The top of our Firewall-as-a-Service range — one monthly price, no compromises. The Sophos XGS 3300 1U rackmount with complete Xstream Protection licensing: hardware, licence, 24/7 support and lifecycle replacement in a single predictable subscription. For campus networks, hosting estates and organisations consolidating many sites onto one security platform.
Why subscribe instead of buy
- Zero CapEx on serious hardware — this class of appliance is a five-figure capital purchase with licensing; here it's one monthly operating cost.
- Never unlicensed — Xstream Protection is bundled for the life of the service, so IPS signatures, sandboxing and support can't lapse.
- Inspect encrypted traffic at scale — 3.13 Gbps of Xstream TLS 1.3 decryption and over 100,000 concurrent inspected sessions, the highest in our range.
- A VPN concentrator in its own right — 31.1 Gbps IPsec throughput and 6,500 concurrent tunnels to consolidate an entire branch estate.
- 10 GE fiber built in — two SFP+ ports, two SFP ports and eight copper ports with a hardware LAN bypass pair, plus a Flexi Port bay (up to 20 ports total).
- Hardware refresh is our problem — faulty or end-of-life units are replaced under the service.
- Made for colocation — bundle with our colocation service and we rack, power and connect it directly in front of your hosted infrastructure. Quoted separately.
Key specifications — Sophos XGS 3300 (1U)
| Firewall throughput | 58,000 Mbps |
| IPS throughput | 14,000 Mbps |
| Threat protection | 10,000 Mbps |
| NGFW throughput | 12,500 Mbps |
| IPsec VPN throughput | 31,100 Mbps |
| Xstream TLS 1.3 inspection | 3,130 Mbps |
| Xstream TLS concurrent connections | 102,400 |
| Concurrent connections | 13,700,000 |
| New connections/sec | 257,800 |
| VPN tunnels (IPsec / SSL) | 6,500 / 5,000 |
| Interfaces | 2 × SFP+ 10 GE fiber, 2 × SFP fiber, 8 × GE copper (incl. 1 hardware bypass pair) |
| Expansion | 1 × Flexi Port bay (up to 20 ports total); optional modules incl. PoE and VDSL2 |
| Architecture | Dual-processor: high-speed CPU + dedicated Xstream Flow NPU |
| Storage | Min. 240 GB SATA-III SSD (on-box logs and quarantine) |
| Design | 1U rackmount (kit included), front LCD panel, optional redundant PSU |
Included with your subscription
- Network Protection — next-gen IPS, Advanced Threat Protection, Security Heartbeat
- Web Protection — URL filtering, app control, TLS 1.3 decryption
- Zero-Day Protection — cloud sandboxing with SophosLabs AI analysis
- Central Orchestration — SD-WAN VPN orchestration and central reporting
- Email Protection — full anti-spam with MTA-mode support for queued delivery
- Web Server Protection — reverse-proxy WAF with antivirus scanning
- Enhanced Support — 24/7 Sophos support, unlimited firmware updates
- SD-WAN, VPN, on-box reporting & Sophos Central management — included in the base platform
Subscription terms
£909.56/month ex VAT. Minimum 12-month commitment, billed monthly in advance, then rolling 30-day. Hardware remains our property and is replaced under the service. Colocation bundle, Flexi Port modules and redundant PSU quoted separately.
Not sure you need this much? The XGS 3100 shares the same connectivity with around 30% less inspection headroom, saving roughly £212/month. Talk to us for a sizing recommendation before you commit.
