Sophos XGS models: desktop, 1U and 2U firewall appliances

The current Sophos XGS range

Sophos Firewall XGS appliances come in three groups:

• Desktop (Gen.2): XGS 88, 108, 118, 128 and 138, with 2.5 GE copper ports. The XGS 88w, 108w, 118w and 128w add integrated Wi-Fi 6 (802.11ax, 2x2:2).
• 1U rackmount: XGS 2100, 2300, 3100, 3300, 2380, 4300, 3380, 4500, 4580 and 5580, each with one or two Flexi Port bays for extra ports.
• 2U rackmount: XGS 5500, 6500, 7500 and 8500, with redundant power supplies, SSDs and fans built in and up to 70 ports with modules.

All run Sophos Firewall OS and are managed on the appliance or in Sophos Central. Sophos Central is Sophos's cloud management console; Sophos's October 2026 firewall brochure presents it under the new name Sophos Fusion.

Sophos XGS models and part numbers

Press Add next to a part number to put it in your basket. Where a subscription or support option goes with the hardware, you choose it in the same step and it goes into your basket with the hardware. Part numbers come from the vendor; we confirm each line, quantity and term when we quote.

XGS part numbers with a protection bundle

Sophos also lists each XGS appliance under part numbers that include Standard Protection or Xstream Protection for 1, 3 or 5 years, so the hardware and its bundle are one line on the order. They are the same appliances as above:

Which XGS desktop model?

• XGS 88 and 88w: the entry models. Sophos notes that they do not support on-box reporting, dual antivirus scanning, web application firewall antivirus scanning or the email message transfer agent, and points to the XGS 108 where those are needed.
• XGS 108 to 128: six or nine 2.5 GE copper ports and an SFP port, with an optional second power supply. The XGS 118 and 128 have an expansion bay for Sophos's 5G module.
• XGS 138: two 2.5 GE PoE ports, two 10 GE SFP+ ports and the same expansion bay. It has no w version.
• Rack mounting: a rackmount kit for the desktop models is ordered separately.

Figures are Sophos's own, from its Sophos Firewall and XGS Series brochure (opens in a new tab). Sophos says: "Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services". NGFW is measured with IPS and application control on; Threat Protection adds malware prevention, so size on the Threat Protection figure if you plan to run the full protection bundle.

Which XGS 1U model?

The XGS 2100, 2300, 3100, 3300, 2380 and 3380 are short 1U units with rackmount ears included and sliding rails optional; the XGS 4300, 4500, 4580 and 5580 are full-depth units with sliding rails included. The XGS 2100 to 3300, 4300 and 4500 have built-in bypass port pairs and take the PoE Flexi Port module. The newer XGS 2380, 3380, 4580 and 5580 have 2.5 GE copper ports throughout, SFP28 25 GE ports on the 3380, 4580 and 5580, and SSDs that can be replaced in the field. Throughput figures are Sophos's, measured as described above.

Which XGS 2U model?

The 2U models have two Flexi Port bays plus one (XGS 5500) or two (XGS 6500, 7500 and 8500) bays for Sophos's High-Density Flexi Port module, giving up to 48, 68 or 70 ports. The XGS 7500 and 8500 add two QSFP28 ports. Sliding rails are included.

Protection bundles and subscriptions

Sophos includes the Base License with every XGS appliance (networking, SD-WAN, VPN and wireless management). Protection is added with one of three bundles, or with individual subscriptions:

From Sophos's firewall brochure. Sophos recommends Xstream Protection or Xstream Plus. Enhanced Support can also be bought on its own: it brings Sophos's technical support, firmware and feature updates and an advanced replacement hardware warranty for the term. Email Protection (on-box anti-spam, antivirus, DLP and encryption; XGS 108 and above) and Web Server Protection (a web application firewall) are separate subscriptions, and extra cloud reporting retention is sold in storage blocks.

The configurator offers the bundles and subscriptions when you add a firewall; you can pick one or skip, and we confirm the term at quote. To order the appliance and a bundle as one line, use the part numbers with a protection bundle listed above. For renewals of an existing firewall, see Sophos Firewall subscriptions (opens in a new tab) on softwarelicensing.uk.

What you order with it

Subscription and support part numbers for the hardware above. We confirm the right tier, term and quantity at quote.

Sophos Firewall protection bundle or Enhanced Support

Flexi Port modules and accessories

Rackmount XGS models take Flexi Port modules for extra copper, fibre, PoE and bypass ports, and the desktop models take a 5G module, a second power supply and a rackmount kit. Which module fits which model, with every part number, is on Sophos Flexi Port modules and accessories. When you add a firewall, the configurator offers the modules, power supply, rails and Sophos SFP or SFP+ transceivers that go with that model, to add or skip. For SFP28, QSFP and DAC links, tell us what you need and we add them to your quote.

Replacing an XGS 87, 107, 116, 126 or 136

Sophos has announced the global end of sale of all XGS Gen.1 desktop models: the XGS 87, 107, 116, 126 and 136 and their w versions. Its notice dates the post-end-of-sale support phase from 30 Sep 2025, the final one-year renewal at 30 Sep 2029 and end of life at 30 Sep 2030. The Gen.2 models above are the current desktop range, and Sophos's notice names the migration path: the XGS 88 for the 87, the 108 for the 107, the 118 for the 116, the 128 for the 126 and the 138 for the 136, each with its w version, except that the 136w moves to the XGS 128w. The Gen.2 5G module is for the XGS 118, 128 and 138. We can quote the replacement with its bundle and move your configuration across, with the scope confirmed at quote.

Lifecycle and replacements

Dates are the vendor's published end-of-sale and support dates. We can quote current replacements and plan the swap.

How to order

How ordering works. Press Add next to a model and it goes into your basket; where a protection bundle or support subscription goes with the hardware, you pick it in the same step or skip it. Then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the network as a project, with the scope confirmed at quote (see network installation). Every row shows the Sophos UK order code, and your quote confirms the exact part number for each appliance, subscription and term.

Vendor sources

• Sophos: Sophos Firewall and XGS Series brochure (October 2026) (opens in a new tab)
• Sophos: end-of-sale announcement, XGS Gen.1 desktop appliances (opens in a new tab)