Skip to content

Sophos XGS Desktop Series

HomeFirewalls / Sophos / Sophos XGS Desktop Series

subscriptions & Accessories

Sophos Parts & Accessories

  • Which Model?
  • Which Subscription?
  • More protection?
  • Thinking  Wireless?

The Sophos Desktop Series range is currently made up of 5 models, with wireless and PoE options  These are ideal for small to midsize organizations looking for a small form factor, strong throughput and enterprise-grade security.  The table below highlights the main features of each model.


Wireless Model Available

Wireless Version Available On All Models

Power over Ethernet

XGS 116 (1x GbE Max 30W), XGS 126 (2 x 1GbE Max 30W Per Port), XGS 136 (2 x 2.5GbE Max 30W Per Port)


XGS 87 (16GB eMMC), XGS 107 / 116 / 126 / 136 (64GB SSD)

Redundant Power Supply

Optional On XGS 107 / 116 / 126 / 136


Firewall Inspection

XGS 87 (3.7 Gbps), XGS 107 (7 Gbps), XGS 116 (7.7 Gbps), XGS 126 (10.5 Gbps), XGS 136 (11.5 Gbps)

Threat Prevention

XGS 87 (240 Mbps), XGS 107 (330 Mbps), XGS 116 (685 Mbps), XGS 126 (900 Mbps), XGS 136 (1000 Mbps)

Firewall IMIX

XGS 87 (2.5 Gbps), XGS 107 (2.9 Gbps), XGS 116 (3.5 Gbps), XGS 126 (4 Gbps), XGS 136 (4.7 Gbps)

Intrusion Prevention

XGS 87 (1.01 Gbps), XGS 107 (1.35 Gbps), XGS 116 (2 Gbps), XGS 126 (2.6 Gbps), XGS 136 (3.3 Gbps)


XGS 87 (700 Mbps), XGS 107 (1050 Mbps), XGS 116 (2000 Mbps), XGS 126 (2500 Mbps), XGS 136 (3000 Mbps)

SSL / TLS Inspection

XGS 87 (375 Mbps), XGS 107 (420 Mbps), XGS 116 (650 Mbps), XGS 126 (800 Mbps), XGS 136 (950 Mbps)

IPSec VPN Throughput

XGS 87 (2.8 Gbps), XGS 107 (3 Gbps), XGS 116 (3.6 Gbps), XGS 126 (4.1 Gbps), XGS 136 (4.8 Gbps)



XGS 87 (4 x 1GbE + 1 x SFP), XGS 107 /116  (8 x 1GbE + 1 x SFP),  XGS 126 (12 x 1GbE + 2 x SFP), 

XGS 136 (10 x 1GbE, 2 x 2.5GbE +  2 x SFP)

Wireless Interface

XGS 87W / 107W / 116W (2x2 Wi-Fi 5/802.11a/b/g/n/ac - 2.4Ghz OR 5Ghz)
XGS 126W / 136W (3x3 Wi-Fi 5/802.11a/b/g/n/ac - 2.4Ghz OR 5Ghz)

Expansion Slots

XGS 87 / 107 (0), XGS 116 / 126 / 136 (1)

Optional Add-On Connectivity

All Models - SFP DSL Module VDSL2
XGS 116 / 126 / 136 - 3G/4G Module, Second Wi-Fi Radio

VPN Tunnels & Licenses

SSL VPN Concurrent Tunnels

XGS 87 (500),  XGS 107 (1000),  XGS 116 (1250),  XGS 126 / 136 (1500)

Our Serving suggestion

Internet Speed

<  50 Mbps
XGS 87

<  100 Mbps
XGS 107

<  250 Mbps
XGS 116 / 126

<  500 Mbps
XGS 136

Number of Users

< 5

< 10

< 25

< 50

Paul's Quick Tip

So here's my quick tip for selecting a Sophos Desktop Series firewall to meet your needs.  Having sold and managed literally thousands of firewalls across the world since I started in 1999, I have noticed one thing - Our browsing and data consuming habits effect a firewall's throughput.  All the tests above were performed in labs and under controlled conditions.  

I would always recommend taking the slowest speed published - in this instance something like the Threat Protection value and then dividing it by three.   This will give you, from our experience, the worst speed you will get under the heaviest load conditions, with full protection turned on.   Make sure this speed is faster than your internet connection and you will be good to go.

Example using a Sophos XGS 87

Threat Protection speed is 240 Mbps, divide this by 3 which gives you 80 Mbps.  This is the slowest we believe this firewall will run under the heaviest of loads.  Obviously if you want to turn some of the security services off, then you will make it run faster.

The Tech Geeks - Paul Sillars

Gio's Advice

Your firewall is nothing without a live and updating subscription.  Viruses, Malware and network threats, change almost hourly.  Purchasing a security subscription means that your firewall will always be receiving the latest threat signatures, virus protection updates and filter block lists.

The best bit is that an active security subscription also gives you free firmware updates, technical support from Sophos and hardware warranty for the duration of the subscription.

Never view a security subscription like the warranty for a car.   It is not there just in case something goes wrong, it is actually needed to make sure nothing goes wrong.  You are only truly being protected if your firewall is auto updating and has an active subscription.

Base License

Every Sophos XG/XGS firewall comes with a base license as standard.  This gives you the basic features to get going, but no ongoing updates or support.

standard protection

The Standard Protection Bundle provides all

essential security services needed to protect against known, as well as firmware updates, hardware warranty and 24x7 support

Xstream protection

The Xstream Protection Bundle builds on the features available in Standard, but adds in protection against unknown threat, often called Zero-Day, along with advanced SD-WAN capabilities and an extended reporting period.




24x7 Enhanced Support

24/7 support, advanced replacement hardware warranty for the term of the subscription.

Fimware Updates

Keep your Sophos patched and up to date with regular firmware updates.

Xstream SD-WAN and Networking

Includes all networking, routing, and SD-WAN capabilities including zone-based stateful firewall, NAT, VLAN, SDWAN profiles, performance-based WAN link selection and monitoring, zero-impact WAN link transitions, and Xstream FastPath acceleration of SD-WAN VPN traffic.

Secure Wireless

Built-in wireless controller for Sophos APX wireless access points. Plug-and-play access point discovery makes setup easy. Support for multiple SSIDs, hotspots, guest networks, and the diverse encryption and security standards.


Provides standards-based site-to-site and remote access VPN (free up to the capacity of the firewall) with support for IPsec and SSL. Sophos Connect remote access VPN client for Windows and Macs offers seamless and easy deployment and configuration options.


Extensive on-box reporting provides valuable insights into threats, users, applications, web activity, and much more. Note that specific reporting functionality may be dependent on other protection modules to get the full benefits (for example, Web Protection or web and app reports).  Please note the XGS 87 / 87 Wireless does not have enough onboard storage to provide on-box reporting.

Intrusion Prevention Service

Provides advanced protection from all types of modern attacks. It goes beyond traditional server and network resources to protect users and apps on the network as well.

Security Heart Beat

Creates a link between your Sophos Central protected endpoints and your firewall to identify threats faster, simplify investigation, and minimize impact from attacks. Easily incorporate Heartbeat status into firewall policies to automatically isolate compromised systems.

Advanced Threat Protection

Instant identification and immediate response to today’s most sophisticated attacks. Multi-layered protection identifies threats instantly and Security Heartbeat provides an emergency response.

Advanced VPN Technologies

Adds unique and simple VPN technologies, including our clientless HTML5 self-service portal that makes remote access incredibly simple or utilize our exclusive light-weight secure SD-RED (Remote Ethernet Device) VPN technology.

Application Control and QoS

Enables user-aware visibility and control over thousands of applications with granular policy and traffic-shaping (QoS) options based on application category, risk, and other characteristics. Synchronized Application Control automatically identifies all the unknown, evasive, and custom applications on your network.

Advanced Web Threat Protection

Backed by SophosLabs, our advanced engine provides the ultimate protection from today’s polymorphic and obfuscated web threats. Innovative techniques like JavaScript emulation, behavioral analysis, and origin reputation help keep your network safe.

High-performance traffic scanning

Optimized for top performance, our Xstream SSL inspection provides ultra-low latency inspection and HTTPS scanning while maintaining performance

Zero-Day Protection

Powered by the industry-leading SophosLabs, the Zero-Day Protection subscription includes a fully cloud-based threat intelligence and threat analysis platform. This provides deep learning-based file analysis, detailed analysis reporting, and a threat meter to show the risk summary for a file. We use layers of analytics to identify known and potential threats, reduce unknowns, and derive verdicts and intelligence reports for the most commonly used file types.

Sophos Central SD-WAN Orchestration

Makes VPN orchestration easy. Wizard-based tunnel configuration helps create full mesh networks, hub-and spoke models, or complex tunnel setups between multiple firewalls a quick point-and-click exercise. Seamlessly integrates multiple WAN link and SD-WAN functionality and routing optimizations to improve resilience and performance and also integrates with user authentication and Synchronized Security Heartbeat to control access.

Central Firewall Reporting Advanced (30-day)

Cloud-based reporting with several pre-packaged common reports for threats, compliance, and user activity. Includes advanced options for creating custom reports and views with the option to save, schedule or export your custom reports. Includes 30 days of log data retention with the option to add additional storage for additional historical reporting needs.


Sophos MTR provides optional 24/7 threat hunting, detection and response delivered by an expert team as a fully-managed service. Sophos XDR offers extended detection and response managed by your own team. Regardless of whether you manage it yourself, or Sophos manages it for you, your Sophos Firewall is ready to share the necessary threat intelligence and data to the cloud.

Email Protection

Consolidate your email protection with anti-spam, DLP, and encryption. We recommend Sophos Central Email Advanced for the best cloud-based email protection solution. If you require on-box email protection, this module offers essential anti-spam, DLP and encryption.

Optional Add-On

Optional Add-On

Web Server Protection

Harden your web servers and business applications against hacking attempts while providing secure access.

Optional Add-On

Optional Add-On

SOPHOS XGS DESKTOP Series - further information

The Sophos XGS Series Quick Intro

The XGS Series delivers Xstream performance at every price point to power the protection you need for today’s diverse, distributed, and encrypted networks.

Powered by Xstream

Accelerate and offload your important SaaS, SD-WAN, and cloud traffic at the hardware level, while adding performance headroom for TLS and deep packet inspection with integrated Xstream Flow Processors.

High-Speed Connectivity

Customize your firewall’s already versatile connectivity options with an extensive range of add-on modules for high-speed copper, fiber, Power over Ethernet (PoE), and Wi-Fi.

Sophos Central Cloud Management

Sophos Central - The ultimate cybersecurity cloud management platform. Free and easy.

One Console to Manage It All

Sophos Central provides a single cloud management console for all your Sophos products and includes group firewall management at no extra charge.

Reporting in the Cloud

Sophos Central maintains your firewall log data in the cloud with flexible reporting tools that enable you to analyze and visualize your network over time.

Sophos Synchronised Security

Synchronize Your Protection

Sophos Firewall integrates tightly with the rest of the Sophos ecosystem, including ZTNA and Intercept X Endpoint, to enable MTR, XDR, and Synchronized Security with incredible visibility, protection, and response benefits, whether you manage it yourself or let Sophos manage it for you.

Extend Your Network

Sophos Firewall enables you to extend your network anywhere, anyhow, easily and affordably, with a full portfolio of SD-WAN, cloud, and VPN secure access solutions that will integrate your distributed network together.

SOPHOS XGS DESKTOP Series - Out the box

The Sophos XGS 116

The quick video will show you what you get in the box, when you purchase a Sophos XGS 116.

Do make sure you purchase it with a subscription for full protection and you may like to consider adding wireless or even endpoint protection to the bundle to further enhance your network security.

Sophos XGS 136

The quick video will show you what you get in the box, when you purchase a Sophos XGS 116.

Do make sure you purchase it with a subscription for full protection and you may like to consider adding wireless or even endpoint protection to the bundle to further enhance your network security.

information hub

What happens if I don't renew my Sophos Subscription?

For the best protection a firewall will always need an active and configured security subscription.   If this has lapsed or your are thinking about not renewing it, then the following will happen.

1 - You will loose the option to get free support from the Manufacturer

2 - You will loose all hardware warranty and if your physical unit fails, you will no longer be able to get a free replacement

3 - Any firewall polices that use subscription services will need to be updated to remove them, otherwise they will often switch in to blocking mode.

4 - Your firewall will return to the base license subscription

Is support included in the subscription?

Support is included as standard in the 2 main subscription offerings - Standard Protection and Xstream Protection.   This support includes telephone and email support direct with Sophos, Firmware Updates and Hardware Warranty.

Is hardware warranty included?

If you have a current Standard Protection or Xstream Protection, then hardware replacement is included for the length of time you keep that subscription current.  Please do note that in the case of hardware failure, Sophosl will ship you a replacement from outside of Australia.   You may like to consider additional next business day hardware warranty services to supplement this, to get you back and running as quickly as possible.

What options do I have to get additional support if I get stuck?

We know that sometimes we just need that extra little bit of help and support.   The Tech Geeks have a team that are qualified to assist you and get your back on track as quickly as possible.   We offer rates from $150 + GST per hour and would be happy to quote for any work that you need help with.

Real world performance tests

The below tests have been conducted on a dedicated 1:1 uncontended 1Gb/s fibre connection