Multi-gigabit security without the multi-gigabit slowdown — as a monthly subscription. The Sophos XGS 128 (Gen 2) with complete Xstream Protection licensing: hardware, licence, 24/7 support and lifecycle replacement in one predictable monthly price. The top single-CPU desktop model, built for sites that run fast leased lines with full inspection switched on.
Why subscribe instead of buy
- Zero CapEx — one forecastable monthly operating cost instead of hardware purchase plus multi-year licence invoices.
- Never unlicensed — Xstream Protection is bundled for the life of the service, so IPS signatures, sandboxing and support can't lapse.
- Inspect everything, slow nothing — 4.65 Gbps of IPS and 1.45 Gbps of TLS 1.3 decryption mean you can inspect encrypted traffic on a gigabit leased line without throttling it.
- 5G failover ready — optional 5G module adds cellular backup or fixed wireless access, managed from the firewall itself.
- Hardware refresh is our problem — faulty or end-of-life units are replaced under the service.
- Optional colocation bundle — we can rack, power and connect it in our data centre, in front of your hosted servers. Quoted separately.
Key specifications — Sophos XGS 128 (Gen 2)
| Firewall throughput | 19,100 Mbps |
| IPS throughput | 4,650 Mbps |
| Threat protection | 4,000 Mbps |
| NGFW throughput | 4,350 Mbps |
| IPsec VPN throughput | 15,050 Mbps |
| Xstream TLS 1.3 inspection | 1,450 Mbps |
| Concurrent connections | 6,000,000 |
| VPN tunnels (IPsec / SSL) | 2,500 / 1,500 |
| Interfaces | 9 × 2.5 GE copper + 1 × SFP fiber |
| Expansion | Optional 5G module for cellular failover / FWA |
| Design | Desktop with optimised low-noise thermal design and optional redundant power supply |
Included with your subscription
- Network Protection — next-gen IPS, Advanced Threat Protection, Security Heartbeat
- Web Protection — URL filtering, app control, TLS 1.3 decryption
- Zero-Day Protection — cloud sandboxing with SophosLabs AI analysis
- Central Orchestration — SD-WAN VPN orchestration and central reporting
- Email Protection — full anti-spam with MTA-mode support for queued delivery
- Web Server Protection — reverse-proxy WAF with antivirus scanning
- Enhanced Support — 24/7 Sophos support, unlimited firmware updates
- SD-WAN, VPN, on-box reporting & Sophos Central management — included in the base platform
Subscription terms
£123.51/month ex VAT. Minimum 12-month commitment, billed monthly in advance, then rolling 30-day. Hardware remains our property and is replaced under the service. Colocation bundle priced on request. Optional 5G module quoted separately.
Same port layout, lighter traffic? The XGS 118 offers identical connectivity with around 30% less inspection headroom at a lower monthly price. Need 10 GE fiber? Ask about the XGS 138.
