Sophos XGS 88w Wireless (Gen 2) Firewall
Quiet Desktop Firewall with 9,900 Mbps Throughput and Wi-Fi 6

Name: Sophos XGS 88w Wireless (Gen 2) Firewall
Brand: Sophos
Availability: InStock

Wired Version Available!

License Bundles

The following license bundles are available for XGS and XG Series firewalls:

BlueAlly services are offered throughout the United States.

Xstream Appliance Bundle	Standard Appliance Bundle
Base License	Base License
Xstream protection	Standard protection
Network Protection Web Protection Zero-Day Protection Central Orchestration Enhanced Support	Network Protection Web Protection Enhanced Support

Individual licenses and firewall features

You can also subscribe to individual licenses. The licenses deliver the following features:

Base License: Stateful Firewall, VPN, Wireless.
Network Protection: Intrusion Prevention (IPS), Advanced Threat Protection (ATP), SD-RED Device Management.
Web Protection: Web Security and Control, Application Control, Web Malware Protection.
Zero-day protection: Machine Learning, Sandboxing File Analysis, Threat Intelligence.
Central Orchestration: SD-WAN VPN Orchestration, CFR Advanced.
Email Protection: Anti-spam, Antivirus, DLP, Encryption, Email Malware Protection.
Webserver Protection: Web Application Firewall.

Overview of the SFOS licensing model

SFOS includes a Base License which is required for all hardware and virtual firewalls and is perpetual. Additional features can be purchased as subscriptions with terms ranging from one to five years, depending on the product. Irregular terms greater than one year are also possible. The subscriptions can be purchased individually or as bundles. Some of the bundles include hardware or virtual appliance, which includes the perpetual Base License, and other bundles contain subscriptions only.

Upon the launch of the XGS Series hardware appliances in late April 2021, we introduced a new simplified licensing scheme. Existing customers with XG Series hardware or the software/virtual appliances running SFOS were migrated to the new licensing scheme in August 2021. SG Series hardware customers who had previously switched to SFOS were also migrated.

Figure 1: Sophos Firewall bundles and subscriptions

Note:

Central Orchestration requires SFOS 18.5 MR1 or later.
Zero-Day Protection was formerly known as Sandstorm Protection.

There are two levels of support, Enhanced and Enhanced Plus. The higher level of support provides direct access to senior Sophos Support staff and also provides a warranty for some connected Sophos appliances. If you buy any of the bundles, then the bundle includes Enhanced Support, and you can add a higher level of support by purchasing the Enhanced to Enhanced Plus Support Upgrade product.

Sorry, this product is no longer available, please contact us for a replacement.

More pricing below, click here!

Overview

Features

Xstream

Licensing and Deployment

Protection Modules

Specifications

Documentation

Overview:

Note: XGS 87/87w and XGS 88/88w don't support on-appliance reporting.

Much More Than a Firewall

Sophos Firewall and XGS Series appliances are at the heart of the world’s best network security platform. Consolidate your network protection with our integrated and extensible platform to secure your hybrid networked world. Unlock supreme desktop performance, improved energy efficiency, and a wealth of new high-speed connectivity options.

Sophos second-generation XGS Series desktop appliances deliver double the performance of our first-generation models while cutting power consumption in half. All these desktop firewalls include 2.5 GE interfaces, allowing traffic to flow freely and without bottlenecks, from your firewall to your 2.5 GE switch to your Wi-Fi 6 access point.

Customers with noise-sensitive environments such as healthcare, education, and retail will love the whisper-quiet operation of the fanless XGS 88 and XGS 108 models. Using the expansion bay, an optional 5G module adds either redundant cellular connectivity or cost-effective 5G fixed wireless access (FWA).

The XGS 88 to XGS 128 models feature a streamlined, single-CPU architecture that utilizes virtual FastPath technology for traffic acceleration (in combination with Sophos Firewall OS v21 and higher). As our gateway model to the distributed edge, the XGS 138 boasts a dedicated Xstream Flow processor for hardware acceleration and two 10 GE SFP+ interfaces for high-speed fiber connectivity. All models except the XGS 138 are optionally available with built-in Wi-Fi.

Product highlights

All protection features are supported on every XGS 1xx desktop model and most are available on XGS 88 and XGS 88w.
Accelerated performance: Up to double the throughput of Gen.1 models plus Xstream virtual FastPath acceleration for IPsec VPN (XGS 88 to XGS 128) in combination with SFOS v21 and higher
High-speed connectivity built in: 2.5 GE interfaces on everymodel,two built-in 10 GE SFP+ interfaces on the XGS 138, and Wi-Fi 6 (802.11ax) integrated on all w-models with concurrent use of the 2.4 and 5 GHz bands for better performance
Power and environment: Up to 50% lower power consumption, fanless XGS 88 and 108 models for whisper-quiet operation, optimized thermal design for XGS 118 and above, and redundant power option for all XGS 1xx models
Optional connectivity: New 5G module available exclusively for Gen.2 models for more cost-effective redundant connectivity
Streamlined hardware architecture: The XGS 88 to XGS 128 models boast a new single-CPU architecture while the XGS 138 has a refreshed dual-processor architecture

Sophos XG Firewall

Powerful Protection and Performance

Sophos Firewall includes the latest advanced protection technologies and threat intelligence, including:

Streaming DPI engine with web protection and IPS
Accelerated TLS 1.3 encrypted traffic inspection
Zero-day AI and machine learning analysis
Real-time cloud sandboxing
DNS Protection

The best part is, you don' t need to compromise on performance. This is thanks to our programmable Xstream architecture. It offloads benign traffic flows and crypto operations as well as VPN and select application routing to accelerate these network traffic flows and create performance headroom for traffic that actually needs deep packet inspection.

Sophos Firewall leverages the Sophos Cloud to ensure that your organization is protected from the latest threats and further maximize your performance. You get the latest AI and machine learning technology from SophosLabs working to identify previously unseen threats and malicious URLs. Using a common cloud, any new threat attacking a single Sophos customer is instantly shared across all our customers, blocking it everywhere. In addition, offloading this analysis from your firewall to the cloud boosts your performance even further.

Sophos XGS Series Appliances

All XGS Series firewall appliances are built upon a dual-processor architecture, combining a high-performance, multi-core CPU with a dedicated Xstream Flow Processor for targeted acceleration at the hardware level. This gives you all the flexibility and adaptability of an x86 based firewall plus a significant performance boost over legacy firewall designs.

Model		Tech Specs			Throughput
	Form Factor	Slots (Max Ports)	w-model	Swappable Components	Firewall (Mbps)	IPsec VPN (Mbps)	Threat Protection (Mbps)	Xstream SSL/TLS (Mbps)
XGS 88(w)	Gen.2 Desktop*	4/- (4)	Wi-Fi 6	n/a	9,900	6,000	2,000	600
XGS 108(w)	Gen.2 Desktop*	7/-(7)	Wi-Fi 6	Optional: 2nd power supply, 5G module	12,500	8,250	2,500	800
XGS 118(w)	Gen.2 Desktop*	10/1(10)	Wi-Fi 6	Optional: 2nd power supply, 5G module	15,500	13,000	3,250	1,100
XGS 128(w)	Gen.2 Desktop*	10/1(10)	Wi-Fi 6	Optional: 2nd power supply, 5G module	19,100	15,050	4,000	1,450
XGS 138(w)	Gen.2 Desktop*	8/1(8)	n/a	Optional: 2nd power supply, 5G module	19,100	6,600	4,750	1,700
XGS 87(w)	Gen.1 Desktop	5/- (5)	Wi-Fi 5	n/a	3,850	3,000	850	375
XGS 107(w)	Gen.1 Desktop	9/- (9)	Wi-Fi 5	Optional: 2nd power supply	7,000	4,000	1,110	420
XGS 116(w)	Gen.1 Desktop	9/1 (9)	Wi-Fi 5	Optional: 2nd power supply, 3G/4G, 5G, Wi-Fi**	7,700	4,800	2,160	650
XGS 126(w)	Gen.1 Desktop	14/1 (14)	Wi-Fi 5	Optional: 2nd power supply, 3G/4G, 5G, Wi-Fi**	10,500	5,500	2,700	800
XGS 136(w)	Gen.1 Desktop	14/1 (14)	Wi-Fi 5	Optional: 2nd power supply, 3G/4G, 5G, Wi-Fi**	11,500	6,350	3,000	950
XGS 2100	1U Short	10/1 (18)	n/a	Optional: external power supply	30,000	17,000	5,000	1,100
XGS 2300	1U Short	10/1 (18)	n/a	Optional: external power supply	39,000	20,500	5,550	1,450
XGS 3100	1U Short	12/1 (20)	n/a	Optional: external power supply	47,000	25,000	7,400	2,470
XGS 3300	1U Short	12/1 (20)	n/a	Optional: external power supply	58,000	31,100	10,000	3,130
XGS 4300	1U Long	12/2 (28)	n/a	Optional: external power supply	75,000	62,500	25,200	8,000
XGS 4500	1U Long	12/2 (28)	n/a	Optional: internal power supply	80,000	75,550	31,850	10,600
XGS 5500	2U	16/3 (48)	n/a	Built in: redundant power, SSDs, fans	100,000	92,500	46,000	13,500
XGS 6500	2U	20/4 (68)	n/a	Built in: redundant power, SSDs, fans	120,000	109,800	53,500	16,000
XGS 7500	2U	22/4 (70)	n/a	Built in: redundant power, SSDs, fans	160,000	117,000	70,000	19,500
XGS 8500	2U	22/4 (70)	n/a	Built in: redundant power, SSDs, fans	190,000	141,000	92,500	24,000

* All Gen.2 Desktop models include two or more 2.5 GE ports
** 2nd Wi-Fi module option for XGS 116w, 126w and 136w only

Performance Test Methodology

General: Maximum throughput measured under ideal test conditions using industry standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services.
Firewall: Measured using HTTP traffic and 512 KB response size.
Firewall IMIX: UDP throughput based on a combination of 66 byte, 570 byte and 1518 byte packet sizes.
IPS: Measured with IPS with HTTP traffic using default IPS ruleset and 512 KB object size.
IPsec VPN: HTTP throughput using multiple tunnels and 512 KB HTTP response size.
TLS inspection: Performance measured with IPS with HTTPS sessions and different cipher suites.
Threat Protection: Measured with Firewall, IPS, Application Control, and malware prevention enabled using HTTP 200 KB response size.

Features:

See How it Works:

Security Heartbeat: Your firewall and your endpoints are finally talking

Sophos Firewall is the only network security solution that is able to fully identify the user and source of an infection on your network, and automatically limit access to other network resources in response. Our unique Security Heartbeat shares telemetry and health status between Sophos endpoints and your firewall and integrates endpoint health into firewall rules to control access and isolate compromised systems.

Synchronized Application Control

Using Security Heartbeat, we also have a solution to one of the biggest problems most network administrators face today – lack of visibility into network traffic.
Synchronized Application Control utilizes the Heartbeat connections with Sophos endpoints to automatically identify, classify, and control application traffic. All encrypted, custom, evasive, and generic HTTP or HTTPS applications which are currently going unidentified will be revealed.

You can’t control what you can’t see. All firewalls today depend on static application signatures to identify apps. But those don’t work for most custom, obscure, evasive, or any apps using generic HTTP or HTTPS.

Sophos Firewall utilizes Synchronized Security to automatically identify, classify, and control all unknown applications easily blocking the apps you don’t want and prioritizing the ones you do

Lateral Movement Protection

Lateral Movement Protection automatically isolates compromised systems at every point in the network to stop attacks. Healthy endpoints assist by ignoring all traffic from unhealthy endpoints, enabling complete isolation, even on the same network segment, to prevent threats and active adversaries from spreading or stealing data.

Synchronized User ID

User authentication is critically important in a nextgeneration firewall but often challenging to implement in a seamless and transparent way. Synchronized User ID eliminates the need for client or server authentication agents by sharing user identity between the endpoint and the firewall through Security Heartbeat.

Active Threat Response

Sophos Firewall uniquely integrates with many Sophos products to automatically coordinate a response to an active adversary or attack:

Sophos Endpoint and XDR
Sophos Managed Detection and Response services
Sophos switches and wireless access points
Sophos ZTNA remote access
Sophos messaging protection
And third-party threat intelligence solutions

Regardless of how the threat is first identified, whether at the firewall, by another product, or by a security analyst, Sophos Firewall coordinates a Synchronized Security response across Sophos products. It will identify and isolate the compromised host and prevent lateral movement and external communications until the threat can be investigated and cleaned up.

Sophos Synchronized Security integration between products also provides additional capabilities you can’t get anywhere else that adds tremendous value to your network:

Synchronized Application Control takes advantage of telemetry gathered by the endpoint about active, networked applications and shares that with the firewall enabling control of applications that might otherwise go unidentified.
Synchronized User ID works similarly to share user identity between the endpoint agent and the firewall to enforce user-based policies without the need for a separate client or server identity solution.
Synchronized SD-WAN leverages Synchronized Application Control for traffic matching operations to effectively route custom or otherwise unknown application traffic across your network.

Work From Anywhere

Sophos Firewall offers the ultimate in flexible connectivity and secure access for even the most demanding networks. You get a fully integrated SD-WAN solution, along with a full suite of secure access products for Zero Trust Network Access, SD-RED edge devices, VPN, switching, and wireless — all managed from Sophos Fusion.

Securing and managing remote workers with ZTNA ensures users only have access to the applications they need, and not the whole network. ZTNA also integrates with Sophos Firewall and Sophos Endpoint to ensure a compromised device can’t access the network at all. ZTNA also protects your applications from hacks and attacks by making them invisible to the outside world. The best part is, Sophos Firewall integrates a Sophos ZTNA gateway directly into your firewall to make deployment easy.

Sophos Firewall also includes one of the best integrated SD-WAN solutions available in any firewall. Xstream SDWAN provides a powerful integrated SD-WAN solution with:

Performance-based link selection and routing
Load balancing with configurable weightings across multiple links
Zero-impact transitions between links in the event of a disruption
Fusion cloud-managed orchestration
Xstream FastPath acceleration of VPN tunnel traffic

Sophos Firewall makes interconnecting your hybrid distributed enterprise easy and makes it extremely robust, ensuring maximum reliability and uptime.

Xstream

All the next-gen protection, performance and value you need to power even the most demanding networks. Also available with the XGS Series model of your choice included.

Base Firewall Features

Networking and SD-WAN: Wireless, SD-WAN, application aware routing, traffic shaping
Protection and Performance: Xstream Architecture with Network Flow FastPath, TLS 1.3 inspection, Deep-Packet Inspection
SD-WAN and VPN: Xstream SD-WAN, IPsec/SSL site-to-site and remote access VPN (unlimited), SD-RED site-to-site
Reporting: Historical on-box logging and reporting, Sophos Fusion cloud reporting (seven-day data retention)

Network Protection

Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
Xstream DPI engine: streaming deep-packet inspection
IPS: Next-gen Intrusion Prevention
ATP: Advanced Threat Protection
Synchronized Security Heartbeat: integration with Sophos Endpoints to identify and isolate threats
Clientless VPN: HTML5
SD-RED VPN: Manage SD-RED devices
Reporting: Extensive network and threat reporting

Web Protection

Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
Xstream DPI engine: streaming deep-packet inspection
Web Control: by user, group, category, URL, keyword
Web Threat Protection: malware, PUA, malicious JavaScript, pharming
App Control: by user, group, category, risk, and more
Synchronized App Control: integration with Sophos endpoints to identify unknown apps
Synchronized SD-WAN: utilizing Synchronized App Control to route unknown apps
Reporting: Extensive web and app reporting

Zero-Day Protection

Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
Xstream DPI engine: streaming deep-packet inspection
Zero-Day Threat Protection: analyze all unknown files using AI, ML, and sandboxing
Powered by SophosLabs Intelix: cloud-based intelligence and analysis
Machine Learning: using multiple deep learning models
Cloud Sandboxing: dynamic runtime analysis of unknown files
Reporting: Extensive threat intelligence analysis reporting

DNS Protection and Xstream Protection Bundle-Only Features

Domain name resolution service: Backed by SophosLabs and powered by AI to block malicious or unwanted URLs
Active Threat Response: For Sophos MDR/XDR threat feeds
Active Threat Response: For third-party regional/vertical threat feeds

Sophos Fusion Management

Group Firewall Management: Synchronized policy across firewall groups
Backup and firmware updates: storage and scheduling
Zero-touch deployment: for new firewalls from the cloud

Sophos Orchestration

SD-WAN Orchestration: Point and click Site-to-Site VPN Orchestration
Cloud Firewall Reporting: Multi-firewall reporting with save, schedule and export reports (30-day data retention)
XDR and MDR Connector: Support for XDR and MDR services

Licensing and Deployment

We recommend the Xstream Protection bundle for the ultimate in security, but if you prefer to customize your protection, all subscriptions are also available for individual purchase.

Xstream Protection Bundle:
Base License	Networking, wireless, Xstream Architecture, unlimited remote access VPN, site-to-site VPN, reporting
Network Protection	Xstream TLS/DPI, IPS, Active Threat Response with Sophos X-Ops threat feeds, Heartbeat, SD-RED, reporting
Web Protection	Xstream TLS and DPI engine, Web Security and Control, Application Control, reporting
Zero-Day Protection	Machine Learning and Sandboxing File Analysis, reporting
Orchestration	SD-WAN VPN Orchestration, Firewall Advanced Reporting (30-days), MDR/XDR Connector
DNS Protection (not sold separately)	Cloud-based DNS service for web security and compliance
Bundle-only Features (not sold separately)	Active Threat Response with MDR/XDR threat feeds and third-party threat feeds
Enhanced Support	24/7 support, feature updates, advanced replacement hardware warranty for term

Custom Protection

You can choose the Standard Protection Bundle or purchase any of the protection modules separately.

Standard Protection Bundle:
Base License	Networking, wireless, Xstream Architecture, Xstream SD-WAN, unlimited remote access VPN, site-to-site VPN
Network Protection	Xstream TLS and DPI engine, IPS, ATP, Security Heartbeat, manage SD-RED, reporting
Web Protection	Xstream TLS and DPI engine, Web Security and Control, Application Control, reporting
Enhanced Support	24/7 support, feature updates, advanced replacement hardware warranty for term

Additional Protection Modules:
Email Protection	On-box antispam, AV, DLP, encryption
Web Server Protection	Web Application Firewall

Sophos Fusion Management and Reporting:

Sophos Fusion Management and Reporting (included at no charge):
Sophos Fusion Management	Group firewall management, backup management, firmware update scheduling
Sophos Firewall Reporting	Prepackaged and custom report tools with seven days cloud storage for no extra charge

Additional Protection:

Additional Protection Services, Products and Modules:
Managed Detection and Response	24/7 threat hunting, detection and response delivered by an expert team
Sophos Intercept X Endpoint with XDR	Sophos Fusion managed next-gen endpoint protection with EDR
Zero Trust Network Access	A ZTNA gateway is integrated into your firewall
Sophos Email	Sophos Fusion managed antispam, AV, DLP, encryption
Sophos Switch	Cloud-managed access layer switches
Sophos Wireless	Scalable, cloud-managed Wi-Fi

Support

A support subscription is required to receive firmware upgrades. Enhanced support is included in all protection bundles, but you can enhance your support experience further by upgrading.

Additional Support Options:
Enhanced Plus Support Upgrade	Upgrade your support with VIP support, hardware warranty for add-ons, TAM option (extra cost) In Active/Passive HA scenarios, Enhanced Plus support is required in the primary device to be eligible for Advanced RMA on the passive device

Cloud, Virtual and Software Appliance Licensing Options

If you’re deploying Sophos Firewall in the cloud, in a virtual environment, or as software on your own hardware, the licensing guide below can help you find the right option.

Model	Equivalent AWS instance	Equivalent Azure VM	Software/Virtual License*
XGS 88(w)/87(w)	t3.medium	-	2C4
XGS 108(w)/107(w)	c5.large	Standard_F2s_v2	-
XGS 118(w)/116(w)	-	-	4C6
XGS 2100	c5.xlarge	-	-
XGS 2300	m5.xlarge	Standard_F4s_v2	6C8
XGS 3100	c5.2xlarge	Standard_F8s_v2	8C16
XGS 4300	c5.4xlarge	Standard_F16s_v2	16C24
XGS 5500	c5.9xlarge	Standard_F32s_v2	Unlimited

* Based upon CPU cores and RAM

Deployment Options

XGS Series

Purpose-built devices to provide the ultimate in performance.

AWS/Azure

Protect your network infrastructure in the AWS or Azure cloud.

Virtual

Install on VMware, Citrix, Microsoft Hyper-V, and KVM.

Software

Install the Sophos Firewall OS image on your own Intel hardware or server.

Cloud

Sophos Firewall offers the very best network visibility, protection, and response to secure your public, private, and hybrid cloud environments.

As an AWS Advanced Technology Partner, Sophos is a validated AWS Security Competency vendor, AWS marketplace seller, and AWS Public Sector Partner.

Sophos Firewall is now available in the AWS marketplace with autoscaling support with either a pay-as-you-go (PAYG) license model, or bring your own license (BYOL) to best fit your needs.

Sophos Firewall is certified and optimized for Azure and is available in the Microsoft Azure Marketplace. Take advantage of the free test drive or the flexible PAYG or BYOL licensing options.

Sophos Firewall is Nutanix AHV and Nutanix Flow Ready, bringing the world’s best next-gen firewall visibility, protection, and response to the industry’s leading Hyper Convergence Infrastructure (HCI) platform. Take advantage of a 30-day free trial using our KVM image and flexible licensing

Virtual and Software

Sophos Firewall supports a broad range of virtualization platforms and can also be deployed as a software appliance on your own x86 Intel hardware:

Protection Modules

You can choose from a number of modules to customize the protection offered by your firewall to your individual needs and deployment scenario.

Base Firewall

The Sophos Firewall Base License includes the Xstream Architecture, networking, wireless, SD-WAN, VPN, and reporting.

Xstream SD-WAN and Networking

Includes all networking, routing, and SD-WAN capabilities including zone-based stateful firewall, NAT, VLAN, SDWAN profiles, performance-based WAN link selection and monitoring, load balancing, zero-impact WAN link transitions, and Xstream FastPath acceleration of trusted application traffic.

VPN

Provides standards-based site-to-site and remote access VPN (free up to the capacity of the firewall) with support for IPsec and SSL. Sophos Connect remote access VPN client for Windows and Macs offers seamless and easy deployment and configuration options. SD-RED layer 2 siteto-site tunnels offers a light-weight robust VPN alternative.

Reporting

Extensive on-box reporting provides valuable insights into threats, users, applications, web activity, and much more. Note that specific reporting functionality may be dependent on other protection modules to get the full benefits (for example, Web Protection or web and app reports).

Xstream Architecture

Enables high performance TLS 1.3 inspection, deep-packet inspection, and network flow FastPath to accelerate trusted SaaS, SD-WAN, and cloud application traffic. Note that Network and Web Protection are required to get the full benefits of the Xstream Architecture.

Secure Wireless

Built-in wireless controller for Sophos APX wireless access points. Plug-and-play access point discovery makes setup easy. Support for multiple SSIDs, hotspots, guest networks, and the diverse encryption and security standards.