In short: Sophos XGS firewalls are the hardware appliances that run Sophos Firewall. The XGS Series spans desktop models for small offices and branches, 1U rackmount models for mid-sized and multi-site organisations, and 2U models for enterprise and campus edges, with Xstream hardware acceleration, high availability options and management in Sophos Fusion.
What is the Sophos XGS Series?
XGS appliances are purpose-built boxes for Sophos Firewall. They replaced the earlier XG Series, which reached end of life on 31 March 2025 (see XG end of life). The software is the same Sophos Firewall OS on every model, so features, policies and the management experience in Sophos Fusion do not change as you move up or down the range. What changes is how much traffic each appliance can inspect, how many ports it has and how much resilience is built in.
Encrypted traffic is the main reason firewall hardware matters. Most web traffic now uses TLS, and decrypting it for inspection is processor-heavy. Sophos's Xstream architecture handles this in two ways: the rackmount models pair a main CPU with a dedicated Xstream Flow Processor that offloads trusted traffic, while the second-generation desktop models use Xstream virtual FastPath acceleration, including for IPsec VPN traffic.
The XGS ranges
| Range | Typical use | Notable hardware traits |
|---|---|---|
| Desktop (second generation) | Small businesses, shops and branch offices | 2.5 GbE ports on every model, Wi-Fi 6 options, fanless quiet models at the small end, optional second power supply on most, and an optional 5G module on some models |
| 1U rackmount | Larger SMBs and mid-sized, multi-site organisations | Dual-processor design with an Xstream Flow Processor, copper and fibre ports, LAN bypass ports, Flexi Port expansion bays, optional second power supply and a PoE module option |
| 2U rackmount | Enterprise head offices, data centres and campus edges | Dedicated acceleration co-processor, high-density 10 GbE fibre with faster uplinks on the top models, redundant power, SSDs and fans built in |
Some first-generation desktop models are still sold while stock lasts. The smallest second-generation desktop models leave out a few advanced features, such as on-box reporting and the email message transfer agent, so check the feature notes before choosing the cheapest box. We do not list individual model numbers here because the right one depends on your traffic, not on a headline throughput figure. Sophos measures datasheet throughput under ideal test conditions and says actual performance varies with network conditions and the services you switch on; throughput with TLS inspection, IPS and malware scanning all enabled is lower, and that is the figure that matters for sizing.
How we size an XGS appliance
Choosing an appliance from a datasheet usually leads to one that is too small once inspection is switched on, or one that is far too big for the job. We size from your real requirements:
- Users and devices: how many people and devices sit behind the firewall now, and in three years
- Internet links: line speeds, how many links you have, and whether you need SD-WAN failover or a 5G backup
- Inspection: whether you will decrypt TLS traffic, run IPS and Zero-Day Protection on everything, and use email or web server protection on the box
- VPN and remote access: the number of site-to-site tunnels, SD-RED branches and remote users, and whether ZTNA will replace some VPN use
- Ports and resilience: copper, fibre and PoE needs, LAN bypass, dual power and whether you need a high availability pair
Sophos provides sizing assistance and a firewall sizing tool to the companies that sell its firewalls, and we use them together with your traffic profile. The result is a written recommendation with headroom for growth, rather than a guess.
High availability and resilience
For sites where the internet connection is business-critical, two XGS appliances can run as a high availability (HA) pair:
- Active-passive: one appliance handles traffic and the other takes over if it fails. Sophos licenses the pair through the primary, and its subscriptions sync to the auxiliary
- Active-active: both appliances share the load. Each needs matching licences
For hardware replacement, Enhanced Support includes advance replacement for the term. In an active-passive pair, Sophos requires Enhanced Plus support on the primary appliance for the passive unit to be eligible for advance replacement; in an active-active pair, both appliances need Enhanced or Enhanced Plus support. If the licences on an active-active pair stop matching, Sophos stops load balancing and then disables HA after three days, so renew both together. The Sophos Firewall licensing page covers this in more detail.
On the hardware side, every 1U model has LAN bypass ports and a second power supply option, and the 2U models have redundant power, SSDs and fans built in.
Virtual and cloud alternatives to XGS hardware
You do not always need a physical box. Sophos Firewall also runs as:
- A virtual appliance on VMware, Microsoft Hyper-V, KVM, Citrix or Nutanix AHV, licensed by CPU cores
- A cloud firewall in AWS or Microsoft Azure, through each marketplace
- A software appliance on your own x86 Intel server
Virtual and cloud firewalls need a separately ordered base licence plus the subscriptions you want, whereas XGS hardware includes the base licence. A common pattern is XGS hardware at each office with a virtual or cloud Sophos Firewall protecting servers in a data centre or in Azure, all managed together in Sophos Fusion.
How we help
Forever Systems supplies XGS appliances, subscriptions and support for UK organisations. We size the appliance, pre-stage it with your configuration, help with zero-touch deployment through Sophos Fusion, and migrate rules from XG, Sophos UTM or another vendor. We can also add Sophos Switch and Sophos Wireless for a single-vendor network.
XGS pricing depends on the appliance, the bundle and the term, so ask us for a quote. Contact us with your user count and line speeds, and we will recommend the right model.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Sophos XG and XGS?
XG was the previous hardware generation and reached end of life on 31 March 2025. XGS is the current range. Both run Sophos Firewall OS, but XGS appliances add Xstream hardware acceleration for TLS inspection and trusted traffic, faster ports and newer resilience options.
Which Sophos XGS appliance do I need?
It depends on your users, internet line speeds, whether you inspect encrypted traffic, VPN and SD-RED needs, and whether you want high availability. Datasheet figures are measured in ideal conditions, so we size on real-world throughput with inspection switched on.
Do Sophos XGS firewalls have built-in Wi-Fi?
Some second-generation desktop models are available with built-in Wi-Fi 6. For larger or multi-room coverage, Sophos recommends cloud-managed AP6 Series access points, which are managed in Sophos Fusion rather than by the firewall.
Can two XGS firewalls run in high availability?
Yes. XGS appliances support active-passive and active-active high availability. In an active-passive pair, licences are applied to the primary and synced to the auxiliary appliance.
Is the base licence included with XGS hardware?
Yes. XGS hardware includes the base licence for networking, wireless, VPN and on-box reporting. Protection subscriptions such as Xstream Protection are added on top, and support (included in every bundle) is needed for firmware updates.