Sophos XGS 87w
Unleash the full potential of your network

Approximately 99% of web traffic is now encrypted, making it invisible to most firewalls. Many organizations find themselves powerless to protect their networks from an increasing amount of ransomware, threats and potentially unwanted apps which are exploiting this blind spot.

Sophos Firewall makes efficient and effective TLS inspection possible without compromising on performance. Our XGS Series appliances with integrated Xstream Flow Processors put TLS traffic on the FastPath for accelerated inspection. And our high-performance TLS inspection engine supports TLS 1.3 without downgrading, the latest cypher suites for maximum compatibility, and enhanced visibility into encrypted traffic flows right on the dashboard.

We believe you should never have to decide between security and performance. Sophos Firewall includes a highspeed deep packet inspection (DPI) engine to scan your traffic for threats without a proxy slowing down the process. The firewall stack can completely offload the processing to the DPI engine, significantly reducing latency and so improving overall efficiency.

Sophos Firewall blocks the latest ransomware and breaches with high-performance streaming DPI including next-gen IPS, web protection, and app control, as well as deep learning and sandboxing powered by SophosLabs Intelix.

A significant portion of your network traffic is trusted business application traffic destined for branch offices, remote users, or cloud application servers. As such, no additional security scanning for threats or malware is needed, and it can be intelligently directed to the FastPath, reducing latency, optimizing overall performance, and freeing up capacity for traffic that does need deep packet inspection.

Sophos Firewall accelerates your SaaS, SD-WAN, and cloud traffic such as VoIP, video, and other trusted applications automatically or via your own policies – putting them on the FastPath through the Xstream Flow Processor.

Managing application traffic routing over multiple WAN links, and interconnecting a distributed network are essential elements of any SD-WAN solution. Often these tasks are much more challenging than they should be.

Sophos Firewall with Xstream SD-WAN provides a powerful, integrated SD-WAN solution, with performance-based link selection and routing, load balancing, zero-impact transitions between links in the event of a disruption, central cloud-managed orchestration, and Xstream FastPath acceleration of VPN tunnel traffic. Sophos Firewall with Xstream SD-WAN is one of the best, most flexible SDWAN solutions available in any firewall today.

Zero-Touch Deployment

Zero-touch deployment enables the initial configuration to be performed in Sophos Central and then exported for loading onto the device from a flash drive at startup, automatically connecting the device back to Sophos Central.

SD-WAN Orchestration

Sophos Central makes interconnecting SD-WAN overlay networks between multiple Sophos Firewalls quick and easy. With just a few clicks you can setup a full mesh network, hub-and-spoke topology, or something in-between, and Sophos Central will automatically configure all the necessary VPN tunnel and firewall access rules to enable your SD-WAN network.

Security Heartbeat: Your firewall and your endpoints are finally talking

Sophos Firewall is the only network security solution that is able to fully identify the user and source of an infection on your network, and automatically limit access to other network resources in response. Our unique Security Heartbeat shares telemetry and health status between Sophos endpoints and your firewall and integrates endpoint health into firewall rules to control access and isolate compromised systems.

Synchronized Application Control

Using Security Heartbeat, we also have a solution to one of the biggest problems most network administrators face today – lack of visibility into network traffic.
Synchronized Application Control utilizes the Heartbeat connections with Sophos endpoints to automatically identify, classify, and control application traffic. All encrypted, custom, evasive, and generic HTTP or HTTPS applications which are currently going unidentified will be revealed.

Lateral Movement Protection

Lateral Movement Protection automatically isolates compromised systems at every point in the network to stop attacks. Healthy endpoints assist by ignoring all traffic from unhealthy endpoints, enabling complete isolation, even on the same network segment, to prevent threats and active adversaries from spreading or stealing data.

Synchronized User ID

User authentication is critically important in a nextgeneration firewall but often challenging to implement in a seamless and transparent way. Synchronized User ID eliminates the need for client or server authentication agents by sharing user identity between the endpoint and the firewall through Security Heartbeat.

Expose Hidden
Risks

Superior visibility into unknown applications, risky activity, suspicious traffic, and advanced threats helps you regain control of your network and get deeper insights.

Blocks unknown
threats

Powerful next-gen protection technologies like deep learning and intrusion prevention keep your organization secure from the latest hacks and attacks.

Automatically responds to incidents

Synchronized Security automatic threat response instantly identifies and isolates compromised systems on your network to prevent breaches and lateral movement.

XGS Series

Purpose-built devices to provide the ultimate in performance.

AWS/Azure

Protect your network infrastructure in the AWS or Azure cloud.

Virtual

Install on VMware, Citrix, Microsoft Hyper-V, and KVM.

Software

Install the Sophos Firewall OS image on your own Intel hardware or server.

Xstream SD-WAN and Networking

Includes all networking, routing, and SD-WAN capabilities including zone-based stateful firewall, NAT, VLAN, SDWAN profiles, performance-based WAN link selection and monitoring, load balancing, zero-impact WAN link transitions, and Xstream FastPath acceleration of trusted application traffic.

VPN

Provides standards-based site-to-site and remote access VPN (free up to the capacity of the firewall) with support for IPsec and SSL. Sophos Connect remote access VPN client for Windows and Macs offers seamless and easy deployment and configuration options. SD-RED layer 2 siteto-site tunnels offers a light-weight robust VPN alternative.

Reporting

Extensive on-box reporting provides valuable insights into threats, users, applications, web activity, and much more. Note that specific reporting functionality may be dependent on other protection modules to get the full benefits (for example, Web Protection or web and app reports).

Xstream Architecture

Enables high performance TLS 1.3 inspection, deep-packet inspection, and network flow FastPath to accelerate trusted SaaS, SD-WAN, and cloud application traffic. Note that Network and Web Protection are required to get the full benefits of the Xstream Architecture.

Secure Wireless

Built-in wireless controller for Sophos APX wireless access points. Plug-and-play access point discovery makes setup easy. Support for multiple SSIDs, hotspots, guest networks, and the diverse encryption and security standards.

Next-Gen Intrusion Prevention System

Provides advanced protection from all types of modern attacks. It goes beyond traditional server and network resources to protect users and apps on the network as well.

Advanced Threat Protection

Instant identification and immediate response to today’s most sophisticated attacks. Multi-layered protection identifies threats instantly and Security Heartbeat provides an emergency response.

Security Heartbeat

Creates a link between your Sophos Central protected endpoints and your firewall to identify threats faster, simplify investigation, and minimize impact from attacks. Easily incorporate Heartbeat status into firewall policies to automatically isolate compromised systems.

Advanced VPN technologies

Adds unique and simple VPN technologies, including our clientless HTML5 self-service portal that makes remote access incredibly simple plus management for our exclusive light-weight secure SD-RED (Remote Ethernet Device) VPN technology.

Powerful user and group web policy

Provides enterprise-level Secure Web Gateway policy controls to easily manage sophisticated user and group web controls. Apply policies based upon uploaded web keywords indicating inappropriate use or behavior.

High-performance traffic scanning

Optimized for top performance, our Xstream SSL inspection provides ultra-low latency inspection and HTTPS scanning while maintaining performance

Application Control and QoS

Enables user-aware visibility and control over thousands of applications with granular policy and traffic-shaping (QoS) options based on application category, risk, and other characteristics. Synchronized Application Control automatically identifies all the unknown, evasive, and custom applications on your network.

Advanced Web Threat Protection

Backed by SophosLabs, our advanced engine provides the ultimate protection from today’s polymorphic and obfuscated web threats. Innovative techniques like JavaScript emulation, behavioral analysis, and origin reputation help keep your network safe.

Powered by SophosLabs

Powered by the industry-leading SophosLabs, the Zero-Day Protection subscription includes a fully cloud-based threat intelligence and threat analysis platform. This provides deep learning-based file analysis, detailed analysis reporting, and a threat meter to show the risk summary for a file

Threat Intelligence Analysis Reporting

Rich intelligence reports provide you with much more than just a ‘good,' ‘bad,' or ‘unknown’ verdict. Full insight into the nature and capabilities of a threat are delivered through the use of data science and SophosLabs research.

Dynamic File Analysis

Execute a file in a secure cloud-based sandbox to observe its behavior and intent. Screenshots provide added insight into any key events during the analysis.

Static File Analysis

By harnessing the power of multiple machine learning models, global reputation, deep file scanning, and more, you can quickly identify threats without the need to execute the files in real time.

Sophos Central SD-WAN Orchestration

Makes VPN orchestration easy. Wizard-based tunnel configuration helps create full mesh networks, hub-andspoke models, or complex tunnel setups between multiple firewalls a quick point-and-click exercise. Seamlessly integrates multiple WAN link and SD-WAN functionality and routing optimizations to improve resilience and performance.

Central Firewall Reporting Advanced (30-day)

Cloud-based reporting with several pre-packaged common reports for threats, compliance, and user activity. Includes advanced options for creating custom reports and views with the option to save, schedule or export your custom reports. Includes 30 days of log data retention with the option to add additional storage for additional historical reporting needs.

MDR/XDR Connector

Sophos MDR provides optional 24/7 threat hunting, detection and response delivered by an expert team as a fully-managed service. Sophos XDR offers extended detection and response managed by your own team. Regardless of whether you manage it yourself, or Sophos manages it for you, your Sophos Firewall is ready to share the necessary threat intelligence and data to the cloud.

Integrated Message Transfer Agent

Ensures always-on business continuity for your email, allowing the firewall to automatically queue mail in the event servers become unavailable.

SPX Email Encryption

Unique to Sophos, SPX makes it easy to send encrypted email to anyone, even those without any kind of trust infrastructure, using our patent-pending password-based encryption technology.

Data Loss Prevention

Policy-based DLP can automatically trigger encryption or block/notify based on the presence of sensitive data in emails leaving the organization

Live Anti-Spam

Provides protection from the latest spam campaigns, phishing attacks, and malicious attachments.

Self-serve Quarantine

Gives employees direct control over their spam quarantine, saving you time and effort.

Business Application Policy Templates

Pre-defined policy templates let you protect common applications like Microsoft Exchange Outlook Anywhere or SharePoint quickly and easily.

Protection from the latest hacks and attacksn

With a variety of advanced protection technologies including URL and form hardening, deep-linking and directory traversal prevention, SQL injection and cross-site scripting protection, cookie signing and more.

Reverse proxy

With authentication options, SSL offloading, and server load balancing ensure maximum protection and performance for your servers being accessed from the internet.