Standard Protection covers the core security subscriptions: Network Protection (IPS, ATP, sandboxing), Web Protection, and Sophos Central management. Xstream Protection adds Zero-Day Threat Intelligence and accelerated TLS inspection via the Xstream architecture, which offloads encrypted traffic inspection to a dedicated processing engine. For most organizations, Xstream Protection is the recommended bundle because TLS inspection performance degrades significantly without it on any model.

Yes. Sophos Central management requires at least a Standard Protection or Xstream Protection subscription. The Base License that comes with the hardware appliance alone does not include Central management access. If you purchase hardware-only, you will need to add a subscription separately before you can use Central for policy management, reporting, or firmware updates.

Firewall throughput is measured under lab conditions with large packet sizes and no active security inspection. Real-world throughput with IPS, threat protection, and TLS inspection enabled is always lower. The IPS Throughput and Threat Protection Throughput specs are better indicators of inspected performance. For sizing, plan around the Threat Protection throughput number rather than raw firewall throughput.

The XGS 88w, 108w, 118w, and 128w are wireless models with built-in Wi-Fi 6 (802.11ax) supporting concurrent 2.4 GHz and 5 GHz operation via dual external antennas. The XGS 138 and all rackmount models do not have built-in Wi-Fi. For those, Sophos AP6 access points managed through Sophos Central or the firewall itself are the recommended wireless solution.

Yes. Sophos offers an upgrade path from older XG and SG series appliances to the XGS platform. Firewalls.com can provide a quote for the new hardware and help identify the right XGS model based on your current appliance and user count. Give us the model you are replacing and we will find the best fit.

All XGS 1xx desktop models include at least one SFP fiber port (1 GbE). The XGS 138 includes two built-in SFP+ 10 GbE fiber ports. Starting with the XGS 2100 rackmount series, 10 GbE SFP+ connectivity is standard across the lineup. The XGS 5500 and above add QSFP28 ports for 40 or 100 GbE uplinks.

No. Rack mount kits for the desktop models are sold separately. A Sophos rackmount kit fits the XGS 88 and 108 series, and a separate kit covers the XGS 118 through 138 range. Firewalls.com stocks both; add it to your cart when ordering the hardware.

Firewalls.com ships in-stock XGS models same day when ordered by 3 PM EST. Most desktop models and common rackmount configurations are in stock. For large or high-end models, check with our team for current availability before placing an order.