In short
Sophos network hardware is three ranges managed in Sophos Central: Sophos Firewall XGS appliances from the desktop XGS 88 to the 2U XGS 8500, Sophos Switch access switches with 8, 24 or 48 ports, and AP6 Series Wi-Fi 6 and 6E access points. Forever Systems, a Sophos MSP Partner, can quote each model with its protection bundle and can install it.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
Sophos ranges at a glance
| Range | Current models | What it is |
|---|---|---|
| Sophos Firewall XGS desktop | XGS 88, 108, 118, 128 and 138, with w versions of the 88 to 128 | Desktop firewalls with 2.5 GE ports; the w models add integrated Wi-Fi 6 |
| Sophos Firewall XGS 1U | XGS 2100, 2300, 3100, 3300, 2380, 4300, 3380, 4500, 4580 and 5580 | 1U rackmount firewalls with one or two Flexi Port bays |
| Sophos Firewall XGS 2U | XGS 5500, 6500, 7500 and 8500 | 2U rackmount firewalls with redundant power, SSDs and fans built in |
| Sophos Switch | CS101, CS110, CS210 and CS1010 models | 8, 24 and 48-port access switches, with PoE versions and 2.5G or 10G multi-gigabit ports |
| Sophos AP6 Series | AP6 420, 420E, 840, 840E and 420X | Wi-Fi 6 and Wi-Fi 6E access points, indoor and outdoor |
| Flexi Port modules and accessories | 14 Flexi Port modules, the 5G module, power supplies, rails, mounts, antennas, PoE injectors and transceivers | Extra ports and fittings for the ranges above |
Compare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
Sophos Firewall XGS desktop models compared
| Model | Built-in ports | Firewall | NGFW | Threat Protection | Options |
|---|---|---|---|---|---|
| XGS 88 | 4 x 2.5 GE copper | 9.9 Gbps | 2 Gbps | 2 Gbps | None listed |
| XGS 88w | 4 x 2.5 GE copper | 9.9 Gbps | 2 Gbps | 2 Gbps | Integrated Wi-Fi 6 |
| XGS 108 | 6 x 2.5 GE copper, 1 x SFP | 12.5 Gbps | 2.6 Gbps | 2.5 Gbps | Second power supply |
| XGS 108w | 6 x 2.5 GE copper, 1 x SFP | 12.5 Gbps | 2.6 Gbps | 2.5 Gbps | Integrated Wi-Fi 6, second power supply |
| XGS 118 | 9 x 2.5 GE copper, 1 x SFP | 15.5 Gbps | 3.95 Gbps | 3.25 Gbps | Expansion bay for the 5G module, second power supply |
| XGS 118w | 9 x 2.5 GE copper, 1 x SFP | 15.5 Gbps | 3.95 Gbps | 3.25 Gbps | Integrated Wi-Fi 6, expansion bay for the 5G module, second power supply |
| XGS 128 | 9 x 2.5 GE copper, 1 x SFP | 19.1 Gbps | 4.35 Gbps | 4 Gbps | Expansion bay for the 5G module, second power supply |
| XGS 128w | 9 x 2.5 GE copper, 1 x SFP | 19.1 Gbps | 4.35 Gbps | 4 Gbps | Integrated Wi-Fi 6, expansion bay for the 5G module, second power supply |
| XGS 138 | 4 x GE copper, 2 x 2.5 GE copper with PoE, 2 x SFP+ 10 GE | 19.1 Gbps | 5.1 Gbps | 5.4 Gbps | 2 PoE ports, expansion bay for the 5G module, second power supply |
Figures are Sophos's own, from its Sophos Firewall and XGS Series brochure (opens in a new tab). Sophos says: "Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services". NGFW is measured with IPS and application control on; Threat Protection adds malware prevention, so size on the Threat Protection figure if you plan to run the full protection bundle. Every model, with the 1U and 2U ranges, is on Sophos XGS models.
Protection bundles sold with an XGS firewall
Sophos includes its Base License with every XGS appliance: networking, SD-WAN, VPN and wireless management. Protection is added as a bundle, chosen in our configurator when you add the firewall:
- Standard Protection: Network Protection and Web Protection with Enhanced Support.
- Xstream Protection: the bundle Sophos recommends. It adds Zero-Day Protection, DNS Protection, Active Threat Response, Central Orchestration and cloud firewall reporting.
- Xstream Plus: everything in Xstream Protection plus an allocation of Sophos Workspace Protection user licences, longer reporting retention and Enhanced Plus Support.
- Enhanced Support on its own: Sophos's technical support, firmware and feature updates and an advanced replacement hardware warranty for the term.
Email Protection and Web Server Protection are separate subscriptions. Sophos says an appliance on the Base License alone needs support or another subscription to receive firmware updates and to be managed in Sophos Central, so we quote the appliance and its bundle together.
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
Sophos Central
Sophos Central is Sophos's cloud management console; Sophos's October 2026 firewall brochure presents it under the new name Sophos Fusion. XGS firewalls, Sophos Switch and AP6 access points are all managed there, alongside Sophos's endpoint and other products. A firewall is managed in Sophos Central with any protection bundle or support subscription; a switch or an AP6 access point needs its own Support and Services subscription for Sophos Central management, and can be managed locally without one.
Sophos switches and access points
Sophos Switch and the AP6 Series are built to sit behind a Sophos Firewall and share its console:
- Sophos Switch: the CS101 and CS110 are 1G access switches with 8, 24 or 48 ports; the CS210 adds 2.5G ports and the CS1010-8FP has eight 10G multi-gigabit ports. Most have a PoE version for access points, phones and cameras. Every model is on Sophos Switch models.
- Sophos AP6 Series: the AP6 420 and 840 are 2x2 and 4x4 Wi-Fi 6 access points; the 420E and 840E add the 6 GHz band (Wi-Fi 6E); the 420X is the outdoor model. Every model is on Sophos AP6 access points.
We can quote the firewall, switches and access points as one bill of materials, with PoE budgets and uplinks checked against the access points you choose.
Sophos ranges we supply
| Range | Vendor | Models | Examples |
|---|---|---|---|
| Sophos Firewall XGS desktop appliances | Sophos | 9 | XGS 88, XGS 88w, XGS 108, XGS 108w, XGS 118, XGS 118w and more |
| Sophos Firewall XGS 1U rackmount appliances | Sophos | 10 | XGS 2100, XGS 2300, XGS 3100, XGS 3300, XGS 2380, XGS 4300 and more |
| Sophos Firewall XGS 2U rackmount appliances | Sophos | 4 | XGS 5500, XGS 6500, XGS 7500, XGS 8500 |
| Sophos Switch 100, 200 and 1000 Series | Sophos | 11 | CS101-8, CS101-8FP, CS110-24, CS110-24FP, CS110-48, CS110-48P and more |
| Sophos AP6 Series access points | Sophos | 5 | AP6 420, AP6 420E, AP6 840, AP6 840E, AP6 420X |
| Sophos Firewall XGS Flexi Port modules | Sophos | 14 | 8-port GE copper Flexi Port module, 8-port GE SFP Flexi Port module, 4-port 10 GE SFP+ Flexi Port module, 4-port GE copper bypass Flexi Port module, 4-port GE PoE and 4-port GE copper Flexi Port module, 4-port 2.5 GE PoE Flexi Port module and more |
| Sophos Firewall XGS power and mounting accessories | Sophos | 9 | 5G module for XGS desktop (Gen.2), Second power supply for XGS desktop, Rackmount kit for XGS 88 and 108, Rackmount kit for XGS 118, 128 and 138, External redundant power supply for XGS 1U, Internal power supply for XGS 2380 and 3380 and more |
| Sophos Switch and AP6 accessories | Sophos | 8 | Sliding rails for Sophos Switch, AP6 plenum and flat-ceiling mounting bracket kit, AP6 suspend mounting kit, External power supply for AP6 420, PoE+ injector, 30 W, PoE++ injector, 60 W and more |
| Sophos transceivers | Sophos | 5 | 1000Base-SX fibre transceiver, 1000Base-LX fibre transceiver, 1000Base-T copper transceiver, Dual-rate 10GBase-SR fibre transceiver, Dual-rate 10GBase-LR fibre transceiver |
Part numbers and warranty
Every row shows the Sophos UK order code, and your quote confirms the exact part number for each appliance, subscription and term.
Sophos states that all AP6 Series access points come with a limited lifetime warranty, and that Enhanced Support for a firewall includes an advanced replacement hardware warranty for the term. Those are Sophos's terms; anything we add is confirmed at quote.
Sophos endpoint protection
Sophos Firewall shares health and threat status with Sophos-protected computers through Security Heartbeat, part of Network Protection. Sophos Endpoint (formerly Intercept X), Sophos MDR and the rest of the Sophos security portfolio are covered on our sister site, sophos-intercept-x.co.uk (opens in a new tab).
How to order Sophos
How ordering works. Press Add next to a model and it goes into your basket; where a protection bundle or support subscription goes with the hardware, you pick it in the same step or skip it. Then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the network as a project, with the scope confirmed at quote (see network installation).
Replacing an older Sophos firewall or access point? Contact us with the model you run and we will quote the current equivalent.
Explore Sophos
Sophos XGSEvery current Sophos XGS firewall model, desktop to 2U, with ports, Sophos figures and bundles.Sophos SwitchSophos Switch CS101, CS110, CS210 and CS1010 models by ports, PoE budget and uplinks.Sophos AP6Sophos AP6 420, 420E, 840, 840E and outdoor 420X Wi-Fi 6 and 6E access points.Sophos accessoriesSophos Flexi Port modules, the XGS 5G module, power supplies, rails, transceivers, AP6 mounts and antennas.How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What network hardware does Sophos make?
Sophos Firewall XGS appliances (desktop, 1U and 2U), Sophos Switch access switches and AP6 Series Wi-Fi 6 and Wi-Fi 6E access points, all managed in Sophos Central.
Which Sophos XGS firewall suits a small office?
The desktop range: the XGS 88 and 108 for the smallest sites, and the XGS 118, 128 and 138 for busier offices and branches. Tell us your users, internet speed and the protection you want to run and we will suggest a model.
Does a Sophos XGS firewall need a subscription?
Sophos includes the Base License with the hardware. Protection (IPS, web filtering, sandboxing) and firmware updates come with a Standard Protection, Xstream Protection or Xstream Plus bundle, or with Enhanced Support, so we quote the appliance and bundle together.
Do Sophos switches and access points need a Sophos firewall?
No. They can be managed in Sophos Central with a Support and Services subscription, or locally, behind any firewall. With a Sophos Firewall they share one console.
Can you install Sophos network hardware?
Yes. We can design, supply, stage, install and configure Sophos firewalls, switches and access points, with the scope confirmed at quote.
Ready to order?
Build your basket and check out when you are ready.