanced Plus	Everything in Enhanced, plus a named technical contact and the fastest response and replacement targets.
Managed firewall	Prefer to hand off the day-to-day? We run and support your firewalls for you. Ask about Nuformat Managed Firewall.

Ask about support Managed firewall

Renewal	What it covers
Standard Protection renewal	Renews intrusion prevention, application and web control, and Synchronized Security, plus support, for a new term.
Xstream Protection renewal	Renews the full Xstream bundle (TLS inspection, sandboxing, AI threat intelligence) plus support.
Support renewal	Renews Enhanced or Enhanced Plus support where it was purchased separately.
Term options	Available in 1, 2, or 3 year terms. We match the renewal to your appliance and remind you before it lapses.

Shop renewals Get a quote

Which Sophos XGS model do I need?+

It depends on your users, sites, and throughput with full inspection enabled. Desktop models suit small and branch offices, 1U suits mid-market, and 2U suits enterprise cores and data-center edges. Tell us your environment and we will size it.

What is the difference between Standard and Xstream Protection?+

Standard covers intrusion prevention, application and web control, and Synchronized Security. Xstream adds Xstream TLS inspection, sandboxing, and AI threat intelligence, and is the bundle most businesses choose.

Is the old XG series still available?+

No. The XG series reached end of life on 31 March 2025. All current Sophos firewalls are the XGS series.

Can I run Sophos Firewall in the cloud?+

Yes. The same Sophos firewall software runs as a virtual appliance on your hypervisor or in the public cloud. See the Virtual and Cloud range.