The appliance runs on a base license that covers core firewall, routing, and VPN for unlimited users. To turn on the security features most enterprises buy it for, you add a protection subscription. Every bundle we sell includes one. If you buy the appliance on its own, plan to add Standard or Xstream Protection to enable threat scanning, web filtering, and firmware updates.

Standard Protection includes the base license, Network Protection, Web Protection, and Enhanced Support. Xstream Protection adds Zero-Day Protection, which is cloud sandboxing and AI-driven threat analysis, plus Central Orchestration for SD-WAN and multi-firewall management. For most XGS 7500 deployments we recommend Xstream, since the appliance is built to run those features at speed. If you only need core network and web filtering, Standard covers it.

Raw firewall throughput is up to 160 Gbps, but that number assumes no scanning. The figure to size against is threat protection throughput, which is up to 26 Gbps with IPS, deep packet inspection, and other protections running. IPsec VPN throughput reaches 117 Gbps and TLS 1.3 inspection reaches 19.5 Gbps. If a spec sheet shows one large number with no context, it is usually the raw firewall figure, so always compare threat protection throughput between models.

Yes. The XGS 7500 ships with redundant power supplies and dual NVMe SSDs, so a single component failure will not take the appliance down. It also supports high availability, so you can pair two units in active-passive or active-active mode to keep traffic flowing if one appliance goes offline. High availability is a common ask at this tier, and our engineers can help you spec the pair.

Yes. Along with the built-in 8 GbE copper, 12 SFP+ 10 GbE fiber, and 2 QSFP28 ports, the XGS 7500 has two standard and two high-density FleXi Port bays. You can add fiber or higher-density modules as your network changes, up to a maximum of 70 ports, without buying a new appliance.

Yes. The XGS 7500 and your Sophos access points, switches, and other firewalls all report into Sophos Central, so you manage them from one console. Security Heartbeat shares health and threat information between your firewall and Sophos-protected endpoints, so a compromised device can be isolated automatically.