Sophos XGS 2nd Gen Firewalls
2nd Generation XGS Desktop for SMB and Branch Office
Product Overview (PDF)
XGS Series Wired (Gen 2)
XGS Series Wireless (Gen 2)
XGS Series Overview
Unlock supreme desktop performance, improved energy efficiency, and a wealth of new high-speed connectivity options.
Sophos second-generation XGS Series desktop appliances deliver double the performance of our first-generation models while cutting power consumption in half. All these desktop firewalls include 2.5 GE interfaces, allowing traffic to flow freely and without bottlenecks, from your firewall to your 2.5 GE switch to your Wi-Fi 6 access point.
Customers with noise-sensitive environments such as healthcare, education, and retail will love the whisper-quiet operation of the fanless XGS 88 and XGS 108 models. Using the expansion bay, an optional 5G module adds either redundant cellular connectivity or cost-effective 5G fixed wireless access (FWA).
The XGS 88 to XGS 128 models feature a streamlined, single-CPU architecture that utilizes virtual FastPath technology for traffic acceleration (in combination with Sophos Firewall OS v21 and higher). As our gateway model to the distributed edge, the XGS 138 boasts a dedicated Xstream Flow processor for hardware acceleration and two 10 GE SFP+ interfaces for high-speed fiber connectivity. All models except the XGS 138 are optionally available with built-in Wi-Fi.
Product highlights
- All protection features are supported on every XGS 1xx desktop model and most are available on XGS 88 and XGS 88w.
- Accelerated performance: Up to double the throughput of Gen.1 models plus Xstream virtual FastPath acceleration for IPsec VPN (XGS 88 to XGS 128) in combination with SFOS v21 and higher
- High-speed connectivity built in: 2.5 GE interfaces on everymodel,two built-in 10 GE SFP+ interfaces on the XGS 138, and Wi-Fi 6 (802.11ax) integrated on all w-models with concurrent use of the 2.4 and 5 GHz bands for better performance
- Power and environment: Up to 50% lower power consumption, fanless XGS 88 and 108 models for whisper-quiet operation, optimized thermal design for XGS 118 and above, and redundant power option for all XGS 1xx models
- Optional connectivity: New 5G module available exclusively for Gen.2 models for more cost-effective redundant connectivity
- Streamlined hardware architecture: The XGS 88 to XGS 128 models boast a new single-CPU architecture while the XGS 138 has a refreshed dual-processor architecture
Accessories
5G connectivity for XGS 118, XGS 128, and XGS 138 models only
For many business locations, a 5G cellular network can be deployed to support traffic peaks or provide an important redundant/fallback connectivity option for SD-WAN. 5G fixed wireless access (FWA) may sound like a contradiction in terms, but as a technology, it allows network operators to deliver cost-effective, high-speed broadband connectivity to both suburban and rural areas. Using 5G, operators can now meet the high-speed internet access demands of cloud services in business and consumer requirements for latency-free, high-definition streaming services.
The optional Gen.2 5G module can be securely mounted in the XGS device and then managed from your Sophos Firewall.
- Better performance with the latest standards supported
- Highly cost-effective solution
- Full protection from theft and damage
- Gen.2 5G module data rates (max.):
- 5G SA sub-6: downlink 2.4 Gbps; uplink 900 Mbps
- 5G NSA sub-6: downlink 3.4 Gbps; uplink 550 Mbps
- LTE: downlink 1.6 Gbps; uplink 200 Mbps
- WCDMA: downlink 42 Mbps; uplink 5.76 Mbps
- One 5G module (Gen.2) version for all regions
XGS Series Features
Powerful Protection and Performance
Sophos Firewall includes the latest advanced protection technologies and threat intelligence, including:
- Streaming DPI engine with web protection and IPS
- Accelerated TLS 1.3 encrypted traffic inspection
- Zero-day AI and machine learning analysis
- Real-time cloud sandboxing
- DNS Protection
The best part is, you don' t need to compromise on performance. This is thanks to our programmable Xstream architecture. It offloads benign traffic flows and crypto operations as well as VPN and select application routing to accelerate these network traffic flows and create performance headroom for traffic that actually needs deep packet inspection.
Sophos Firewall leverages the Sophos Cloud to ensure that your organization is protected from the latest threats and further maximize your performance. You get the latest AI and machine learning technology from SophosLabs working to identify previously unseen threats and malicious URLs. Using a common cloud, any new threat attacking a single Sophos customer is instantly shared across all our customers, blocking it everywhere. In addition, offloading this analysis from your firewall to the cloud boosts your performance even further.
Active Threat Response
Sophos Firewall uniquely integrates with many Sophos products to automatically coordinate a response to an active adversary or attack:
- Sophos Endpoint and XDR
- Sophos Managed Detection and Response services
- Sophos switches and wireless access points
- Sophos ZTNA remote access
- Sophos messaging protection
- And third-party threat intelligence solutions
Regardless of how the threat is first identified, whether at the firewall, by another product, or by a security analyst, Sophos Firewall coordinates a Synchronized Security response across Sophos products. It will identify and isolate the compromised host and prevent lateral movement and external communications until the threat can be investigated and cleaned up.
Sophos Synchronized Security integration between products also provides additional capabilities you can’t get anywhere else that adds tremendous value to your network:
- Synchronized Application Control takes advantage of telemetry gathered by the endpoint about active, networked applications and shares that with the firewall enabling control of applications that might otherwise go unidentified.
- Synchronized User ID works similarly to share user identity between the endpoint agent and the firewall to enforce user-based policies without the need for a separate client or server identity solution.
- Synchronized SD-WAN leverages Synchronized Application Control for traffic matching operations to effectively route custom or otherwise unknown application traffic across your network.
Work From Anywhere
Sophos Firewall offers the ultimate in flexible connectivity and secure access for even the most demanding networks. You get a fully integrated SD-WAN solution, along with a full suite of secure access products for Zero Trust Network Access, SD-RED edge devices, VPN, switching, and wireless — all managed from Sophos Central.
Securing and managing remote workers with ZTNA ensures users only have access to the applications they need, and not the whole network. ZTNA also integrates with Sophos Firewall and Sophos Endpoint to ensure a compromised device can’t access the network at all. ZTNA also protects your applications from hacks and attacks by making them invisible to the outside world. The best part is, Sophos Firewall integrates a Sophos ZTNA gateway directly into your firewall to make deployment easy.
Sophos Firewall also includes one of the best integrated SD-WAN solutions available in any firewall. Xstream SDWAN provides a powerful integrated SD-WAN solution with:
- Performance-based link selection and routing
- Load balancing with configurable weightings across multiple links
- Zero-impact transitions between links in the event of a disruption
- Central cloud-managed orchestration
- Xstream FastPath acceleration of VPN tunnel traffic
Sophos Firewall makes interconnecting your hybrid distributed enterprise easy and makes it extremely robust, ensuring maximum reliability and uptime.
Single Console Management
With Sophos Central, you get a single cloud management platform for all your Sophos products, including rich and powerful tools for group firewall management, SDWAN overlay network orchestration, ZTNA and user management, and infrastructure management for your switches and wireless access points. You also get full indepth dashboards and reports, cross-product integration and automation with other Sophos products, and much more. Sophos Firewall is so much more than just a firewall – consolidate and streamline your network security management starting with your firewall.
- Manage all of your Sophos Firewalls and other Sophos products from a single console
- Configure changes and apply them to a group of firewalls or manage each firewall individually
- Create a backup schedule and store up to five backups in the cloud
- Schedule firmware updates across your entire network with just a few clicks
- Use zero-touch deployment for new firewalls from Sophos Central: just drop ship the device to any location and set it up remotely. A USB drive is no longer required (but can still be used if you prefer).
Sophos Central also includes powerful reporting and orchestration tools that enable you to visualize your network, web, application activity, and security over time:
- Flexible reporting combines a variety of builtin reports with powerful tools that you can use to create your own custom reports
- Analyze data to identify security gaps, suspicious user behavior, or other events requiring policy changes
- Data is shared across Sophos products through the Sophos Central data lake for threat hunting, forensics, and automated response to active threats
- Utilize point-and-click SD-WAN orchestration to easily setup a fully redundant VPN overlay network for your hybrid distributed network
- Central reporting is available at no extra cost with storage of up to seven days of reporting data*
* Calculated based on average traffic volumes per appliance size. In high-traffic environments, the retention period can be lower.
Solutions That Fit Your Network
Sophos Firewall adapts to your network, so you don’t need to adapt your network to the firewall. You get all the features, versatility, and options you need to fit your unique environment.
Enterprise
Sophos Firewall offers the enterprise-grade protection, performance, visibility, and SD-WAN features you need for today’s most demanding networks.
Remote Workers
Sophos Firewall and Zero Trust Network Access offer an easy and scalable solution to enable your remote workers and protect your network.
Cloud
If you have public cloud infrastructure or hybrid networks that need protection, we have a cloud firewall solution for you.
All-in-One
If you’re looking for simpler, consolidated, affordable protection for a small office we’ve got you covered with the best protection and value.
Retail and Branch
Retail and other distributed organizations with lots of branch offices have unique challenges that Sophos Firewall and SD-RED can solve.
Schools
Education institutions have special requirements for compliance and protection that Sophos Firewall has been purpose-built to address.