2x performance
Up to double the throughput of Gen 1 models with Xstream virtual FastPath acceleration for IPsec VPN.
Sophos XGS 2nd Gen Firewalls
Second-generation XGS desktop appliances deliver double the performance while cutting power consumption in half. Perfect for SMB and branch office deployments.
Second-generation performance and efficiency
XGS Series Gen 2 desktop firewalls unlock supreme performance, improved energy efficiency, and high-speed connectivity options.
50% less power
Up to 50% lower power consumption with fanless XGS 88 and 108 models for whisper-quiet operation.
2.5 GE interfaces
High-speed 2.5 GE interfaces on every model allow traffic to flow freely without bottlenecks.
Wi-Fi 6 built-in
Integrated Wi-Fi 6 (802.11ax) available on all w-models with concurrent 2.4 and 5 GHz bands.
XGS Series Wired (Gen 2)
Desktop firewall appliances for small business and branch office deployments.
XGS 88 (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 9,000 Mbps
- Concurrent Connections: 1,600,000
XGS 108 (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 12,500 Mbps
- Concurrent Connections: 4,190,000
XGS 118 (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 15,500 Mbps
- Concurrent Connections: 5,500,000
XGS 128 (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 19,100 Mbps
- Concurrent Connections: 6,000,000
XGS 138 (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 19,100 Mbps
- Concurrent Connections: 6,550,000
XGS Series Wireless (Gen 2)
Desktop firewall appliances with integrated Wi-Fi 6 (802.11ax) for comprehensive network security.
XGS 88w Wireless (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 9,900 Mbps
- Concurrent Connections: 1,600,000
- Wireless: Wi-Fi 6 (802.11ax)
XGS 108w Wireless (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 12,500 Mbps
- Concurrent Connections: 4,190,000
- Wireless: Wi-Fi 6 (802.11ax)
XGS 118w Wireless (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 15,500 Mbps
- Concurrent Connections: 5,500,000
- Wireless: Wi-Fi 6 (802.11ax)
XGS 128w Wireless (Gen 2)
- Form Factor: Desktop
- Firewall Throughput: 19,100 Mbps
- Concurrent Connections: 6,000,000
- Wireless: Wi-Fi 6 (802.11ax)
XGS Series Overview
Unlock supreme desktop performance, improved energy efficiency, and a wealth of new high-speed connectivity options.
Sophos second-generation XGS Series desktop appliances deliver double the performance of our first-generation models while cutting power consumption in half. All these desktop firewalls include 2.5 GE interfaces, allowing traffic to flow freely and without bottlenecks, from your firewall to your 2.5 GE switch to your Wi-Fi 6 access point.
Customers with noise-sensitive environments such as healthcare, education, and retail will love the whisper-quiet operation of the fanless XGS 88 and XGS 108 models.
Meet the 2nd Generation Sophos XGS Desktop Firewalls (52 seconds)
Product highlights
- All protection features are supported on every XGS 1xx desktop model and most are available on XGS 88 and XGS 88w
- Accelerated performance: Up to double the throughput of Gen 1 models plus Xstream virtual FastPath acceleration for IPsec VPN (XGS 88 to XGS 128) in combination with SFOS v21 and higher
- High-speed connectivity built in: 2.5 GE interfaces on every model, two built-in 10 GE SFP+ interfaces on the XGS 138, and Wi-Fi 6 (802.11ax) integrated on all w-models with concurrent use of the 2.4 and 5 GHz bands
- Power and environment: Up to 50% lower power consumption, fanless XGS 88 and 108 models for whisper-quiet operation, optimized thermal design for XGS 118 and above
- Optional connectivity: New 5G module available exclusively for Gen 2 models for more cost-effective redundant connectivity
- Streamlined hardware architecture: The XGS 88 to XGS 128 models boast a new single-CPU architecture while the XGS 138 has a refreshed dual-processor architecture
5G connectivity accessories
Available for XGS 118, XGS 128, and XGS 138 models
For many business locations, a 5G cellular network can be deployed to support traffic peaks or provide an important redundant/fallback connectivity option for SD-WAN. The optional Gen 2 5G module can be securely mounted in the XGS device and managed from your Sophos Firewall.
- Better performance with the latest standards supported
- Highly cost-effective solution
- Full protection from theft and damage
- Gen 2 5G module data rates (max): 5G SA sub-6 downlink 2.4 Gbps / uplink 900 Mbps
- One 5G module (Gen 2) version for all regions
Powerful protection and performance
Sophos Firewall includes the latest advanced protection technologies and threat intelligence, including streaming DPI engine, accelerated TLS 1.3 inspection, zero-day AI analysis, real-time cloud sandboxing, and DNS Protection.
The programmable Xstream architecture offloads benign traffic flows and crypto operations to accelerate network traffic flows and create performance headroom for traffic that needs deep packet inspection.
Sophos Firewall leverages the Sophos Cloud to ensure your organization is protected from the latest threats. SophosLabs AI and machine learning technology identifies previously unseen threats and malicious URLs in real time.
Active Threat Response
Sophos Firewall uniquely integrates with many Sophos products to automatically coordinate a response to an active adversary or attack: Sophos Endpoint and XDR, Sophos Managed Detection and Response services, Sophos switches and wireless access points, Sophos ZTNA remote access, Sophos messaging protection, and third-party threat intelligence solutions.
Regardless of how the threat is first identified, Sophos Firewall coordinates a Synchronized Security response across Sophos products to identify and isolate the compromised host and prevent lateral movement.
- Synchronized Application Control takes advantage of telemetry gathered by the endpoint about active networked applications
- Synchronized User ID shares user identity between the endpoint agent and firewall to enforce user-based policies
- Synchronized SD-WAN leverages Synchronized Application Control for traffic matching operations to route custom application traffic
Work from anywhere
Sophos Firewall offers ultimate flexibility in connectivity and secure access. You get a fully integrated SD-WAN solution along with a full suite of secure access products for Zero Trust Network Access, SD-RED edge devices, VPN, switching, and wireless — all managed from Sophos Central.
ZTNA ensures users only have access to the applications they need, not the whole network. It integrates with Sophos Firewall and Endpoint to ensure compromised devices can't access the network.
Sophos Firewall includes one of the best integrated SD-WAN solutions with performance-based link selection, load balancing, zero-impact transitions between links, central cloud-managed orchestration, and Xstream FastPath acceleration of VPN tunnel traffic.
Single console management
With Sophos Central, you get a single cloud management platform for all your Sophos products, including rich and powerful tools for group firewall management, SD-WAN overlay network orchestration, ZTNA and user management, and infrastructure management for switches and wireless access points.
- Manage all of your Sophos Firewalls and other Sophos products from a single console
- Configure changes and apply them to a group of firewalls or manage each firewall individually
- Create a backup schedule and store up to five backups in the cloud
- Schedule firmware updates across your entire network with just a few clicks
- Use zero-touch deployment for new firewalls from Sophos Central
Sophos Firewall v22: Top-requested features
The latest Sophos Firewall OS release delivers your most-requested features, including enhanced web notifications, comprehensive audit logging, stronger authentication, and UI performance improvements.
Instant web notifications
Set up instant alerting for restricted web categories with emails sent as frequently as every 5 minutes. Includes full reports with date, time, user, category, and domain—ideal for education institutions.
Enhanced audit logging
Comprehensive audit logs with before-and-after tracking that meet the latest NIST standards. Detailed logging is supported for firewall rules, objects, and interfaces with XML change highlighting.
Stronger authentication
SHA-256 and SHA-512 support for OTP tokens with Google and Sophos apps, plus multi-factor authentication support for the integrated Web Application Firewall (form-based authentication).
Improved UI performance
Navigate between menu entries and tabs without waiting for data to fully load, making the UI much more responsive. Includes pagination support and new search and filtering for XFRM interfaces.
- Hardware monitoring via SNMP: Downloadable MIB file with metrics for CPU temp, NPU temp, fan speeds, power supply status (XGS 2100+), and PoE measurements
- sFlow monitoring: Real-time interface data based on configurable sampling rates, supporting any physical interface with up to 5 collectors
Solutions that fit your network
Sophos Firewall adapts to your network, so you don't need to adapt your network to the firewall.
Enterprise
Sophos Firewall offers the enterprise-grade protection, performance, visibility, and SD-WAN features you need for today's most demanding networks.
Remote workers
Sophos Firewall and Zero Trust Network Access offer an easy and scalable solution to enable your remote workers and protect your network.
Cloud
If you have public cloud infrastructure or hybrid networks that need protection, we have a cloud firewall solution for you.
All-in-one
If you're looking for simpler, consolidated, affordable protection for a small office we've got you covered with the best protection and value.
Retail and branch
Retail and other distributed organizations with lots of branch offices have unique challenges that Sophos Firewall and SD-RED can solve.
Schools
Education institutions have special requirements for compliance and protection that Sophos Firewall has been purpose-built to address.
How to buy
Flexible purchasing options
XGS 2nd Generation firewalls are available with flexible licensing options including Network Protection, Web Protection, Email Protection, and Xstream Protection bundles. All models include lifetime hardware warranty and 24/7 support.
Available in 1-year and multi-year subscription terms with volume discounts for larger deployments.
Related products
Extend your network security with complementary Sophos solutions.
XGS Rackmount Series
High-performance rackmount firewalls for data centers and large enterprise deployments with up to 260 Gbps throughput.
Explore rackmount modelsSophos Central Management
Unified cloud management platform for all Sophos products with group policy management and zero-touch deployment.
Explore Sophos CentralSophos Managed Detection and Response
24/7 threat hunting and incident response from Sophos experts. Integrates with XGS Firewall for comprehensive protection.
Discover Sophos MDR