Sophos XGS Series - Revolutionary Firewall Protection
Sophos Firewall

Sophos XGS Series - Revolutionary Firewall Protection

Pascal - April 22, 2021

In this article, we'll go over all the changes and innovations to the XGS series that make it the best firewall appliance Sophos has ever created.

It has become true after all...

At the Sophos Discover Conference 2017 in Lisbon, the new hardware was presented for the first time. At that time, it was said that it would be available in 2018. However, the release did not happen and it became very quiet about the new hardware. Now, a little more than three years later, it is here. We had the great honor of participating in an exclusive EAP for the XGS since February 2021. We were able to test an XGS 2300 with v18.5 and share our experiences with Sophos. Small conclusion beforehand: It is really fast! 🚀

The main improvements of the XGS Series

Sophos's XGS firewall has been redesigned from the ground up to become a completely new and much more efficient product. The hardware resembles the XG series from the outside, but what matters is what's inside the new XGS series. Under the hood, the new firewall has been designed for maximum protection and more efficient network security.

Dual-Processor Architecture

All the appliances in the XGS series now come with two different multi-core processors. The multi-core CPU and the multi-core networking processing unit, Xstream Flow Processor. Up until now, the Xstream architecture (discussed later) was only software-based, but now in the XGS series, it has a hardware layer that takes the efficiency metrics of this architecture beyond imagination.

In the upcoming firmware releases SFOS 19.0 and 19.5, the software will be further optimized to allow the hardware to offload even more tasks to the NPU e.g. SD-WAN, VPN and Endpoint AV/TLS.

Port Density and Diversity

The XGS series comes with an increased number of built-in interfaces and a more diverse option of connectivity to make sure that this series can keep up with the infrastructure changes. The XGS series does not aim to keep your network protected for the next year, it aims to match your requirements for the next 4-5 years. We've all been hit differently hard by Covid-19, but based on the last 18 months, network requirements can change drastically and your firewall appliances need to be flexible enough to adapt to a variety of changes to the infrastructure.

Note: The FleXi port modules of the XG Firewall are no longer compatible for the XGS series.

Protection & Performance

Intelligent and more focused traffic handling due to extra dedicated hardware frees up resources so they can be used on more intensive tasks such as Core Firewall Tasks, TLS Inspections, and Deep Packet Inspection. Depending upon which statistics you are looking at, the XGS series offers up to 3X or even more performance boost over your previous appliances.

The Xstream Architecture

The new XGS series comes with a new Xstream Flow Processor which is a multi-core networking processing unit or an NPU. Before we can get into how the new processor significantly improves the performance of XGS over XG, we need to take a look at what Xstream architecture is.

Introduced in V18, Xstream architecture is an efficient way for traffic handling by consolidating security in a single streaming deep packet inspection engine. It creates a virtual fast path to offload previously verified and trusted traffic and significantly benefits apps with real-time data such as SaaS and Cloud applications. In the XG series, the Xstream architecture was completely software-based but in the XGS series, Sophos have added a hardware layer i.e the Xstream Flow Processor. This provides a dedicated fast path for app acceleration. All of this means less burden on the CPU which can focus all the resources on core firewall tasks and deep packet inspection hence greatly improving latency and providing much more efficient network protection

The XGS Appliances

The all-new Hardware comes with a series of new appliances that are distributed into different categories. Depending on how big the IT infrastructure is, the appropriate hardware size then comes into action. But before we go into detail about all the categories and the devices, we need to take a look at the portfolio to see how the devices are changed from the XG series.

All the appliances of the XG series have an XGS equivalent with the exception of XG 750. However, with the improved hardware, all the XGS series significantly outperform the XG series hence XGS 6500 is miles ahead of XG 750.

If the power of an XGS 6500 is still not enough for you, I would like to mention here that the XGS 7500 and XGS 8500 models will be added next year 🤐.

Now we will take a look at the three categories that the XGS series devices offer:

Desktop Range

All the Devices from XGS 87 to XGS 136 are categorized as the Desktop Range. These appliances are best for Small offices, Branches, and Retail Stores. The highlights of this category are:

  • All the devices in this range come with the Dual-processor Architecture.
  • All devices of this series have a SFP port, which was also newly integrated in the XGS 87 (was not the case in the XG 86)
  • The devices from 116w to 136w now come with optional modules, which is a new addition for 116w (was not available in 115w XG series)
  • The XGS 116w, 126w and 136w, can now optionally install a WiFi module (was not available on the XG 115w & XG 125w)
  • The devices from 116w to 136w now come with a Power over Ethernet (POE) built-in.
  • The XGS 136w now has 2.5 GE ports
  • All the models except 87w have optional 2nd Power Supply.

1U Rackmount

All the devices from XGS 2100 to XGS 4500 are categorized as 1U Rackmount. These devices are perfectly suited for distributed locations and multiple branches. The highlights of this category are:

  • All the devices in this range come with the Dual-processor Architecture.
  • All the devices from XGS 2100 to XGS 3300 come with One Flexi port bay and XGS 4300 & XGS 4500 come with Two flexi port bays.
  • XGS 3100 onwards come with an SFP+ built-in.
  • All the devices from XGS 2100 to XGS 3300 come with One LAN Bypass port pair and XGS 4300 & XGS 4500 come with Two LAN Bypass port pairs.
  • XGS 4300 and XGS 4500 now come with 2.5 GE ports built-in
  • The memory in the devices from XGS 3300 onwards is boosted for better TLS inspected
  • All the devices in 1U Rackmount now come with Optional centrally-powered PoE Flexi port modules.
  • All the devices in 1U rackmount now come with Optional external redundant power supply
  • XGS 4500 comes with a Dual SSD and an optional internal redundant power source

2U Rackmount

XGS 5500 and XGS 6500 are categorized as 2U Rackmount. These devices are perfectly suited for enterprise requirements. The highlights of this category are:

  • All the devices in this range come with the Dual-processor Architecture.
  • Both of the devices come with Two Flexi port bays.
  • XGS 5500 comes with One high-density Flexi port bay and XGS 6500 comes with Two high-density Flexi port bays.
  • Both devices come with Copper and 10G fiber ports on-board.
  • The XGS 5500 can have 48 maximum ports using modules.
  • The XGS 6500 can have 68 maximum ports using modules.
  • Both devices have Internal redundant power supplies.
  • Both devices have Dual SSDs.
  • Both devices have Boosted Memory for better TLS inspection.


The new XGS series comes with a new licensing model. We've covered everything you need to know about this in detail in a separate article: Sophos Firewall: XGS Hardware launches new license bundles

More information about the XGS series:

Send Your Feedback

Share your thoughts about this article, your private queries are always welcome and greatly appreciated.

Send Feedback
All information are confidential

On our blog we regularly publish articles on various topics related to Sophos. To make sure you don't miss any articles, you can subscribe to our newsletter, and once a month you will receive an email with a summary of all articles published in the last 30 days.

Knowledge base

Do you need help with a Sophos product? Then maybe our free knowledge base can help you. We try to document most support requests in an article so that we can help as many people as possible.