10 GE fiber and double-digit gigabit inspection — as a monthly subscription. The Sophos XGS 3100 1U rackmount with complete Xstream Protection licensing: hardware, licence, 24/7 support and lifecycle replacement in one predictable monthly price. Built for head offices and hosting environments where encrypted traffic inspection can't be the bottleneck.
Why subscribe instead of buy
- Zero CapEx on serious hardware — this class of appliance is a five-figure capital purchase with licensing; here it's one monthly operating cost.
- Never unlicensed — Xstream Protection is bundled for the life of the service, so IPS signatures, sandboxing and support can't lapse.
- 10 GE fiber built in — two SFP+ ports on the front panel, plus two SFP and eight copper ports with a hardware LAN bypass pair.
- Real TLS headroom — 2.47 Gbps of Xstream TLS 1.3 inspection and 55,000 concurrent inspected sessions: decrypt at scale without user complaints.
- Adaptable connectivity — a modular Flexi Port expansion bay takes optional port modules (up to 20 ports total), including centrally powered PoE.
- Hardware refresh is our problem — faulty or end-of-life units are replaced under the service.
- Made for colocation — bundle with our colocation service and we rack, power and connect it directly in front of your hosted infrastructure. Quoted separately.
Key specifications — Sophos XGS 3100 (1U)
| Firewall throughput | 47,000 Mbps |
| IPS throughput | 10,500 Mbps |
| Threat protection | 7,400 Mbps |
| NGFW throughput | 9,000 Mbps |
| IPsec VPN throughput | 25,000 Mbps |
| Xstream TLS 1.3 inspection | 2,470 Mbps |
| Xstream TLS concurrent connections | 55,296 |
| Concurrent connections | 12,260,000 |
| New connections/sec | 186,500 |
| VPN tunnels (IPsec / SSL) | 6,500 / 5,000 |
| Interfaces | 2 × SFP+ 10 GE fiber, 2 × SFP fiber, 8 × GE copper (incl. 1 hardware bypass pair) |
| Expansion | 1 × Flexi Port bay (up to 20 ports total); optional modules incl. PoE and VDSL2 |
| Architecture | Dual-processor: high-speed CPU + dedicated Xstream Flow NPU |
| Storage | Min. 240 GB SATA-III SSD (on-box logs and quarantine) |
| Design | 1U rackmount (kit included), front LCD panel, optional redundant PSU |
Included with your subscription
- Network Protection — next-gen IPS, Advanced Threat Protection, Security Heartbeat
- Web Protection — URL filtering, app control, TLS 1.3 decryption
- Zero-Day Protection — cloud sandboxing with SophosLabs AI analysis
- Central Orchestration — SD-WAN VPN orchestration and central reporting
- Email Protection — full anti-spam with MTA-mode support for queued delivery
- Web Server Protection — reverse-proxy WAF with antivirus scanning
- Enhanced Support — 24/7 Sophos support, unlimited firmware updates
- SD-WAN, VPN, on-box reporting & Sophos Central management — included in the base platform
Subscription terms
£697.43/month ex VAT. Minimum 12-month commitment, billed monthly in advance, then rolling 30-day. Hardware remains our property and is replaced under the service. Colocation bundle, Flexi Port modules and redundant PSU quoted separately.
Traffic comfortably under 5 Gbps inspected? The XGS 2300 covers most mid-size estates at a lower monthly price. Consolidating multiple sites or heavy VPN estates onto one box? Step up to the XGS 3300.
