Sophos Firewall
Powerful Protection and Performance
Sophos Firewall and XGS Series appliances with dedicated Xstream Flow
Processors enable the ultimate in application acceleration, high-performance
TLS inspection, and powerful threat protection.

Sophos Firewall

Powerful Protection and Performance
The Sophos Firewall Xstream architecture is engineered to deliver high levels ofvisibility, protection, and performance to address some of the greatest challenges
facing network administrators today.
TLS 1.3 inspection

Application acceleration

Approximately 99% of web traffic is now encrypted, making
it invisible to most firewalls. Many organizations findthemselves powerless to protect their networks from anincreasing amount of ransomware, threats, and potentiallyunwanted apps that are exploiting this blind spot.

A significant portion of your network traffic is trusted
business application traffic destined for branch offices,
remote users, or cloud application servers. As such,no additional security scanning for threats or malware
is needed, and traffic can be intelligently directed to
the FastPath. This reduces latency, optimizes overall
performance, and frees up capacity for traffic that does
need deep packet inspection.

Sophos Firewall makes efficient and effective TLS
inspection possible without compromising on performance.
Our XGS Series appliances with integrated Xstream Flow
Processors put TLS traffic on the FastPath for accelerated
inspection. Our high-performance TLS inspection engine
supports TLS 1.3 without downgrading, the latest cipher
suites for maximum compatibility, and enhanced visibility
into encrypted traffic flows right on the dashboard.

Deep packet inspection
We believe you should never have to decide between
security and performance. Sophos Firewall includes ahigh-speed deep packet inspection (DPI) engine to scan
your traffic for threats without a proxy slowing down theprocess. The firewall stack can completely offload theprocessing to the DPI engine, significantly reducing latency
and improving overall efficiency.
Sophos Firewall blocks the latest ransomware andbreaches with high-performance streaming DPI, including
next-gen IPS, web protection, and app control, as well as
deep learning and sandboxing powered by SophosLabs
IntelixTM.

Sophos Firewall accelerates your SaaS, SD-WAN, and cloud
traffic such as VoIP, video, and other trusted applications
automatically or via your policies – putting them on the
FastPath through the Xstream Flow Processor.

SD-WANManaging application traffic routing over multiple WAN links
and interconnecting a distributed network are essential
elements of any SD-WAN solution. Oftentimes, these tasks
are much more challenging than they should be.
Sophos Firewall with Xstream SD-WAN provides a powerful,
integrated SD-WAN solution, with performance-based
link selection and routing, load balancing, zero-impact
transitions between links in the event of a disruption,
central cloud-managed orchestration, and Xstream
FastPath acceleration of VPN tunnel traffic. Sophos Firewallwith Xstream SD-WAN is one of the best, most flexible
SD-WAN solutions available in any firewall today.

1Sophos Firewall

Sophos Central
Sophos Central is the ultimate cybersecurity cloud management platform tomanage your firewalls and your full portfolio of Sophos security solutions.
Central management

Central reporting

Manage multiple firewalls simply

Firewall reporting in the cloud

Sophos Central makes day-to-day setup, monitoring, andmanagement of your Sophos Firewall easy. It also provides
helpful features such as alerting, backup management,
one-click firmware updates, and rapid provisioning of new
firewalls.

Sophos Central includes powerful reporting tools thatenable you to visualize your network, web, application
activity, and security over time. You get flexible reportingthat combines a variety of built-in reports with powerfultools that you can use to create your own custom reports,
enabling you to report what you want, how you want.

Ì Manage all of your Sophos Firewalls and other
Sophos products from a single console
Ì Configure changes and apply them to a group of
firewalls or manage each firewall individuallyÌ Create a backup schedule and store
up to five backups in the cloudÌ Schedule firmware updates across yourentire network with just a few clicks
Central Management is available at no extra cost.

Ì Increase your visibility into network activity throughanalytics
Ì Analyze data to identify security gaps, suspicious user
behavior, or other events requiring policy changes
Ì Use the pre-defined modules or customize
each report for specific use cases
Central reporting is available at no extra cost for the storage of up to seve days of report
data. Premium options with longer data retention and additional features are available
for optional purchase, either individually or as part of other subscriptions/bundles.

Zero-touch deployment

SD-WAN orchestration

Our enhanced zero-touch deployment allows you to
pre-define, deploy, and then finish the configurationof remote firewalls from Sophos Central without
having to do anything on-site other than plugthem in. A USB drive is no longer required.

Sophos Central makes interconnecting SD-WAN overlay
networks between multiple Sophos Firewalls quick
and easy. With just a few clicks, you can setup a fullmesh network, hub-and-spoke topology, or something
in-between, and Sophos Central will automaticallyconfigure all of the necessary VPN tunnel and firewall
access rules to enable your SD-WAN network.

Learn more about the Sophos Central ecosystem at sophos.com/firewall-central

2Sophos Firewall

Synchronized Security
Active Threat Response
Sophos Firewall is uniquely integrated with other Sophos
products and services to constantly share threat,application, and user information across products toprovide enhanced detection and automatic response toactive threats. When a threat or indicator of compromise
is detected, Sophos Firewall automatically coordinatesa response with endpoints, wireless, ZTNA, email, andother Sophos solutions to stop threats dead in their tracks.
Dynamic firewall rules ensure that compromised devices
are unable to communicate with command-and-control
servers or move around the network.

What Next-Gen Firewalls See Today

You can’t control what you can’t see. All firewalls today
depend on static application signatures to identify apps.
But those don’t work for most custom, obscure, andevasive apps or any apps using generic HTTP or HTTPS.

Sophos Synchronized Security also integrates with Sophos
MDR and XDR, enabling analysts to provide real-time
active threat feed information to the firewall for automatic
response to active threats, dramatically reducing response
time.

Lateral Movement Protection
Lateral Movement Protection automatically isolates
compromised systems at every point in a network to stop
attacks. Healthy endpoints assist by ignoring all traffic fromunhealthy endpoints, enabling complete isolation, even on
the same network segment, to prevent threats and active
adversaries from spreading or stealing data.

What Sophos Firewall Sees

Sophos Firewall uses Synchronized Security toautomatically identify, classify, and control all unknown
applications, easily blocking the apps you don’t want andprioritizing the ones you do.

Synchronized Application Control

Synchronized User ID

Synchronized Application Control utilizes Security
Heartbeat connections with Sophos endpoints toautomatically identify, classify, and control application
traffic. All encrypted, custom, evasive, and generic HTTP or
HTTPS applications that are currently unidentified will be
revealed.

User authentication is critically important in a nextgeneration firewall but often challenging to implement
in a seamless and transparent way. Synchronized User
ID eliminates the need for client or server authentication
agents by sharing the user identity between an endpoint
and the firewall through Security HeartbeatTM.

Synchronized SD-WAN: Powerful, reliable application routing
Synchronized SD-WAN harnesses the power of Synchronized Security to optimize
WAN path selection for your important business applications.
With Synchronized Application Control, discovered applications, that would otherwise be
unknown, can be used for traffic-matching criteria in SD-WAN routing policies. This is yet
another way that Synchronized Security can improve the efficiency of your network.

3

Sophos Firewall

Powerful Protection
See it. Stop it. Secure it.
Our comprehensive next-generation firewall protection has been built to expose hidden risks, block both known andunknown threats, and automatically respond to incidents.

Exposes hidden risks

Blocks unknown threats

Automatically responds to incidents

Superior visibility into unknown
applications, risky activity, suspicious
traffic, and advanced threatshelps you regain control of yournetwork and get deep insights.

Powerful next-gen protection
technologies like deep learningand intrusion prevention keep
your organization safe from thelatest hacks and attacks.

Synchronized Security's automaticthreat response instantly identifies
and isolates compromised systems
on your network to prevent
breaches and lateral movement.

Sophos Managed Detection and Response
More customers trust Sophos for MDR than any other vendor. Using your Sophos Firewall in combination with
Sophos MDR and Sophos Endpoint Protection gives you unmatched protection and more efficient remediation.
Find out more at: sophos.com/mdr

Sophos offers the full network stack managed from a single console: firewalls, switches, and access points.

4

Sophos Firewall

Xstream Protection: A single bundle for ultimate protection
All the next-gen protection, performance, and value you need to power even themost demanding networks. Also available with the XGS Series model of yourchoice included.
Base Firewall Features
Ì Networking and SD-WAN: Wireless, SD-WAN, application-aware routing, traffic shaping
Ì Protection and Performance: Xstream Architecture with Network Flow FastPath, TLS 1.3 inspection, deep packet
inspection
Ì SD-WAN and VPN: Xstream SD-WAN, IPsec/SSL site-to-site and remote access VPN (unlimited), SD-RED site-to-siteÌ Reporting: Historical on-box logging and reporting, Sophos Central cloud reporting (seven-day data retention)

Network Protection

Zero-Day Protection

Web Protection

Ì Xstream TLS Inspection: TLS 1.3

Ì Xstream TLS Inspection: TLS 1.3

Ì Xstream TLS Inspection: TLS 1.3

Ì Xstream DPI engine: Streaming
deep packet inspection

Ì Xstream DPI engine: Streaming
deep packet inspection

Ì Xstream DPI engine: Streaming
deep packet inspection

Ì IPS: Next-gen intrusion
prevention

Ì Web Control: By user, group,
category, URL, keyword

Ì Zero-Day Threat Protection: ML
and Sandboxing analysis of files

Ì ATP: Advanced Threat Protection

Ì Web Threat Protection:from the latest threatsÌ Machine Learning: Using
multiple deep learning models

Ì App Control: By user, group,
category, risk, and more

Ì Cloud Sandboxing: Dynamic runtime analysis of unknown files

Ì Synchronized App Control:
Identify unknown apps

Ì Reporting: Extensive threat
intelligence analysis reportingÌ Synchronized Security:
Automatically identify
and isolate threatsÌ Clientless VPN: HTML5Ì SD-RED VPN: Manage
SD-RED devices
Ì Reporting: Extensive networkand threat reportingÌ Synchronized SD-WAN:
Route unknown apps
Ì Reporting: Extensive web
and app reporting

DNS Protection
Ì Domain name resolution service: Backed by SophosLabs and powered by AI to block malicious or unwanted URLs
Ì High-performance web protection: Across every application, port, or protocol that access a web domain
Ì Granular and easy compliance: Provides network-wide access control to unwanted websites

Sophos Central Management

Sophos Central Orchestration

Ì Group firewall management: Synchronizedpolicy across firewall groups

Ì SD-WAN orchestration: Point-and clicksite-to-site VPN orchestration

Ì Backup and firmware updates:
Storage and schedulingÌ Cloud firewall reporting: Multi-firewall reporting, save,schedule and export reports (30-day data retention)Ì Zero-touch deployment: For new
firewalls from the cloudÌ XDR and MDR connector: Support
for XDR and MDR services

Enhanced Support
5

Sophos Firewall

All Licensing Options
We recommend the Xstream Protection bundle for the ultimate in security. If
you prefer to customize your protection, all subscriptions are also available forindividual purchase.
Xstream Protection Bundle:
Base License

Networking, wireless, Xstream Architecture, unlimited remote access VPN, site-to-site VPN, reporting

Network Protection

Xstream TLS and DPI engine, IPS, ATP, Security Heartbeat, manage SD-RED, reporting

Web Protection

Xstream TLS and DPI engine, web security and control, application control, reporting

Zero-Day Protection

Machine learning and sandboxing file analysis, reporting

DNS Protection

Cloud-based DNS service for web security and complianceCentral Orchestration

SD-WAN VPN orchestration, Central Firewall Advanced Reporting (30-days), MDR/XDR connector

Enhanced Support

24/7 support, feature updates, advanced replacement hardware warranty for term

Custom protection: You can choose the Standard
Protection bundle or purchase any of the protection
modules separately.
Standard Protection Bundle:
Base License

Networking, wireless, Xstream Architecture,
Xstream SD-WAN, unlimited remote
access VPN, site-to-site VPN

Network Protection

Xstream TLS and DPI engine, IPS, ATP, Security
Heartbeat, manage SD-RED, reporting

Web Protection

Xstream TLS and DPI engine, web security
and control, application control, reporting

Enhanced Support

24/7 support, feature updates, advanced
replacement hardware warranty for term

Support: A support subscription is required to receive
firmware upgrades. Enhanced support is included in all
protection bundles, but you can upgrade to enhance yoursupport experience further.
Additional Support Options:
Enhanced Plus
Support Upgrade

Cloud, virtual, and software application licensing options:If you’re deploying Sophos Firewall in the cloud, in a virtualenvironment, or as software on your own hardware, thelicensing guide below can help you find the right option.

Additional Protection Modules:
Email Protection

On-box antispam, AV, DLP, encryption

Web ServerProtection

Web Application Firewall

Upgrade your support with VIP support, HW
warranty for add-ons, TAM option (extra cost)Model
XGS 87(w)
XGS 107(w)Equivalent AWS
instance

Equivalent
Azure VM

Software/
Virtual License*t3.medium-2C4

c5.large

Standard_
F2s_v2-

Sophos Central managing and reporting:

XGS 116(w)

-

-

4C6

Sophos Central Management and Reporting (included at no charge):

XGS 2100c5.xlarge-

6C8

Sophos Central
Management

Group firewall management, backup
management, firmware update scheduling

XGS 2300

m5.xlarge

Standard_
F4s_v2

Sophos Central
Firewall Reporting

Pre-packaged and custom report tools,
with seven days cloud storage for no
extra charge (see other options)

XGS 3100c5.2xlarge

Standard_
F8s_v2

8C16

XGS 4300

c5.4xlarge

Standard_
F16s_v2

16C24

XGS 5500

c5.9xlarge

Standard_
F32s_v2

Unlimited

Additional protection:
Additional Protection Services, Products, and Modules:
Managed Detection
and Response

24/7 threat hunting, detection, and responsedelivered by an expert team (more info)

Sophos Intercept X
Endpoint with XDR

Sophos Central managed next-gen endpoint
protection with EDR (more info)

Zero Trust
Network AccessA ZTNA gateway is integrated into
your firewall. (more info)

Central Email
Advanced

Sophos Central managed antispam,
AV, DLP, encryption (more info)

Sophos Switch

Cloud-managed access layer switches (more info)

Sophos Wireless

Scalable, cloud-managed Wi-Fi (more info)* Based upon CPU cores and RAM

For a complete list of features included in each protection
subscription, see the Sophos Firewall Feature List.

6

Sophos Firewall

Deployment Options

XGS Series

AWS/Azure

VirtualSoftwarePurpose-built devices
to provide the ultimate
in performance.

Protect your network
infrastructure in the
AWS or Azure cloud.

Install on VMware,
Citrix, Microsoft
Hyper-V, and KVM.

Install the Sophos Firewall
OS image on your own
Intel hardware or server.

Cloud

Virtual and software

Sophos Firewall offers the best network visibility, protection,and response capabilities to secure your public, private, andhybrid cloud environments.

Sophos Firewall supports a broad range of virtualization
platforms and can also be deployed as a software applianceon your own x86 Intel hardware.

As an AWS Advanced Technology Partner, Sophos isa validated AWS Security Competency vendor, AWS
Marketplace seller, and AWS Public Sector Partner (PSP).
Sophos Firewall is now available in the AWS Marketplace,with auto-scaling support with either a pay-as-you-go(PAYG) license model or bring your own license (BYOL) tobest fit your needs.

Sophos Firewall is certified and optimized for Azure andis available in the Microsoft Azure Marketplace. Take
advantage of the free test drive or the flexible PAYG or BYOL
licensing options.

See the Licensing section for available licensing options.

Sophos Firewall is Nutanix AHV and Nutanix Flow Ready,bringing the world’s best next-gen firewall visibility,
protection, and response to the industry’s leading hyperconverged infrastructure (HCI) platform. Take advantage
of a 30-day free trial using our KVM image and flexible
licensing.

7

Sophos Firewall

Protection Modules
You can choose from a number of modules to customize the protection offered byyour firewall to your individual needs and deployment scenario.
Base Sophos Firewall

Network protection

The Sophos Firewall Base License includes the Xstream
Architecture, networking, wireless, SD-WAN, VPN, andreporting.

All the protection you need to stop sophisticated attacks
and advanced threats while providing secure network
access to those you trust.

Xstream Architecture
Enables high-performance TLS 1.3 inspection, deep packet
inspection, and network flow FastPath to accelerate trusted
SaaS, SD-WAN, and cloud application traffic. Note that
Network and Web Protection are required to get the full
benefits of the Xstream Architecture.

Next-Gen intrusion prevention system
Provides advanced protection from all types of modern
attacks. It goes beyond traditional server and network
resources to protect users and apps on the network as well.

Xstream SD-WAN and networking
Includes all networking, routing, and SD-WAN capabilities,
including zone-based stateful firewall, NAT, VLAN, SDWAN profiles, performance-based WAN link selection
and monitoring, load balancing, zero-impact WAN linktransitions, and Xstream FastPath acceleration of trusted
application traffic, IPsec VPN traffic, and TLS encrypted
traffic flows.
Secure Wireless
Built-in wireless controller for Sophos APX Wi-Fi 5 accesspoints (no longer sold). Plug-and-play access point
discovery makes setup easy. Support for multiple SSIDs,
hotspots, guest networks, and diverse encryption andsecurity standards.
Wi-Fi 6/6E support is available using our separate, cloudmanaged Wi-Fi solution.

Security Heartbeat
Creates a link between your Sophos Central protected
endpoints and your firewall to identify threats faster,
simplify investigation, and minimize the impact of attacks.
Easily incorporate the Security Heartbeat status into firewall
policies to automatically isolate compromised systems.
Advanced Threat Protection
Instant identification and immediate response to today’s
most sophisticated attacks. Multi-layered protection
identifies threats instantly, and Security Heartbeat provides
an emergency response.
Advanced VPN technologies
Adds unique and simple VPN technologies, including ourclientless HTML5 self-service portal that makes remote
access incredibly simple, plus management for our
exclusive lightweight and secure SD-RED VPN technology.
Network Protection is included in the Xstream and Standard Protection bundles and isalso available for separate purchase.

VPN
Provides standards-based site-to-site and remote access
VPN (free up to the capacity of the firewall), with support
for IPsec and SSL. Sophos Connect remote access VPN
client for Windows and Macs offers seamless and easy
deployment and configuration options. SD-RED layer 2 siteto-site tunnels offer a lightweight robust VPN alternative.
Reporting
Extensive on-box reporting provides valuable insights into
threats, users, applications, web activity, and much more.
Note that specific reporting functionality may be dependent
on other protection modules to get the full benefits (forexample, web protection or web and app reports).
The Base Firewall is included with every appliance.

8

Sophos Firewall

Web protection

Zero-Day Protection

Unmatched visibility and control over all of your users web
and application activity.

AI-driven static and dynamic file analysis techniques
combine to bring unprecedented threat intelligence to yourfirewall and effectively identify and block ransomware andother known and unknown threats.

Powerful user and group web policy
Provides enterprise-level Secure Web Gateway policy
controls to easily manage sophisticated user and groupweb controls. Apply policies based on uploaded web
keywords indicating inappropriate use or behavior.
Application control and QoS
Enables user-aware visibility and control over thousandsof applications with granular policy and traffic-shaping(QoS) options based on application category, risk, andother characteristics. Synchronized Application Control
automatically identifies all unknown, evasive, and custom
applications on your network.
Advanced web threat protection
Backed by SophosLabs, our advanced engine provides
the ultimate protection from today’s polymorphic andobfuscated web threats. Innovative techniques like
JavaScript emulation, behavioral analysis, and origin
reputation help keep your network safe.
High-performance traffic scanning
Optimized for top performance, our Xstream SSL inspection
provides ultra-low latency inspection and HTTPS scanning
while maintaining performance.
Web Protection is included in the Xstream and Standard Protection bundles and is alsoavailable for separate purchase.

DNS Protection
Cloud-based DNS service for added web security andcompliance.

Powered by SophosLabs
Powered by the industry-leading SophosLabs, the Zero-Day
Protection subscription includes a fully cloud-based threat
intelligence and threat analysis platform. This provides deeplearning-based file analysis, detailed analysis reporting, anda threat meter to show the risk summary for a file.
We use layers of analytics to identify known and potential
threats, reduce unknowns, and derive verdicts andintelligence reports for the most commonly used file types.
Static file analysis
By harnessing the power of multiple machine learningmodels, global reputation, deep file scanning, and more,
you can quickly identify threats without the need to execute
files in real time.
Dynamic file analysis
Execute a file in a secure cloud-based sandbox to observe
its behavior and intent. Screenshots provide added insights
into any key events during the analysis.
Threat intelligence analysis reporting
Rich intelligence reports provide you with more than justa "good," "bad," or "unknown" verdict. Full insight into thenature and capabilities of a threat is delivered through theuse of data science and SophosLabs research.
Zero-Day Protection is included in the Xstream Protection bundle and is also available
for separate purchase.

High-performance domain-level protection
Sophos DNS Protection is a cloud-based service providing
DNS resolution and an added layer of web security to yournetworks. It works instantly to block access to unsafe
and unwanted domains across all ports, protocols, andapplications - at the earliest opportunity - from bothmanaged and unmanaged devices.
Integrated Compliance Controls
Easily add an additional layer of compliance controls toyour network to block access to common unwanted site
categories across your entire network.
Powered by AI
Sophos DNS Protection is continually updated by
SophosLabs using the latest in AI analysis to identify
malicious and unwanted sites which are shared across all
customers in real-time as soon as they are discovered.
DNS Protection is included in the Xstream Protection bundle and is not available forseparate purchase.

9

Sophos Firewall

Central Orchestration

Email Protection

Sophos Central cloud-managed VPN orchestration, firewall
reporting, and MDR/XDR integration.

Consolidate your email protection with anti-spam, DLP,
and encryption. We recommend Sophos Central Email
Advanced for the best cloud-based email protection
solution. If you require on-box email protection, this module
offers essential anti-spam, DLP, and encryption.

Sophos Central SD-WAN orchestration
Makes VPN orchestration easy. Wizard-based tunnel
configuration helps create full mesh networks, hub-andspoke models, or complex tunnel setups between multiple
firewalls a quick point-and-click exercise. Seamlessly
integrates multiple WAN link and SD-WAN functionality androuting optimizations to improve resilience performance.
Also integrates with user authentication and Security
Heartbeat to control access.
Central Firewall Reporting Advanced (30 Days)
Cloud-based reporting with several pre-packaged common
reports for threats, compliance, and user activity. Includes
advanced options for creating custom reports and views
with the option to save, schedule, or export your custom
reports. Includes 30 days of log data retention with theoption to add additional storage for more comprehensive
historical reporting requirements.
MDR/XDR connector
Sophos MDR provides optional 24/7 threat hunting,detection, and response delivered by an expert team asa fully managed service. Sophos XDR offers extended
detection and response managed by your team.
Regardless of whether you manage it yourself or Sophos
manages it for you, your Sophos Firewall is ready to share
the necessary threat intelligence and data to the cloud.
Central Orchestration is included in the Xstream Protection bundle and is available forseparate purchase.

Zero Trust Network Access
Provide secure remote access to applications and systems
behind your firewall.
Integrated ZTNA gateway
Sophos Firewall provides an integrated Sophos ZTNA
gateway at no extra cost. This simplifies ZTNA deployments
by eliminating the need for a separate VM gateway, making
deployments faster and easier. Sophos ZTNA is the ultimate
remote access VPN replacement, providing better security,easier management, and a transparent user experience.
ZTNA gateways are available at no extra cost. User-based client licenses for ZTNA are
sold separately.

Integrated message transfer agent
Ensures always-on business continuity for your email,allowing the firewall to automatically queue mail in theevent that servers become unavailable.
Live anti-spam
Provides protection from the latest spam campaigns,
phishing attacks, and malicious attachments.
Self-serve quarantine
Gives employees direct control over their spam quarantine,saving you time and effort.
SPX email encryption
Unique to Sophos, SPX makes it easy to send encryptedemails to anyone, even those without any kind of trust
infrastructure, using our patent-pending password-based
encryption technology.
Data loss prevention
Policy-based DLP can automatically trigger encryption or
block/notify based on the presence of sensitive data inemails leaving the organization.
Email Protection is available for individual purchase only.

Web Server Protection
Harden your web servers and business applications againsthacking attempts and provide secure access.
Business application policy templates
Pre-defined policy templates let you protect common
applications like Microsoft Exchange Outlook Anywhere or
SharePoint quickly and easily.
Protection from the latest hacks and attacks
Offers a variety of advanced protection technologies,
including URL and form hardening, deep-linking anddirectory traversal prevention, SQL injection and cross-site
scripting protection, cookie signing, and more.
Reverse Proxy
Authentication options, SSL offloading, and server loadbalancing ensure maximum protection and performancefor your servers being accessed from the internet.
Web Server Protection is available for individual purchase only.

10

Sophos Firewall

Sophos XGS Series Appliances
All XGS Series firewall appliances are built on a dual-processor architecture,
combining a high-performance, multi-core CPU with a dedicated Xstream Flow
Processor for targeted acceleration at the hardware level. This gives you theflexibility and adaptability of an x86-based firewall plus a significant performance
boost over legacy firewall designs.
Product Matrix
Model

Tech Specs
Form
FactorPorts/Slots(Max Ports)

w-model*Throughput

Swappable Components

Firewall(Mbps)

IPsec VPN
(Mbps)

ThreatProtection(Mbps)

Xstream
SSL/TLS(Mbps)XGS 87(w)Desktop5/- (5)

Wi-Fi 5

n/a

3,850

3,000

280

375

XGS 107(w)Desktop

9/- (9)Wi-Fi 5

Second power supply

7,000

4,000

370

420

XGS 116(w)Desktop

9/1 (9)Wi-Fi 5

2nd power supply, 3G/4G, 5G, Wi-Fi**

7,700

4,800

720

650

XGS 126(w)Desktop14/1 (14)Wi-Fi 5

2nd power supply, 3G/4G, 5G, Wi-Fi**

10,500

5,500

900

800

XGS 136(w)Desktop14/1 (14)Wi-Fi 5

2nd power supply, 3G/4G, 5G, Wi-Fi**

11,500

6,350

1,000

950

XGS 21001U

10/1 (18)n/aOptional external power

30,00017,000

1,250

1,100

XGS 2300

1U

10/1 (18)n/aOptional external power

39,00020,500

1,500

1,450

XGS 31001U

12/1 (20)n/aOptional external power

47,00025,000

2,000

2,470

XGS 33001U

12/1 (20)n/aOptional external power

58,00031,100

3,000

3,130

XGS 43001U

12/2 (28)n/aOptional external power

75,00062,500

6,500

8,000

XGS 45001U

12/2 (28)n/aOptional internal power

80,00075,5508,650

10,600

XGS 55002U

16/3 (48)n/aPower, SSD, Fan

100,000

92,50014,00013,500

XGS 65002U

20/4 (68)n/aPower, SSD, Fan

120,000

109,800

17,85016,000

XGS 75002U

22/4 (70)n/aPower, SSD, Fan

160,000

117,000

26,00019,500

XGS 85002U

22/4 (70)n/aPower, SSD, Fan

190,000

141,000

34,00024,000* 802.11ac** 2nd Wi-Fi module option for XGS 116w, 126w and 136w only

Performance test methodology
General: Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia
BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services
Ì Firewall: Measured using HTTP traffic and 512 KB response size.
Ì Firewall IMIX: UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes.
Ì IPS: Measured with IPS with HTTP traffic using default IPS ruleset and 512 KB object size.
Ì IPsec VPN: HTTP throughput using multiple tunnels and 512 KB HTTP response size.
Ì TLS Inspection: Performance measured with IPS with HTTPS sessions and different cipher suites.
Ì Threat Protection: Measured with firewall, IPS, application control, andmalware prevention enabled using HTTP 200 KB response size.
Ì NGFW: Measured with IPS and application control enabled with HTTP
traffic using default IPS ruleset and 512KB object size.

Need sizing help?
For further assistance in finding the right license or appliance for your needs, speak to your local Sophos sales teamor partner. Sophos offers free sizing assistance and a firewall sizing tool for partners via the Partner Portal.

11

Sophos Firewall

Sophos XGS Series Desktop: SMB and Branch Office
Customers looking for an all-in-one network security solution will appreciate theseamless connectivity options available for our Desktop appliances. With themodularity that small businesses, retail outlets, and branch offices need to growand adapt to changing circumstances, these appliances offer the perfect balance
between price and performance. All Desktop models are optionally available withbuilt-in Wi-Fi.
All models are powered by a high-speed CPU plus a dedicated Xstream Flow
Processor for hardware acceleration.
Product highlights

Product highlights

Ì Dual processor architecture for an excellent
price-to-performance ratio

XGS 87 and XGS 87w
See detailed technical specifications

Ì Every model is available with optional integrated
Wi-Fi for all-in-one connectivity

XGS 107, XGS 107w
See detailed technical specifications

Ì An expansion bay on all XGS 116/126/136
models improves compatibility for 3G/4G and
5G when used with our optional modules

XGS 116, XGS 116w
See detailed technical specifications

Ì An optional second Wi-Fi radio module can be
added to w-models with an expansion bay
Ì Power-over-Ethernet ports built in on all XGS
116, 126, and 136 models (2.5GE on 136)

XGS 126, XGS 126w
See detailed technical specifications
XGS 136, XGS 136w
See detailed technical specifications

Ì A second power supply option for all XGS
1xx models offers a redundancy option
not always seen in this form factor
Ì The SFP port on all models can be used for FTTH/
FTTP or with the optional VDSL modem
Note: All protection features are supported on every XGS
1xx model and most on XGS 87 and 87w.

12

Sophos Firewall

Sophos XGS Series Desktop: SMB and Branch Office
XGS 87 and XGS 87w
Technical specifications
Note: The XGS 87 and 87w do not support some advanced features like on-box reporting, dual AV scanning, WAF AV
scanning, and the email message transfer agent (MTA) functionality. If you need these capabilities, the XGS 107(w) is
recommended.
Front View
Status LEDs
(w-model has
additional WiFi LED)

1x
USB 2.0

Performance

XGS 87(w)Firewall throughput

3,850 Mbps

Firewall IMIX

3,000 Mbps

Firewall Latency (64 byte UDP)

1 x COM
Micro USB

Back View
2 x external antenna(XGS 87w only)

6 µs

IPS throughput

1,200 Mbps

Threat protection throughput

280 Mbps

NGFW

700 Mbps

Concurrent connections

1,600,000

New connections/sec

35,700IPsec VPN throughput

3,000 Mbps

IPsec VPN concurrent tunnels

500

SSL VPN concurrent tunnels

500

Xstream SSL/TLS Inspection

375 Mbps
8,192

Xstream SSL/TLS
concurrent connections
Note: For performance testing methodology, see page 11
1 x COM(RJ45)

Wireless Specification (XGS 87w only)
1 x GbE SFP

Power supply 1 x USB 3.0

No. of antennas

4 x GbE copper port

Physical Specifications
Mounting
Dimensions:
Width X height X depth
WeightRackmount kit available(to be ordered separately)
230 x 44 x 205.5 mm
1.36 kg/3 lbs (unpacked)
2.75 kg/6.06 lbs (packed)(w-model minimally more)

2 x 2:2

Wireless interface

802.11a/b/g/n/ac (2.4 GHz / 5 GHz)

Physical Interfaces
Storage

16 GB eMMC

Ethernet interfaces (fixed)

4 x GbE copper
1 x SFP fiber*

Management ports
Other I/O ports

External auto-ranging AC-DC
100-240VAC, 1.7A@50-60 Hz
12VDC, 5A, 60W

Power consumption

23.2 W / 79.16 BTU/hr (87) (idle)
27.1 W / 92.13 BTU/hr (87w) (idle)
43.4 W / 148.09 BTU/hr (87) (max.)
46.8 W / 159.69 BTU/hr (87w) (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

1 x COM RJ45
1 x Micro-USB (cable incl.)
1 x USB 2.0 (front)
1 x USB 3.0 (rear)

Number of expansion slots

0

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP transceivers

Environment
Power supply

2 external

MIMO capabilities* SFP transceivers sold separately

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, CCC,
KC*, BSMI, RCM, NOM, Anatel*, TEC* XGS 87 only

13

Sophos Firewall

Sophos XGS Series Desktop: SMB and Branch Office
XGS 107, XGS 107w
Technical specifications
Front View

Performance
Status LEDs
(w-model has
additional WiFi LED)

1x
USB 2.0

XGS 107(w)Firewall throughput

7,000 Mbps

Firewall IMIX

3,750 Mbps

Firewall Latency (64 byte UDP)

6 µs

IPS throughput
1 x COM
Micro USB

Back View
2 x external antenna(XGS 107w only)

1,500 Mbps

Threat Protection throughput

370 Mbps

NGFW

1,050 Mbps

Concurrent connections

1,600,000

New connections/sec

44,400IPsec VPN throughput

4,000 Mbps

SSL VPN concurrent tunnels

1,000

IPsec VPN concurrent tunnels

1,000

Xstream SSL/TLS Inspection

420 Mbps

Xstream SSL/TLS
concurrent connections
Note: For performance testing methodology, see page 11

Connector for optional 2nd
redundant power supply
1 x COM(RJ45)

Wireless Specification (XGS 107w only)
1 x GbE SFP

Power supply 1 x USB 3.0

No. of antennas

8 x GbE copper port

Dimensions:
Width X height X depth
WeightRackmount kit available(to be ordered separately)
230 x 44 x 205.5 mm
1.4 kg/3.09 lbs (unpacked)
2.8 kg/6.17 lbs (packed)(w-model minimally more)

Environment
Power supply

External auto-ranging AC-DC
100-240VAC, 1.7A@50-60 Hz
12VDC, 5A, 60W
Optional second redundant power supply

Power consumption

107: 26.1 W/89.06 BTU/hr (idle)
107w: 29.8 W/101.68 BTU/hr (idle)
107: 53.9 W/183.91 BTU/hr (max.)
107w: 57.3 W/195.52 BTU/hr (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

2 external

MIMO capabilities

2 x 2:2

Wireless interface

802.11a/b/g/n/ac (2.4 GHz / 5 GHz)

Physical Interfaces
Storage(local quarantine/logs)

Physical Specifications
Mounting

8,192

Ethernet interfaces (fixed)
Management ports
Other I/O ports

Integrated 64 GB SSD
8 x GbE copper
1 x SFP fiber*
1 x COM RJ45
1 x Micro-USB (cable incl.)
1 x USB 2.0 (front)
1 x USB 3.0 (rear)

Number of expansion slots

0

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP transceivers* SFP transceivers sold separately

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, CCC,
KC*, BSMI, RCM, NOM, Anatel*, TEC, SDPPI** XGS 107 only

14

Sophos Firewall

Sophos XGS Series Desktop: SMB and Branch Office
XGS 116, XGS 116w
Technical specifications
Front View

Performance
Status LEDs
(w-model has
additional WiFi LED)

1x
USB 2.0

XGS 116(w)Firewall throughput

7,700 Mbps

Firewall IMIX

4,500 Mbps

Firewall Latency (64 byte UDP)

8 µs

IPS throughput
1 x COM
Micro USB

Back View
2 x external antenna(XGS 116w only)

2,500 Mbps

Threat Protection throughput

720 Mbps

NGFW

2,000 Mbps

Concurrent connections

1,600,000

New connections/sec

61,500IPsec VPN throughput

4,800 Mbps

IPsec VPN concurrent tunnels

1,500

SSL VPN concurrent tunnels

1,250

Xstream SSL/TLS Inspection

650 Mbps

Xstream SSL/TLS
concurrent connections

8,192

Note: For performance testing methodology, see page 11

1 x COM(RJ45)

Power
supplyF1 1 x SFP
fiber port

1 x GbE
Optional module
copper port expansion bay

1 x USB 3.0 6 x GbE copper port

1 x GbE
PoE port

Connector for optional 2
redundant power supply

Wireless Specification (XGS 116w only)
No. of antennas

2 external

MIMO capabilities

2 x 2:2

Wireless interface

Wi-Fi 5/802.11a/b/g/n/ac(2.4 GHz / 5 GHz)

Optional second Wi-Fi module

Wi-Fi 5/802.11a/b/g/n/acndPhysical Interfaces
Storage(local quarantine/logs)

Physical Specifications
Mounting
Dimensions:
Width X height X depth
WeightRackmount kit available(to be ordered separately)
320 x 44 x 213 mm
2.2 kg/4.85 lbs (unpacked)
4.2 kg/9.26 lbs (packed)(w-model minimally higher)

Integrated 64 GB SSD

Ethernet interfaces (fixed)

8 GbE copper
1 GbE SFP*

Power-over-Ethernet (fixed)

1 x GbE
803.2at (30W max.)Management ports
Other I/O ports

1 x COM RJ45
1 x Micro-USB (cable incl.)
1 x USB 2.0 (front)
1 x USB 3.0 (rear)

Number of expansion slots

1

External auto-ranging AC-DC
100-240VAC, 2.5A@50-60 Hz
12VDC, 12.5A, 150W
Optional second redundant power supply

Optional add-on connectivity

SFP DSL module (VDSL2)
3G/4G module/5G module
Second Wi-Fi radio (XGS 116w only)
SFP transceivers

Power consumption

116: 28 W/96 BTU/hr (idle)
116w: 30 W/102 BTU/hr (idle)
116: 57 W/195 BTU/hr (max.)
116w: 60 W/205 BTU/hr (max.)* SFP transceivers sold separately

PoE addition enabled

38 W/130 BTU/hr (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Environment
Power supply

Humidity

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, CCC,
KC*, BSMI, RCM, NOM, Anatel*, TEC* XGS 116 only

15

Sophos Firewall

Sophos XGS Series Desktop: SMB and Branch Office
XGS 126, XGS 126w, XGS 136, XGS 136w
Technical specifications
Front View
Status LEDs
(w-model has
additional WiFi LED)

1x
USB 2.0

Performance

XGS 126(w)

XGS 136(w)Firewall throughput

10,500 Mbps

11,500 Mbps

Firewall IMIX

5,250 Mbps

6,500 Mbps

Firewall Latency (64 byte UDP)
IPS throughput
1 x COM
Micro USB

Back View
3 x external antenna(XGS 126w/136w only)

8 µs

8 µs

3,250 Mbps

4,000 Mbps

Threat Protection throughput

900 Mbps

1,000 Mbps

NGFW

2,500 Mbps

3,000 Mbps

Concurrent connections

5,000,000

6,400,000

New connections/sec

69,90074,500IPsec VPN throughput

5,500 Mbps

6,350 Mbps

IPsec VPN concurrent tunnels

2,500

2,500

SSL VPN concurrent tunnels

1,500

1,500

Xstream SSL/TLS Inspection

800 Mbps

950 Mbps

Xstream SSL/TLS
concurrent connections

12,28818,432

Note: For performance testing methodology, see page 11

1 x COM(RJ45)

Power
supplyF1–F2 2 x
SFP fiberports

1 x USB 3.0

Optional module
expansion bay

10 x GbE copper port

2 x 2.5 GbE PoE port (136(w))
2 x GbE PoE port (126(w))

Connector for optional 2nd
redundant power supply

Dimensions:
Width X height X depth
WeightNo. of antennas
MIMO capabilities

3 x 3:3

Wireless interface

Wi-Fi 5/802.11a/b/g/n/ac(2.4 GHz / 5 GHz)

Optional 2nd Wi-Fi Module

Wi-Fi 5/802.11a/b/g/n/ac

Storage(local quarantine/logs)
Rackmount kit available(to be ordered separately)
320 x 44 x 213 mm
2.4 kg/5.29 lbs (unpacked)
4.4 kg/9.70 lbs (packed)(w-model minimally higher)

Ethernet interfaces (fixed)

Power-over-Ethernet (fixed)
Management ports
Other I/O ports

Environment
Power supply

Power consumption

External auto-ranging AC-DC
100-240VAC, 2.5A@50-60 Hz
12VDC, 12.5A, 150W
Optional second redundant power supply
126/136: 30 W/102 BTU/hr (idle)
126w/136w: 32 W/109 BTU/hr (idle)
126: 59 W/202 BTU/hr (max.)
126w/136: 62 W/212 BTU/hr (max.)
136w: 65 W/222 BTU/hr (max.)

PoE addition enabled

76 W/260 BTU/hr (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

3 external

Physical Interfaces

Physical Specifications
Mounting

Wireless Specification (XGS 126w and XGS 136w only)

Integrated 64 GB SSD
12 x GbE copper
2 x SFP fiber*

10 x GbE copper2 x 2.5 GbE copper
2 x SFP fiber*

2 x GbE2 x 2.5 GbE(30W max. per port) (30W max. per port)
1 x COM RJ45
1 x Micro-USB (cable incl.)
1 x USB 2.0 (front)
1 x USB 3.0 (rear)

Number of expansion slots

1

Optional add-on connectivity

SFP DSL module (VDSL2)
3G/4G module/5G module
Second Wi-Fi radio(XGS 126w/136w only)
SFP transceivers* SFP transceivers sold separately

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, CCC,
KC*, BSMI, RCM, NOM, Anatel*, TEC, SDPPI†* XGS 126 and XGS 136 only
† XGS 136 only

16

Sophos Firewall

Sophos XGS Series 1U: Distributed Edge
Mid-sized and distributed organizations that need a versatile solution to power andprotect their networks will be well-served with our 1U models. These rackmountfirewalls offer excellent performance, a diverse range of high-speed interfaces
and a choice of add-on connectivity modules. Whether your priority is ensuring
maximum uptime for your SD-WAN links, securely connecting your remote users,
or protecting your growing organization's network, you can tailor these models toyour dynamic environment.
All models are powered by a high-speed CPU plus a dedicated Xstream Flow
Processor for hardware acceleration.
Product highlights

Product highlights

Ì Dual processor architecture supports all key protection
features without compromising performance

XGS 2100See detailed technical specifications

Ì Copper and fiber ports built in

XGS 2300
See detailed technical specifications

Ì LAN bypass ports on every modelÌ Modular Flexi Port expansion bay(s) on
every model to adapt connectivity
Ì Second power supply option for all models
Ì Centrally powered PoE Flexi Port module option
to provide redundant power for PoE devices
Ì Rackmount kit included

XGS 3100See detailed technical specifications
XGS 3300
See detailed technical specifications
XGS 4300
See detailed technical specifications
XGS 4500
See detailed technical specifications

LAN and WAN edge connectivity
Securely connect your branch offices or remote locations to your main office with Sophos SD-RED, Remote Ethernet
Devices, and add connectivity at the LAN edge with our access layer switches and access points. Find out more at theend of this brochure and sophos.com/switch.

17

Sophos Firewall

Sophos XGS Series 1U: Distributed Edge
XGS 2100, XGS 2300
Technical specifications
Front View
Multi-function
LCD display andnavigation

COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

LAN 1–8: 8 x GbE copper –1 bypass pair (ports 1/2)

Performance

XGS 2100

XGS 2300

Firewall throughput

30,000 Mbps

39,000 Mbps

Firewall IMIX

16,500 Mbps

20,000 Mbps

Firewall Latency (64 byte UDP)
IPS throughput
F1–F2 2 x SFP
fiber ports

1 x expansion bay(shown with
optional module)

Back View
Power supply

Power switch

Mounting pins for external
power supply

Connector for external
redundant power supply(available as an option)

USB

6 µs

4 µs

6,000 Mbps

7,000 Mbps

Threat Protection throughput

1,250 Mbps

1,500 Mbps

NGFW

5,200 Mbps

6,300 Mbps

Concurrent connections

6,500,000

6,500,000

New connections/sec

134,700

148,000

IPsec VPN throughput

17,000 Mbps

20,500 Mbps

IPsec VPN concurrent tunnels

5,000

5,000

SSL VPN concurrent tunnels

2,500

2,500

Xstream SSL/TLS Inspection

1,100 Mbps

1,450 Mbps

18,432

18,432

Xstream SSL/TLS
concurrent connections

Note: For performance testing methodology, see page 11

Physical Specifications
Mounting
Dimensions:
Width X height X depth
Weight1U rackmount(2 rackmount ears included)
438 x 44 x 405 mm
4.7 kg/10.36 lbs (unpacked)
7 kg/15.43 lbs (packed)

Physical Interfaces
Storage(local quarantine/logs)
Ethernet interfaces(fixed)Power consumption

Internal auto-ranging AC-DC
100-240VAC, 3-6A@50-60 Hz
External Redundant PSU Option
2100: 43 W/146.86 BTU/hr (idle)
2300: 45 W/153.7 BTU/hr (idle)
2100: 162 W/533.5 BTU/hr (max.)
2300: 167 W/570.74 BTU/hr (max.)

PoE addition enabled

76 W/260 BTU/hr (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

1

Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Certifications

Other I/O ports
Number of Flexi Port slots
Flexi Port modules(optional)

10% to 90%, non-condensing

Product Certifications
CB, CE, UKCA, UL, FCC, ISED, VCCI, KC,
RCM, NOM, Anatel, CCC, BSMI, TEC, SDPPI

8 x GbE copper
2 x SFP fiber*

Bypass port pairs

Environment
Power supply

Integrated min. 120 GB SATA-III SSD

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
1 x USB 2.0 (rear)
1
8 port GbE copper
8 port GbE SFP fiber
4 port 10GE SFP+ fiber
4 port GbE copper bypass (2 pairs)
4 port GbE copper PoE +4 port GbE copper
4 port 2.5 GbE copper PoE
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
18

Max. Power-over-Ethernet(using Flexi Port module)

1 module: 4 ports, 60W max.

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

18

Sophos Firewall

Sophos XGS Series 1U: Distributed Edge
XGS 3100, XGS 3300
Technical specifications
Front View
Multi-function
LCD display
and Navigation

COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

LAN 1–8: 8 x GbE copper –1 bypass pair (ports 1/2)

Performance

XGS 3100

XGS 3300

Firewall throughput

47,000 Mbps

58,000 Mbps

Firewall IMIX

23,500 Mbps

27,000 Mbps

Firewall Latency (64 byte UDP)

F1–F2 2 x SFP+
fiber ports

F3–F4: 2 x SFP
fiber ports

1 x expansion bay(shown with
optional module)

Back View
Power supply

Power switch

Mounting pins for external
power supply

Connector for external
redundant power supply(available as an option)

USB

4 µs

4 µs

IPS throughput

10,500 Mbps

14,000 Mbps

Threat Protection throughput

2,000 Mbps

3,000 Mbps

NGFW

9,000 Mbps

12,500 Mbps

Concurrent connections

12,260,000

13,700,000

New connections/sec

186,500

257,800

IPsec VPN throughput

25,000 Mbps

31,100 Mbps

IPsec VPN concurrent tunnels

6,500

6,500

SSL VPN concurrent tunnels

5,000

5,000

Xstream SSL/TLS Inspection

2,470 Mbps

3,130 Mbps

55,296

102,400

Xstream SSL/TLS
concurrent connections

Note: For performance testing methodology, see page 11

Physical Specifications
Mounting
Dimensions:
Width X height X depth
Weight1U rackmount(2 rackmount ears included)
438 x 44 x 405 mm
4.7 kg/10.36 lbs (unpacked)
7 kg/15.43 lbs (packed)

Environment
Power supply

Power consumption

Internal auto-ranging AC-DC
100-240VAC, 3-6A@50-60 Hz
External Redundant PSU Option
3100: 50 W/170.77 BTU/hr (idle)
3300: 50 W/170.77 BTU/hr (idle)
3100: 182 W/621.97 BTU/hr (max.)
3300: 201 W/686.68 BTU/hr (max.)

PoE addition enabled

76 W/260 BTU/hr (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

Physical Interfaces
Storage(local quarantine/logs)

Integrated min. 240 GB SATA-III SSD

Ethernet interfaces(fixed)Bypass port pairs

1Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Number of Flexi Port slots
Flexi Port modules(optional)

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, KC,
RCM, NOM, Anatel, CCC, BSMI, TEC, SDPPI

8 x GE copper
2 x SFP fiber*
2 x SFP+ 10 GbE fiber*Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
1 x USB 2.0 (rear)
1
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
4 port GbE copper PoE +4 port GbE copper
4 port 2.5 GbE copper PoE
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
20

Max. Power-over-Ethernet(using Flexi Port module)

1 module: 4 ports, 60W max.

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

19

Sophos Firewall

Sophos XGS Series 1U: Distributed Edge
XGS 4300
Technical specifications
Front View
Multi-function
LCD display
and navigation

COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

LAN 5–8: 4 x
2.5 GbE copper

Performance

XGS 4300

Firewall throughput

75,000 Mbps

Firewall IMIX

33,000 Mbps

Firewall Latency (64 byte UDP)
IPS throughput
F1–F4 4 x SFP+
fiber ports

LAN 1–4: 4 x GbE copper– 2 bypass pairs (ports
1/2 and 3/4)

2 x expansionbay (shown with
optional modules)

Back View
Power switch

Mounting pins for external
power supply

Power supply

Connector for external
redundant power supply(available as an option)

Physical Specifications
Mounting
Dimensions:
Width X height X depth
WeightThreat Protection throughput

6,500 Mbps

NGFW

23,000 Mbps

Concurrent connections

16,600,000

New connections/sec

368,000

IPsec VPN throughput

62,500 Mbps

IPsec VPN concurrent tunnels

438 x 44 x 510 mm
8.7 kg/19.18 lbs (unpacked)
14.9 kg/32.85 lbs (packed)

Power supply

Internal auto-ranging AC-DC
100-240VAC, 3.7-7.4A@50-60 Hz
External Redundant PSU Option

Power consumption

131 W/447.43 BTU/hr (idle)
268.35 W/916.56 BTU/hr (max.)

PoE addition enabled

152 W/519 BTU/hr

Operating temperature

0°C to 40°C (operating)-20 to +70°C (storage)

7,500

Xstream SSL/TLS Inspection

8,000 Mbps

Xstream SSL/TLS
concurrent connections

276,480

Note: For performance testing methodology, see page 11

Storage(local quarantine/logs)
Ethernet interfaces(fixed)4 x GbE copper4 x 2.5 GbE copper
4 x SFP+ 10 GbE fiber*
2

Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Number of Flexi Port slots
Flexi Port modules(optional)

10% to 90%, non-condensing

CB, CE, UKCA, UL, FCC, ISED, VCCI, KC,
RCM, NOM, Anatel, CCC, BSMI, TEC, SDPPI

1 x min. 240 GB SATA-III SSD

Bypass port pairs

Product Certifications
Certifications

8,500

SSL VPN concurrent tunnels

Physical Interfaces
1U rackmount (sliding rails incl.)

Environment

Humidity

3 µs
29,500 Mbps

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
4 port GbE copper PoE +4 port GbE copper
4 port 2.5 GbE copper PoE
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
28

Max. Power-over-Ethernet(using Flexi Port module)

2 modules: 4 ports, 60W max. each

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

20

Sophos Firewall

Sophos XGS Series 1U: Distributed Edge
XGS 4500
Technical specifications
Front View
Multi-function
LCD display
and navigation

COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

LAN 5–8: 4 x
2.5 GbE copper

Performance

XGS 4500

Firewall throughput

80,000 Mbps

Firewall IMIX

37,000 Mbps

Firewall Latency (64 byte UDP)

4 µs

IPS throughput
F1–F4 4 x SFP+
fiber ports

LAN 1–4: 4 x GbE copper– 2 bypass pairs (ports
1/2 and 3/4)

2 x expansionbay (shown with
optional modules)

Back View
Power switch

Hot swappable
power supply

Slot for internal
redundant power supply(available as an option)

Physical Specifications
Mounting
Dimensions:
Width X height X depth
WeightPower consumption

438 x 44 x 510 mm
9.7 kg/21.38 lbs (unpacked)
15.9 kg/35.05 lbs (packed)

Internal Hot Swappable auto-ranging
AC-DC 100-240VAC, 3.7-7.4A@50-60 Hz
Internal Redundant PSU Option
151 W/515.74 BTU/hr (idle)
268.35 W/916.56 BTU/hr (max.)

PoE addition enabled

152 W/519 BTU/hr

Operating temperature

0°C to 40°C (operating)-20 to +70°C (storage)

HumidityThreat Protection throughput

8,650 Mbps

NGFW

30,000 Mbps

Concurrent connections

17,200,000

New connections/sec

450,000

IPsec VPN throughput

75,550 Mbps

IPsec VPN concurrent tunnels

8,500

SSL VPN concurrent tunnels

10,000

Xstream SSL/TLS Inspection

10,600 Mbps

Xstream SSL/TLS
concurrent connections

276,480

Note: For performance testing methodology, see page 11

Physical Interfaces
1U rackmount (sliding rails incl.)

Environment
Power supply

36,500 Mbps

Storage(local quarantine/logs)

2 x min. 240 GB SATA-III SSD (SW RAID-1)

Ethernet interfaces(fixed)Bypass port pairs

2Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Number of Flexi Port slots
Flexi Port modules(optional)

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, KC,
RCM, NOM, Anatel, CCC, BSMI, TEC, SDPPI

4 x GbE copper4 x 2.5 GbE copper
4 x SFP+ 10 GbE fiber*Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
4 port GbE copper PoE +4 port GbE copper
4 port 2.5 GbE copper PoE
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
28

Max. Power-over-Ethernet(using Flexi Port module)

2 modules: 4 ports, 60W max. each

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

21

Sophos Firewall

Sophos XGS Series 2U: Enterprise and Campus Edge
Distributed and growing enterprises that require maximum throughput for eventhe most complex network get no-compromise protection, performance, andbusiness continuity with these next-gen firewalls. The Xstream Flow Processors
provide dedicated hardware acceleration to easily handle full-on protection fortoday’s encrypted, cloud-hosted applications and traffic. These models strike theperfect balance between port density and modularity, with a range of high-speed,
built-in ports, plus additional high-density Flexi Port modules available to extend
connectivity even further.
All models are powered by a high-speed CPU plus a dedicated Xstream Flow
Processor for enterprise-grade hardware acceleration.
Product highlights

Product highlights

Ì Dual-processor architecture with dedicatedco-processor for hardware acceleration

XGS 5500
See detailed technical specifications

Ì Built to power all key threat protection features such as
TLS inspection, sandboxing, and AI-driven threat analysis

XGS 6500
See detailed technical specifications

Ì Excellent price-to-performance ratio

XGS 7500
See detailed technical specifications

Ì A range of standard 1 GE copper plus 8 to 12
SFP+ 10 GbE fiber interfaces built inÌ QSPF28 ports on the XGS 7500 and 8500 provide port
speeds of up to 40 Gbps (7500) and 100 Gbps (8500)

XGS 8500
See detailed technical specifications

Ì Optional standard and high-density Flexi Port modules
available to extend and adapt connectivity
Ì Maximum port density of 48 (XGS 5500), 68 (XGS 6500),
or 70 (XGS 7500/8500) using optional modules
Ì Redundancy features on all models
ensure business continuity

22

Sophos Firewall

Sophos XGS Series 2U: Enterprise Edge
XGS 5500
Technical specifications
Front View
Multi-function
LCD display andnavigation

Performance
COM: Micro USB, RJ45, 1 x expansion bay (shown
2 x USB 3.0, MGMT port with optional module)

XGS 5500

Firewall throughput

100,000 Mbps

Firewall IMIX

52,000 Mbps

Firewall Latency (64 byte UDP)
IPS throughput

F1–F4/F5–F8
fiber ports

LAN 1–8: 8 x GbE copper– fixed. Incl. 2 bypass
pairs (ports 1/2 and 3/4)

2 x expansion bay(shown with
optional modules)

5 µs
40,000 Mbps

Threat Protection throughput

14,000 Mbps

NGFW

38,000 Mbps

Concurrent connections

32,400,000

New connections/sec

468,000

IPsec VPN throughput

92,500 Mbps

IPsec VPN concurrent tunnels

Back View
ESD grounding point

2 x hot swappable
power supply

10,000SSL VPN concurrent tunnels

15,000

Xstream SSL/TLS Inspection

13,500 Mbps

Xstream SSL/TLS
concurrent connections

512,000

Note: For performance testing methodology, see page 11

Physical Interfaces
Power switch

Chassis grounding
connections

Ethernet interfaces(fixed)Physical Specifications
Mounting
Dimensions:
Width X height X depth
Weight2U sliding rails (included)
438 x 88 x 645 mm
17.8 kg/39.24 lbs (unpacked)
27 kg/59.53 lbs (packed)

Power supply

2 x hot-swap internal auto-ranging
100-240VAC, 50-60 Hz PSUPower consumption

168.0W/573.81 BTU/h (idle)
478.01W/1117.43 BTU/h (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

2
1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Flexi Port modules(optional)

10% to 90%, non-condensing

CB, CE, UKCA, UL, FCC, ISED, VCCI, BSMI,
RCM, NOM, Anatel, KC, CCC, SDPPI
Planned: TEC

8 x GbE copper
8 x SFP+ 10 GbE fiber*

Management ports

Product Certifications
Certifications

2 x min. 480 GB SATA-III SSD
HW RAID built into CPU

Bypass port pairs

Number of Flexi Port slots

Environment

Humidity

Storage(local quarantine/logs)

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2 + 1 for high-density module
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
2 port 40 GbE QSFP+ fiber
8 port 10 GbE SFP+ fiber
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
2 port 10 GbE Fiber (LC) bypass+ 4 port 10 GbE SFP+ Fiber
High-density module (NIC): 12 port
GE copper + 4 port 2.5 GE copper
48

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

23

Sophos Firewall

Sophos XGS Series 2U: Enterprise Edge
XGS 6500
Technical specifications
Front View
Multi-function
LCD display andnavigation

Performance
COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

2 x expansion bay (shownwith optional modules)

XGS 6500

Firewall throughput

120,000 Mbps

Firewall IMIX

60,000 Mbps

Firewall Latency (64 byte UDP)
IPS throughput

F1–F4/F5–F8/
F9–F12 fiber ports

LAN 1–8: 8 x GbE copper– fixed. Incl. 2 bypass
pairs (ports 1/2 and 3/4)

2 x expansion bay(shown with
optional modules)

5 µs
50,750 Mbps

Threat Protection throughput

17,850 Mbps

NGFW

46,500 Mbps

Concurrent connections

39,900,000

New connections/sec

496,000

IPsec VPN throughput

109,800 Mbps

IPsec VPN concurrent tunnels

Back View
ESD grounding point

2 x hot swappable
power supply

10,000SSL VPN concurrent tunnels

15,000

Xstream SSL/TLS Inspection

16,000 Mbps

Xstream SSL/TLS
concurrent connections

768,000

Note: For performance testing methodology, see page 11

Physical Interfaces
Power switch

Chassis grounding
connections

Ethernet interfaces(fixed)Physical Specifications
Mounting
Dimensions:
Width X height X depth
Weight2U sliding rails (included)
438 x 88 x 645 mm
17.8 kg/39.24 lbs (unpacked)
27 kg/59.53 lbs (packed)

2 x hot-swap internal auto-ranging
100-240VAC, 50-60 Hz PSUPower consumption

188.00 W/642.13 BTU/h (idle)
497.09 W/1697.8 BTU/h (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

2
1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Flexi Port modules(optional)

10% to 90%, non-condensing

CB, CE, UKCA, UL, FCC, ISED, VCCI, BSMI,
RCM, NOM, Anatel, KC, CCC, SDPPI
Planned: TEC

8 x GbE copper
12 x SFP+ 10 GbE fiber*

Management ports

Product Certifications
Certifications

2 x min. 480 GB SATA-III SSD
HW RAID built into CPU

Bypass port pairs

Number of Flexi Port slots

Environment
Power supply

Storage(local quarantine/logs)

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2 + 2 for high-density module
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
2 port 40 GbE QSFP+ fiber
8 port 10 GbE SFP+ fiber
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
2 port 10 GbE Fiber (LC) bypass+ 4 port 10 GbE SFP+ Fiber
High-density module (NIC): 12 port
GE copper + 4 port 2.5 GE copper
68

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

24

Sophos Firewall

Sophos XGS Series 2U: Enterprise/Campus Edge
XGS 7500
Technical specifications
Front View
Multi-function
LCD display andnavigation

Performance
COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

2 x large expansion bay (shown with
optional High-Density modules)

XGS 7500

Firewall throughput

160,000 Mbps

Firewall IMIX

70,500 Mbps

Firewall Latency (64 byte UDP)

F1–12 SFP+
fiber/DAC ports

F13–F14 QSFP28
fiber/DAC ports(max. 40 Gbps)

LAN 1–8: 8 x GbE copper –fixed. Incl. 2 bypass pairs(ports 1/2 and 3/4)

2 x expansion bay(shown with
optional modules)

Back View
ESD grounding point

2 x hot swappable
power supply

5.4 µsIPS throughput

71,500 Mbps

Threat Protection throughput

26,000 Mbps

NGFW

58,000 Mbps

Concurrent connections

48,000,000

New connections/sec

1,100,000

IPsec VPN throughput

117,000 Mbps

IPsec VPN concurrent tunnels

12,500SSL VPN concurrent tunnels

19,000

Xstream SSL/TLS Inspection

19,500 Mbps

Xstream SSL/TLS
concurrentconnections

1,280,000

Note: For performance testing methodology, see page 11

Physical Interfaces
Power switch

Chassis grounding
connections

Physical Specifications
Mounting

2U sliding rails (included)

Dimensions:
Width X height X depth

438 x 88 x 645 mm
17.24 x 3.46 x 25.39 inches

Weight18 kg/39.68 lbs (unpacked)
27.3 kg/60.19 lbs (packed)

Storage(local quarantine/logs)

2 x min. 960 GB NVMe SSD
HW RAID built into CPU

Ethernet interfaces(fixed)8 x GbE copper
12 x SFP+ 10 GbE fiber*
2 x QSFP28 (up to 40 Gbps)

Bypass port pairs

2Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Other I/O ports
Environment
Power supply

Number of Flexi Port slots
2 x hot-swap internal auto-ranging
100-240VAC, 50-60 Hz PSUPower consumption

306 W/1,044 BTU/h (idle)
635 W/2,165 BTU/h (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

Flexi Port modules(optional)

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, BSMI,
RCM, NOM, KC, SDPPI, Anatel, CCC.
Planned: TEC

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2 + 2 for high-density module
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
2 port 40 GbE QSFP+ fiber
8 port 10 GbE SFP+ fiber
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
2 port 10 GbE Fiber (LC) bypass+ 4 port 10 GbE SFP+ Fiber
High-density module (NIC): 12 port
GE copper + 4 port 2.5 GE copper
70

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

25

Sophos Firewall

Sophos XGS Series 2U: Enterprise/Campus Edge
XGS 8500
Technical specifications
Front View
Multi-function
LCD display andnavigation

Performance
COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port

2 x large expansion bay (shown with
optional High-Density modules)

XGS 8500

Firewall throughput

190,000 Mbps

Firewall IMIX

81,000 Mbps

Firewall Latency (64 byte UDP)

F1–12 SFP+
fiber/DAC ports

F13–F14 QSFP28
fiber/DAC ports(max. 100 Gbps)

LAN 1–8: 8 x GbE copper –fixed. Incl. 2 bypass pairs(ports 1/2 and 3/4)

2 x expansion bay(shown with
optional modules)

Back View
ESD grounding point

2 x hot swappable
power supply

5.5 µsIPS throughput

93,000 Mbps

Threat Protection throughput

34,000 Mbps

NGFW

76,000 Mbps

Concurrent connections

58,000,000

New connections/sec

1,700,000

IPsec VPN throughput

141,000 Mbps

IPsec VPN concurrent tunnels

15,000SSL VPN concurrent tunnels

24,000

Xstream SSL/TLS Inspection

24,000 Mbps

Xstream SSL/TLS
concurrent connections

2,500,000

Note: For performance testing methodology, see page 11

Physical Interfaces
Power switch

Chassis grounding
connections

Physical Specifications
Mounting

2U sliding rails (included)

Dimensions:
Width X height X depth

438 x 88 x 645 mm
17.24 x 3.46 x 25.39 inches

Weight18 kg/39.68 lbs (unpacked)
27.3 kg/60.19 lbs (packed)

Ethernet interfaces(fixed)8 x GbE copper
12 x SFP+ 10 GbE fiber*
2 x QSFP28 (up to 100 Gbps)

Bypass port pairs

2Management ports

1 x RJ45 MGMT
1 x COM RJ45
1 x Micro-USB (cable incl.)

Number of Flexi Port slots
2 x hot-swap internal auto-ranging
100-240VAC, 50-60 Hz PSUPower consumption

318 W/1,085 BTU/h (idle)
645 W/2,200 BTU/h (max.)

Operating temperature

0°C to 40°C (operating)-20°C to +70°C (storage)

Humidity

2 x min. 960 GB NVMe SSD
HW RAID built into CPU

Other I/O ports

Environment
Power supply

Storage(local quarantine/logs)

Flexi Port modules(optional)

10% to 90%, non-condensing

Product Certifications
Certifications

CB, CE, UKCA, UL, FCC, ISED, VCCI, BSMI,
RCM, NOM, KC, SDPPI, Anatel, CCC.
Planned: TEC

Max. total port density(incl. use of modules)

2 x USB 3.0 (front)
2 + 2 for high-density module
8 port GbE copper
8 port GbE SFP fiber
4 port 10 GbE SFP+ fiber
4 port GbE copper bypass (2 pairs)
2 port 40 GbE QSFP+ fiber
8 port 10 GbE SFP+ fiber
2 port GbE Fiber (LC) bypass+ 4 port GbE SFP Fiber
2 port 10 GbE Fiber (LC) bypass+ 4 port 10 GbE SFP+ Fiber
High-density module (NIC): 12 port
GE copper + 4 port 2.5 GE copper
70

Optional add-on connectivity

SFP DSL module (VDSL2)
SFP/SFP+ Transceivers

Display

Multi-function LCD module* Transceivers (mini GBICs) sold separately

26

Sophos Firewall

Adapt Connectivity with Optional Modules
Connectivity modules
Add additional connectivity options to your appliances to enhance the range and performance of your network.

XGS Series: Optional connectivity modules
Desktop Modules

Other Connectivity Options

SFP VDSL2 Modem
For all XGS and XG Series with an SFP port

2nd Wi-Fi 5 Module

3G/4G Module

Optional Transceivers

For XGS 116w, 126w, and 136w only
(not compatible with XG Series)

For XGS 116(w), 126(w), and 136(w) models only
(not compatible with XG Series)

A range of optional transceivers areavailable, incl. SFP, SFP+

5G Module
For XGS 116(w), 126(w), and 136(w) models only
(not compatible with XG Series)

XGS Series: Desktop accessory matrix by model
Redundancy

Connectivity

Mounting

Model

Power

Expansion Bay

3G/4G module/
5G module

Wi-Fi Options

VDSL SFP Modem

Rackmount Kit

XGS 87

n/a

n/a

n/a

n/a

Optional

Optional

XGS 87w

n/a

n/a

n/a

Built inOptional

Optional

XGS 107

Optional 2nd power supply

n/a

n/a

n/a

Optional

Optional

XGS 107w

Optional 2nd power supply

n/a

n/a

Built inOptional

Optional

XGS 116

Optional 2nd power supply

1

Optional

n/aOptional

Optional

XGS 116w

Optional 2nd power supply

1

Optional

Built inOptional 2nd module

Optional

Optional

XGS 126

Optional 2nd power supply

1

Optional

n/aOptional

Optional

XGS 126w

Optional 2nd power supply

1

Optional

Built inOptional 2nd module

Optional

Optional

XGS 136

Optional 2nd power supply

1

Optional

n/aOptional

Optional

XGS 136w

Optional 2nd power supply

1

Optional

Built inOptional 2nd module

Optional

Optional

27

Sophos Firewall

Flexi Port modules for 1U and 2U
Configure your hardware to suit your infrastructure and change it as needed. Our optional Flexi Port LAN modules give you
the freedom to select the connectivity you need: copper, fiber, 10GbE, and 40GbE – you decide.
XGS Rackmount Models

For XGS 2xxx/3xxx/4xxx only

For XGS 2U Rackmount Models only

8 Port 1G copper

4 Port 1G copper PoE + 4 Port 1G copper

2 Port 40G QSFP+

8 Port 1G SFP

4 Port 2.5G copper PoE

8 Port 10G SFP+

4 Port 10G SFP+

2 port 10 GbE Fiber (LC) bypass +4 port 10 GbE SFP+ Fiber

4 Port 1G copper bypass (2 pairs)

High-Density Flexi Port Module (NIC)
12 Port 1G copper + 4 Port 2.5G copper

2 port GbE Fiber (LC) bypass +4 port GbE SFP Fiber
Note: XGS modules are not compatible with any previous XG Series appliances

28

Sophos Firewall

XGS Series: 1U Accessory matrix by model
Redundancy
Model

Modular Connectivity

Mounting

Power

2nd SSDVDSL SFP Modem

Flexi Port Bays

Flexi Port Modules

Rackmount Kit

XGS 2100

Optional externaln/aOptional

1

8 Port 1G copper
8 Port 1G SFP
4 Port 10G SFP+
4 Port 1G copper bypass
4 port 1G copper PoE+ 4 port 1G copperÌ 4 port 2.5G copper PoE
Ì 2 port GbE Fiber(LC) bypass + 4 port
GbE SFP Fiber

Rackmount ears incl.
Optional sliding rails

XGS 2300

Optional externaln/aOptional

1

XGS 3100

Optional externaln/aOptional

1

XGS 3300

Optional externaln/aOptional

1

XGS 4300

Optional externaln/aOptional

2

Sliding rails included

XGS 4500

Optional internalInternal redundant SSD

Optional

2

Sliding rails included

Ì
Ì
Ì
Ì
Ì

Rackmount ears incl.
Optional sliding rails
Rackmount ears incl.
Optional sliding rails
Rackmount ears incl.
Optional sliding rails

XGS Series: 2U Accessory matrix by model
Redundancy
Model

Modular Connectivity

Power

SSD

VDSL SFP Modem

Flexi Port Bays

XGS 5500

Included

2nd redundant
SSD included

Optional

2 + 1 for
High-density
moduleXGS 6500

Included

2nd redundant
SSD included

Optional

2 + 2 for
High-density
modules

XGS 7500

Included

2nd redundant NVMe
SSD included

Optional

2 + 2 for
High-density
modules

XGS 8500

Included

2nd redundant NVMe
SSD included

Optional

2 + 2 for
High-density
modulesMounting

Flexi Port Modules

Rackmount Kit

8 Port 1G copper
8 Port 1G SFP
4 Port 10G SFP+
4 Port 1G copper bypass
2 port 40G QSFP+
8 port 10G SFP+
2 port GbE Fiber(LC) bypass + 4 port
GbE SFP FiberÌ 2 port 10 GbE Fiber(LC) bypass + 4 port
10 GbE SFP+ FiberÌ High-Density Flexi
Port module (NIC) 12
Port 1G copper + 4
Port 2.5G copper

Sliding rails included

Ì
Ì
Ì
Ì
Ì
Ì
Ì

Sliding rails included

Sliding rails included

Sliding rails included

29

Sophos Firewall

Sophos Wireless Protection
simple, secure, reliable

Sophos offers three different options for wireless protection:
Hardware appliances withintegrated Wi-Fi
All of our XGS Series desktop appliances are available with an integrated wireless access point. This option is ideal for small
environments such as retail outlets where an all-in-one solution is preferred.

Firewall as a controller
This option supports our end-of-sale Wi-Fi 5 APX Series access points only.
Using Sophos Firewall as a wireless controller, supported Sophos access points are automatically discovered when they’reconnected, allowing you to configure a variety of corporate, guest, or contractor wireless networks quickly and easily.

Cloud-managed Wi-Fi
Sophos Wireless is our Sophos Central-managed Wi-Fi solution. It offers the broadest feature set, the best scalability, andsupport for the latest generation of Wi-Fi 6/6E access points, the AP6 Series.
AP6 Series models
Ì AP6 420 – 2x2 indoor Wi-Fi 6
Ì AP6 420E – 2x2 indoor Wi-Fi 6/6E
Ì AP6 840 – 4x4 indoor Wi-Fi 6
Ì AP6 840E – 4x4 indoor Wi-Fi 6/6E
Ì AP6 420X – 2x2 outdoor Wi-Fi 6
All models come with a limited lifetime warranty.
Sophos Central management of AP6
A support subscription is required to manage an AP6 Series access point in Sophos Central.
Local management of AP6
Each AP6 Series includes a local management option that does not require an additional subscription.
As a single management platform for all of your Sophos security solutions, Sophos Central puts your Wi-Fi management
just one click away from your firewalls and switches, endpoint and server security, email protection, and more.

30

Sophos Firewall

SD-RED
Sophos SD-RED: Empowering your SD-WAN strategy
Sophos has long been a pioneer in providing an easy-to-use and secure way to connect branch offices and otherremote locations. Sophos Firewall includes comprehensive SD-WAN features to help you accelerate application
performance and get better visibility into network health to ensure that your remote locations enjoy the same
performance as your main office.
Our SD-RED devices work with your Sophos Firewall independent of whether you have a hardware, software, or
public cloud deployment. Our APX Series access points are also compatible with Sophos SD-RED.
To manage Sophos SD-RED, you need to have an active Network Protection subscription.

Technical specifications
Model

SD-RED 20

SD-RED 60

250 Mbps

850 Mbps

Capacity
Maximum throughput
Physical interfaces (Built-in)
LAN interfaces

4 x 10/100/1000 Base-TX (1 GbE copper)

4 x 10/100/1000 Base-TX (1 GbE copper)

WAN interfaces

1 x 10/100/1000 Base-TX (shared with SFP)

2 x 10/100/1000 Base-TX (WAN1 shared port with SFP)SFP interfaces

1x SFP fiber (shared port with WAN)

1x SFP fiber (shared port with WAN1)

None

2 PoE ports (total power 30W)

USB ports

2 x USB 3.0 (front and rear)

2 x USB 3.0 (front and rear)

COM ports

1 x micro-USB

1 x micro-USB

Power-over-Ethernet ports

Optional Connectivity
Modular bay
Optional Wi-Fi module
Optional 3G/4G LTE module

1 (for use with optional Wi-Fi OR 4G/LTE card)

1 (for use with optional Wi-Fi OR 4G/LTE card)

802.11 a/b/g/n/ac Wave 1 (Wi-Fi 5) dual-band capable2 x 2 MIMO 2 antennas

802.11 a/b/g/n/ac Wave 1 (Wi-Fi 5) dual-band capable2 x 2 MIMO 2 antennas

MC7430/MC7455 Sierra Wireless Card

MC7430/MC7455 Sierra Wireless Card

Optional SFP modem (support coming in future release)

Optional SFP modem (support coming in future release)

225 x 44 x 150 mm
8.86 x 1.73 x 5.91 inches

225 x 44 x 150 mm
8.86 x 1.73 x 5.91 inches

0.9 kg/1.8 kg (1.98 lbs/3.97 lbs) Unpacked/Packed

1.0 kg/2.2 kg (2.2 lbs/4.85 lbs) Unpacked/Packed

Power supply adapter

AC Input: 110-240VAC @50-60 Hz
DC Output: 12V +/- 10%, 3.7A, 40W

AC Input: 110-240VAC @50-60 Hz
DC Output: 12V +/- 10%, 6.95A, 75W

Power redundancy support

Yes, optional second power supply

Yes, optional second power supply

6.1W, 20.814 BTU (idle)
22.6W, 77.114 BTU (full load)

11.88W, 40.536 BTU/h (idle)
25.33W, 86.429 BTU/h (full load without PoE)
62.48W, 213.190 BTU/h (full load with PoE)

Optional VDSL modem
Physical Specifications
Dimensions:
Width x height x depth
WeightPower consumption
Temperature (operational)

0°C to 40°C (32°F to 104°F)

0°C to 40°C (32°F to 104°F)

Temperature (storage)-20°C to 70°C (-4°F to 158°F)-20°C to 70°C (-4°F to 158°F)

Humidity

10% to 90%, non-condensing

10% to 90%, non-condensing

CE/FCC/IC/RCM/VCCI/CB/UL/CCC/KC/ANATEL

CE/FCC/IC/RCM/VCCI/CB/UL/CCC/KC/ANATEL

Safety Regulations
Certifications (safety, EMC, radio)

See sophos.com/compare-xgs for further technical details.

31

Sophos Firewall

Sophos Switch
Access layer switches
The Sophos Switch Series offers a range of network access layer switches to connect and power
the devices connecting to your local area network (LAN) while adding security controls andsegmentation at the all-important LAN edge. Our switches can be managed from Sophos Central
alongside all of your Sophos solutions. A local user interface is also available.

Technical specifications
1G Models
8-Port: CS101-8, CS101-8FP

8 x 1G, 2 x SFP. FP = Full PoE (110W)

24-Port: CS110-24, CS110-24FP

24 x 1G, 4 x SFP+. FP = Full PoE (410W)

48-Port: CS110-48, CS110-48P, CS110-48FP

48 x 1G, 4 x SFP+. P = Partial PoE (410W). FP = Full PoE (740W)

2.5G Models
8-Port: CS210-8FP

8 x 2.5G, 4 x SFP+. FP = Full PoE (240W). This model supports 802.3bt.

24-Port: CS210-24FP

16 x 1G, 8 x 2.5G, 4 x SFP+. FP = Full PoE (410W).

48-Port: CS210-48FP

32 x 1G, 16 x 2.5G, 4 x SFP+. FP = Full PoE (740W)

Deployment Options
While most 24- and 48-port models will find their future home in a rack, our entry-level 8-port
models are also suitable for wall mounting or desktop use, making them the ideal choice for
deployments outside of a standard data center environment. All of our switches come with amounting kit.
See sophos.com/switch for further details.

32

Sophos Firewall

Further Resources
We have a broad range of resources available where you can find out more about Sophos
Firewall and related products.
Ì Sophos Firewall Web – sophos.com/firewall
Ì XGS Series Hardware models – sophos.com/compare-xgs
Ì Sophos Firewall Ecosystem: Add-ons and accessories – sophos.com/firewall-ecosystemÌ Sophos Switch - sophos.com/switch
Ì Sophos Wireless – sophos.com/wirelessÌ Sophos Zero Trust Network Access - sophos.com/ztna
Ì Sophos Managed Detection and Response - sophos.com/mdr

Try It for Free – for Business and Home Use
If you have any questions, visit sophos.com or give us a call.

Free 30-day trial - no strings attached
If you’d like to take it for a test drive, you can get the full-featured
product. Simply sign-up for our free 30-day trial.

See it in action now
You can take a walkthrough of the user interface with our interactive demo or watch videos
showing you just how we make network security simple.
Visit sophos.com/firewall for more information.

Free home use version
Our Sophos Firewall Home Edition is a fully equipped software version that gives you complete
network, web, mail, and web application security with VPN functionality for home-use only andlimited to four virtual cores and 6 GB of RAM. Visit sophos.com/freetools for more information.

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
24-06-4 BR-EN (MP)Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com