The distributed-edge flagship — as a monthly subscription. The Sophos XGS 138 (Gen 2) with complete Xstream Protection licensing: hardware, licence, 24/7 support and lifecycle replacement in one predictable monthly price. The only desktop model with a dedicated Xstream Flow processor, 10 GE fiber connectivity and built-in Power-over-Ethernet.
Why subscribe instead of buy
- Zero CapEx — one forecastable monthly operating cost instead of hardware purchase plus multi-year licence invoices.
- Never unlicensed — Xstream Protection is bundled for the life of the service, so IPS signatures, sandboxing and support can't lapse.
- Hardware-accelerated inspection — a dedicated Xstream Flow NPU offloads trusted traffic in silicon, sustaining 5.85 Gbps of IPS and 1.7 Gbps of TLS 1.3 decryption under real workloads.
- Fiber and PoE built in — two 10 GE SFP+ ports for high-speed uplinks plus two 2.5 GE PoE ports (30W each) to power access points or phones directly from the firewall.
- 5G failover ready — optional 5G module adds cellular backup or fixed wireless access, managed from the firewall itself.
- Hardware refresh is our problem — faulty or end-of-life units are replaced under the service.
- Optional colocation bundle — we can rack, power and connect it in our data centre, in front of your hosted servers. Quoted separately.
Key specifications — Sophos XGS 138 (Gen 2)
| Firewall throughput | 19,100 Mbps |
| IPS throughput | 5,850 Mbps |
| Threat protection | 4,750 Mbps |
| NGFW throughput | 5,100 Mbps |
| IPsec VPN throughput | 6,600 Mbps |
| Xstream TLS 1.3 inspection | 1,700 Mbps |
| Concurrent connections | 6,550,000 |
| New connections/sec | 105,000 |
| VPN tunnels (IPsec / SSL) | 2,500 / 1,500 |
| Interfaces | 2 × 10 GE SFP+ fiber, 2 × 2.5 GE copper, 4 × GE copper, 2 × 2.5 GE PoE (30W per port) |
| Architecture | Dual-processor: AMD x86 CPU + dedicated Xstream Flow NPU |
| Expansion | Optional 5G module for cellular failover / FWA |
| Design | Desktop with optional redundant power supply (rack kit available) |
Included with your subscription
- Network Protection — next-gen IPS, Advanced Threat Protection, Security Heartbeat
- Web Protection — URL filtering, app control, TLS 1.3 decryption
- Zero-Day Protection — cloud sandboxing with SophosLabs AI analysis
- Central Orchestration — SD-WAN VPN orchestration and central reporting
- Email Protection — full anti-spam with MTA-mode support for queued delivery
- Web Server Protection — reverse-proxy WAF with antivirus scanning
- Enhanced Support — 24/7 Sophos support, unlimited firmware updates
- SD-WAN, VPN, on-box reporting & Sophos Central management — included in the base platform
Subscription terms
£173.71/month ex VAT. Minimum 12-month commitment, billed monthly in advance, then rolling 30-day. Hardware remains our property and is replaced under the service. Colocation bundle priced on request. Optional 5G module quoted separately.
Running heavy site-to-site IPsec VPN rather than deep inspection? The XGS 128 delivers more than double the IPsec throughput at a lower monthly price — ask us for a sizing recommendation. Need Wi-Fi built in? The 138 has no wireless variant; consider the XGS 128w or a separate access point powered by the 138's PoE ports.
