New Sophos XGS 1U Firewall Appliances: 2026 Comparison

On 4 November 2026, Sophos introduced several new products: the NDR 5500 appliance for network monitoring, the new Xstream Plus licence bundle and, finally, new XGS hardware with expansion modules (Flexi Port modules).

The Sophos XGS 2380, 3380, 4580 and 5580 bring more performance for greater demands: more headroom for inspecting encrypted connections, faster network interfaces and additional expansion options. This is a welcome addition for businesses whose networks and traffic are growing. In this article, we compare specifications and throughput with the existing models and show the list prices of the new appliances and Flexi Port modules.

Comparing the new XGS hardware

XGS 2380 and 3380: short chassis, one CPU

The two smaller appliances use an Intel x86 CPU with cores reserved for Xstream FastPath. They do not contain a separate Xstream Flow Processor. The short chassis is 305 mm deep, making it suitable for racks where a larger appliance would be difficult to accommodate.

The XGS 3380 offers more headroom, particularly for 25 GbE connections and higher connection counts. A faster interface alone does not increase content inspection performance. If you intend to fill much of a 25 GbE uplink with decrypted and inspected traffic, you need to consider the TLS figures separately.

XGS 4580 and 5580: dedicated network processor and SSD redundancy

The larger appliances combine an AMD x86 CPU with a Marvell Octeon CN9670 as the Xstream Flow Processor. Both still occupy one rack unit but require a chassis depth of 510 mm. They also have two Flexi Port slots and two NVMe SSDs with software RAID-1.

RAID-1 mirrors the SSDs. Two 512 GB SSDs therefore do not provide 1 TB of usable storage. The new design simplifies servicing: faulty SSDs can be replaced on site through the RMA process without returning the entire firewall. The SSDs are not hot-swappable and are not a separately orderable storage upgrade. Replacements use drives supplied by Sophos.

All four models also have an RJ45 management port, RJ45 and Micro-USB console connections, two front USB 3.0 ports and an LCD. Optical transceivers are sold separately. Fixed bypass port pairs and PoE are not included on these models.

Firewall throughput, Threat Protection and TLS Inspection

The following table uses the figures from the Sophos Firewall brochure available at launch. All throughput figures are in Gbit/s.

How much faster are the new models?

For comparison with the existing appliances, we focus on Threat Protection and TLS Inspection. All figures come from the same current Sophos Firewall brochure. The table shows the existing and new throughput in Gbit/s, followed by the increase over the existing model, rounded to a whole percentage.

The largest gains here are for the XGS 2380 and 3380. The increase is much smaller for the XGS 4580 versus the 4500 and the XGS 5580 versus the 5500. The last comparison also involves a change in form factor: the XGS 5500 occupies two rack units, while the XGS 5580 needs only one.

The increase is calculated as (new value ÷ existing value − 1) × 100. +300% means four times the throughput. This comparison provides context; it does not identify official successors or alternatives at the same price. These are differences between manufacturer laboratory figures, not guaranteed improvements in an existing installation.

What the measurements mean

Sophos measures under ideal laboratory conditions using Keysight-Ixia BreakingPoint. The firewall and IPsec tests use HTTP responses of 512 KB; the IPsec figure is spread across multiple tunnels. IMIX uses a mix of UDP packets of 66, 570 and 1518 bytes.

Threat Protection includes firewall, IPS, Application Control and malware prevention with an Enterprise Traffic Mix. NGFW is measured with IPS and Application Control using a different HTTP test profile. This is why a Threat Protection figure can exceed the NGFW or IPS figure. The numbers come from different test methods and cannot be read as a simple sequence of cumulative protection levels.

TLS Inspection is measured with IPS, HTTPS connections and different cipher suites. For an environment with substantial encrypted traffic, this figure is usually more useful than raw firewall throughput. Packet sizes, applications, rules, logging and the actual TLS mix affect the result. A phased TLS inspection rollout remains important even with powerful hardware.

These are manufacturer specifications, not measurements from our own test lab. For the XGS 5580, we use the 58 Gbit/s in the detailed brochure; a different rounded launch figure does not replace a model-specific measurement table.

Connections and VPN capacity

Tunnel count and VPN throughput are separate limits. A high maximum tunnel count does not promise that all tunnels can operate at high bandwidth simultaneously. With many short connections, the rate of new connections may matter more than raw bandwidth.

Power requirements and installation

For all four models, Sophos specifies an operating temperature of 0 to 40 °C and relative humidity of 10 to 90 percent, non-condensing. The long models in particular belong in a suitable equipment room because of their noise levels. Redundant power supplies only deliver their full benefit with separate power feeds; they do not replace a second firewall node.

New Flexi Port modules for XGS 4580 and 5580

Two new modules accompany the new appliances. Compatibility is model-specific: these modules are not universal expansions for every XGS firewall.

The 40 GbE QSFP+ module adds a high-speed connection, for example to a suitable core network. It increases neither TLS throughput nor the performance of the security engines. Optics, the remote endpoint and cabling must match the planned connection.

The 10 GbE fibre bypass module provides two LC fibre ports for a bypass path. For inline deployment, define and test in advance how the connection should behave during a failure. Bypass can maintain traffic flow; traffic forwarded without inspection does not automatically retain its previous protection.

The new models also support familiar Flexi Port options, including 8 × 1 GbE copper, 8 × 1 GbE SFP, 4 × 10 GbE SFP+, 4 × 1 GbE copper with two bypass pairs, and the mixed module with 2 × 10 GbE NBASE-T and 2 × 10 GbE SFP+. The existing PoE modules are not intended for these four new models.

List prices and ordering date

The hardware prices shown are EUR list prices at launch. Licences, optional modules, transceivers and services are additional.

The first ordering date is 4 November 2026. This is distinct from stock availability and a confirmed delivery date.

The new appliances and Flexi Port modules will be available in our shop shortly. We will add direct links here once the product pages are ready. Until then, the list prices provide a guide. Our separate comparison of Xstream Protection and Xstream Plus explains which ongoing services may be useful alongside the hardware purchase.

Our view on the new Sophos XGS models

More performance for inspected traffic, modern interfaces and new expansion options: the XGS 2380, 3380, 4580 and 5580 are welcome additions. The comparison figures show particularly large gains for the XGS 2380 and 3380 over older models with similar numbers. Businesses that need this performance gain additional options for expanding their networks.

What is still missing, in our view, is the long-overdue refresh of the more affordable rackmount segment. The XGS 2100, 2300, 3100 and 3300 have been available since April 2021; the XGS 4300 and 4500 followed in June of the same year. This generation is now around five and a half years old. We would also have liked updated versions of the XGS 2100 and similar appliances, priced closer to the existing models.

One example is the standard network connectivity: the XGS 2100 and XGS 2300 have no onboard 10 GbE; the XGS 3100 already has two 10 GbE SFP+ ports. This is documented in the official Quick Start Guide. Even the XGS 138 desktop model now includes two such connections. Retrofitting the XGS 2100 or 2300 with the four-port module (XSAZTCHF4) costs an additional EUR 1’301.85 excluding VAT at list price, plus transceivers. Modern standard connectivity without an additional module would be particularly welcome here.

At the same time, the range is expanding. From our advisory perspective, there are now almost too many appliances with partly overlapping use cases. This makes the decision harder for customers: which model is sufficient today, how much headroom is needed for growth, and when is the next price step worthwhile? A clearer range with more distinct performance gaps would make sizing and long-term planning easier. Similar model numbers offer only limited help, as the throughput comparisons show.

For most of our customers with fewer than 100 employees, the available budget is a key deciding factor alongside the required performance. The XGS 2380 alone starts at a list price of EUR 9’134.66 for the appliance, with ongoing licences on top. More performance is welcome, but it must remain affordable over the planned service life. For these customers, we would therefore like new models offering modern interfaces and appropriate performance headroom at more accessible prices.

We would also have appreciated more preparation time for advising customers. At Avanet, we only received the detailed technical information and prices on 4 November 2026. We have had earlier access to information for previous product introductions. A little more time before the public launch would help us assess the models and give customers informed advice from day one.

Sources

• Sophos Firewall Solution Brochure
• Sophos: Technical specifications for the new 1U models, 3 November 2026
• Sophos: Network launch announcement