XGS Series
SMB and branch office:
2nd Gen XGS desktop models
Unlock supreme desktop performance, improved energy efficiency, and a wealth of new high-speed connectivity options.
Sophos second-generation XGS Series desktop appliances deliver double the performance of our first-generation models while cutting power consumption in half. All these desktop firewalls include 2.5 GE interfaces, allowing traffic to flow freely and without bottlenecks, from your firewall to your 2.5 GE switch to your Wi-Fi 6 access point.
Customers with noise-sensitive environments such as healthcare, education, and retail will love the whisper-quiet operation of the fanless XGS 88 and XGS 108 models. Using the expansion bay, an optional 5G module adds either redundant cellular connectivity or cost-effective 5G fixed wireless access (FWA).
The XGS 88 to XGS 128 models feature a streamlined, single-CPU architecture that utilizes virtual FastPath technology for traffic acceleration (in combination with Sophos Firewall OS v21 and higher). As our gateway model to the distributed edge, the XGS 138 boasts a dedicated Xstream Flow processor for hardware acceleration and two 10 GE SFP+ interfaces for high-speed fiber connectivity. All models except the XGS 138 are optionally available with built-in Wi-Fi.
2nd Gen XGS desktop models
Scroll
XGS 88 / 88w
Performance
FIREWALL9,900 Mbps
TLS INSPECTION600 Mbps
FIREWALL IMIX6,500 Mbps
IPS2,000 Mbps
IPSEC VPN6,000 Mbps
NGFW2,000 Mbps
THREAT PROTECTION2,000 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 4 X 2.5 GE copper
POWER-OVER-ETHERNET (FIXED) N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 6 (802.11ax)
2X2:2 MIMO
2 external antennas
Dual-band concurrent, 2.4 GHz and 5 GHz
Modularity
EXPANSION SLOTS N/A
OPTIONAL ADD-ON MODULES N/A
Redundancy
SWAPPABLE COMPONENTS N/A
XGS 88 / 88w
Front
Back
XGS 108 / 108w
Performance
FIREWALL12,500 Mbps
TLS INSPECTION800 Mbps
FIREWALL IMIX8,100 Mbps
IPS2,500 Mbps
IPSEC VPN8,250 Mbps
NGFW2,600 Mbps
THREAT PROTECTION2,500 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 6 x 2.5 GE copper
1 x SFP fiber*
POWER-OVER-ETHERNET (FIXED) N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 6 (802.11ax)
2X2:2 MIMO
2 external antennas
Dual-band concurrent, 2.4 GHz and 5 GHz
Modularity
EXPANSION SLOTS N/A
OPTIONAL ADD-ON MODULES SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 108 / 108w
Front
Back
XGS 118 / 118w
Performance
FIREWALL15,500 Mbps
TLS INSPECTION1,100 Mbps
FIREWALL IMIX11,000 Mbps
IPS3,500 Mbps
IPSEC VPN13,000 Mbps
NGFW3,950 Mbps
THREAT PROTECTION3,250 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 9 x 2.5 GE copper
1 x SFP fiber*
POWER-OVER-ETHERNET (FIXED) N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 6 (802.11ax)
2X2:2 MIMO
2 external antennas
Dual-band concurrent, 2.4 GHz and 5 GHz
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 5G module (Gen.2)**
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 118 / 118w
Front
Back
XGS 128/128w
Performance
FIREWALL19,100 Mbps
TLS INSPECTION1,450 Mbps
FIREWALL IMIX14,500 Mbps
IPS4,650 Mbps
IPSEC VPN15,050 Mbps
NGFW4,350 Mbps
THREAT PROTECTION4,000 Mbps
Connectivity
ETHERNET INTERFACES (FIXED)9 x 2.5 GE copper
1 x SFP fiber*
POWER-OVER-ETHERNET (FIXED)N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY)Wi-Fi 6 (802.11ax)
2X2:2 MIMO
2 external antennas
Dual-band concurrent, 2.4 GHz and 5 GHz
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 5G module (Gen.2)**
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 128/128w
Front
Back
XGS 138 ***
Performance
FIREWALL19,100 Mbps
TLS INSPECTION1,700 Mbps
FIREWALL IMIX10,500 Mbps
IPS5,850 Mbps
IPSEC VPN6,600 Mbps
NGFW5,100 Mbps
THREAT PROTECTION4,750 Mbps
Connectivity
ETHERNET INTERFACES (FIXED)4 x GE copper
2 x SFP+ fiber*
POWER-OVER-ETHERNET (FIXED)2 x 2.5 GE
802.3at (30W max. per port)
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY)N/A
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 5G module (Gen.2)**
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 138
Front
Back
* Transceivers sold separately
** 5G module (Gen.2) not sold in Japan
*** XGS 138 not currently available in Japan
Performance test methodology
|
General |
Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services |
|
Firewall |
Measured using HTTP traffic and 512 KB response size |
|
Firewall IMIX |
UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes |
|
IPS |
Measured using HTTP traffic, default IPS ruleset, and 512 KB object size |
|
IPsec VPN |
HTTP throughput measured using multiple tunnels and 512 KB HTTP response size |
|
TLS inspection |
Measured with IPS enabled on HTTPS sessions and different cipher suites |
|
Threat protection |
Measured with firewall, IPS, application control, and malware prevention enabled using Enterprise Mix traffic |
Product highlights
- All protection features are supported on every XGS 1xx desktop model and most are available on XGS 88 and XGS 88w.
- Accelerated performance: Up to double the throughput of Gen.1 models plus Xstream virtual FastPath acceleration for IPsec VPN (XGS 88 to XGS 128) in combination with SFOS v21 and higher
- High-speed connectivity built in: 2.5 GE interfaces on everymodel,two built-in 10 GE SFP+ interfaces on the XGS 138, and Wi-Fi 6 (802.11ax) integrated on all w-models with concurrent use of the 2.4 and 5 GHz bands for better performance
- Power and environment: Up to 50% lower power consumption, fanless XGS 88 and 108 models for whisper-quiet operation, optimized thermal design for XGS 118 and above, and redundant power option for all XGS 1xx models
- Optional connectivity: New 5G module available exclusively for Gen.2 models for more cost-effective redundant connectivity
- Streamlined hardware architecture: The XGS 88 to XGS 128 models boast a new single-CPU architecture while the XGS 138 has a refreshed dual-processor architecture
Accessories
5G connectivity
For XGS 118, XGS 128, and XGS 138 models only
For many business locations, a 5G cellular network can be deployed to support traffic peaks or provide an important redundant/fallback connectivity option for SD-WAN. 5G fixed wireless access (FWA) may sound like a contradiction in terms, but as a technology, it allows network operators to deliver cost-effective, high-speed broadband connectivity to both suburban and rural areas. Using 5G, operators can now meet the high-speed internet access demands of cloud services in business and consumer requirements for latency-free, high-definition streaming services.
The optional Gen.2 5G module can be securely mounted in the XGS device and then managed from your Sophos Firewall.
- Better performance with the latest standards supported
- Highly cost-effective solution
- Full protection from theft and damage
- Gen.2 5G module data rates (max.):
- 5G SA sub-6: downlink 2.4 Gbps; uplink 900 Mbps
- 5G NSA sub-6: downlink 3.4 Gbps; uplink 550 Mbps
- LTE: downlink 1.6 Gbps; uplink 200 Mbps
- WCDMA: downlink 42 Mbps; uplink 5.76 Mbps
- One 5G module (Gen.2) version for all regions
XGS Series 2nd Gen desktop accessories matrix
Model | Power redundancy | Expansion bay | 5G module | Wi-Fi options | Rackmount kit |
|---|---|---|---|---|---|
XGS 88 | N/A | N/A | N/A | N/A | Optional |
XGS 88w | N/A | N/A | N/A | Wi-Fi 6 built in | Optional |
XGS 108 | Optional 2nd | N/A | N/A | N/A | Optional |
XGS 108w | Optional 2nd | N/A | N/A | Wi-Fi 6 built in | Optional |
XGS 118 | Optional 2nd | 1 | Optional | N/A | Optional |
XGS 118w | Optional 2nd | 1 | Optional | Wi-Fi 6 built in | Optional |
XGS 128 | Optional 2nd | 1 | Optional | N/A | Optional |
XGS 128w | Optional 2nd | 1 | Optional | Wi-Fi 6 built in | Optional |
XGS 138 | Optional 2nd | 1 | Optional | N/A | Optional |
Related products
XGS Desktop (Gen.2)
Best-in-class performance, protection, and power efficiency for SMBs and branch offices
THE ULTIMATE SMB FIREWALLS
- Industry-leading price-performance
- Power-saving operation
- Optional Wi-Fi 6 and 5G support on select models
- 2.5 GE and 10 GE SFP+ interfaces
- Redundant power options
Now viewing
XGS Desktop (Gen.1)
Our first-gen SMB and branch office firewalls with great connectivity at a great price
FLEXIBLE SMB FIREWALLS
- All-in-one security
- Optional Wi-Fi 5 on all models
- Modular, add-on connectivity options for Wi-Fi and 4G/5G
- Redundant power options
XGS 1U Rackmount
Performance and versatile connectivity for midsize distributed organizations
POWER FOR THE DISTRIBUTED EDGE
- Dual-processor performance to accelerate traffic and apps
- Diverse range of high-speed interfaces built in plus flexible, add-on modules
- Redundant power options
XGS 2U Rackmount
No-compromise performance for the enterprise and campus edge
PERFORMANCE AND REDUNDANCY
- Enterprise-grade performance and hardware acceleration
- High-speed connectivity on board and via optional modules
- Built-in redundancy
Sophos SD-RED
Plug-and-play security for smaller branch offices and remote sites
CLICK-AND-CONNECT EDGE DEVICES
- Extend security to branch offices and remote locations
- Simple, plug-and-play connectivity
- No technical staff required on site
- Managed via your Sophos Firewall
Sophos Wireless
Our scalable, cloud-managed Wi-Fi solution with support for the Wi-Fi 6/6E AP6 Series
SIMPLE, SECURE WIRELESS LAN
- Easy setup and management via Sophos Central
- Diverse options for guest access
- Integration with Sophos MDR/XDR or third-party solutions via API to block compromised hosts
Sophos Switch
Network access-layer switches to connect, power, and control at the LAN edge
CONNECT, POWER, AND CONTROL
- Sophos Central or local user interface management
- Power-over-Ethernet
- Integration with Sophos MDR/XDR or third-party solutions via API to block compromised hosts
Sophos ZTNA
Zero Trust Network Access to securely connect users to applications
SECURELY CONNECT YOUR USERS
- Micro-segmentation for better security
- Device-health-based policy control
- Single console management via Sophos Central
- Single agent with Sophos Endpoint