XGS Series
SMB and branch office:
1st Gen XGS desktop models
The original XGS desktop models combine advanced hardware technology with excellent value and connectivity.
Customers looking for an all-in-one network security solution will appreciate the seamless connectivity options available with our desktop appliances. With the modularity that smaller businesses, retail outlets, and branch offices need to grow and adapt to changing circumstances, they offer the perfect balance between price and performance.
All first-generation XGS desktop models are optionally available with built-in Wi-Fi and all are powered by a high-speed CPU plus a dedicated Xstream Flow processor for hardware acceleration.
Compare XGS Gen.1 desktop models
Scroll
XGS 87 / 87w
Performance
FIREWALL3,850 Mbps
TLS INSPECTION375 Mbps
FIREWALL IMIX3,000 Mbps
IPS1,200 Mbps
IPSEC VPN3,000 Mbps
NGFW700 Mbps
THREAT PROTECTION850 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 4 X GE copper
1 X SFP fiber*
POWER-OVER-ETHERNET (FIXED) N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 5 (802.11ac)
2X2:2 MIMO
2 external antennas
Single radio, 2.4 GHz or 5 GHz
Modularity
EXPANSION SLOTS N/A
OPTIONAL ADD-ON MODULES SFP transceivers
Redundancy
SWAPPABLE COMPONENTS N/A
XGS 87 / 87w
Front
Back
XGS 107 / 107w
Performance
FIREWALL7,000 Mbps
TLS INSPECTION420 Mbps
FIREWALL IMIX3,750 Mbps
IPS1,500 Mbps
IPSEC VPN4,000 Mbps
NGFW1,050 Mbps
THREAT PROTECTION1,110 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 8 x GE copper
1 x SFP fiber*
POWER-OVER-ETHERNET (FIXED) N/A
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 5 (802.11ac)
2X2:2 MIMO
2 external antennas
Single radio, 2.4 or 5 GHz
Modularity
EXPANSION SLOTS N/A
OPTIONAL ADD-ON MODULES SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 107 / 107w
Front
Back
XGS 116 / 116w
Performance
FIREWALL7,700 Mbps
TLS INSPECTION650 Mbps
FIREWALL IMIX4,500 Mbps
IPS2,500 Mbps
IPSEC VPN4,800 Mbps
NGFW2,000 Mbps
THREAT PROTECTION2,160 Mbps
Connectivity
ETHERNET INTERFACES (FIXED) 8 x GE copper
1 X SFP fiber*
POWER-OVER-ETHERNET (FIXED) 1 x GE
802.3at (30W max.)
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY) Wi-Fi 5 (802.11ac)
2X2:2 MIMO
2 external antennas
Single radio, 2.4 GHz or 5 GHz
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 3G/4G module
5G module (Gen.1)
2nd Wi-Fi 5/802.11ac module (for w-model only)
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 116 / 116w
Front
Back
XGS 126/126w
Performance
FIREWALL10,500 Mbps
TLS INSPECTION800 Mbps
FIREWALL IMIX5,250 Mbps
IPS3,250 Mbps
IPSEC VPN5,500 Mbps
NGFW2,500 Mbps
THREAT PROTECTION2,700 Mbps
Connectivity
ETHERNET INTERFACES (FIXED)10 x GE copper
2 x SFP fiber*
POWER-OVER-ETHERNET (FIXED)2 x GE
802.3at (30W max. per port)
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY)Wi-Fi 5 (802.11ac)
3X3:3 MIMO
3 external antennas
Single radio, 2.4 GHz or 5 GHz
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 3G/4G module
5G module (Gen.1)
2nd Wi-Fi 5/802.11ac module (for w-model only)
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 126/126w
Front
Back
XGS 136/136w
Performance
FIREWALL11,500 Mbps
TLS INSPECTION950 Mbps
FIREWALL IMIX6,500 Mbps
IPS4,000 Mbps
IPSEC VPN6,350 Mbps
NGFW3,000 Mbps
THREAT PROTECTION3,000 Mbps
Connectivity
ETHERNET INTERFACES (FIXED)10 x GE copper
2 x SFP fiber*
POWER-OVER-ETHERNET (FIXED)2 x 2.5 GE
802.3at (30W max. per port)
MANAGEMENT INTERFACES 1 x COM RJ45
1 x COM Micro-USB
OTHER I/O INTERFACES 1 x USB 2.0 (front)
1 x USB 3.0 (rear)
WI-FI OPTION (W-MODEL ONLY)Wi-Fi 5 (802.11ac)
3X3:3 MIMO
3 external antennas
Single radio, 2.4 GHz or 5 GHz
Modularity
EXPANSION SLOTS 1
OPTIONAL ADD-ON MODULES 3G/4G module
5G module (Gen.1)
2nd Wi-Fi 5/802.11ac module (for w-model only)
SFP transceivers
Redundancy
SWAPPABLE COMPONENTS Optional 2nd power supply
XGS 136/136w
Front
Back
* Transceivers sold separately
Performance test methodology
General | Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services. |
Firewall | Measured using HTTP traffic and 512 KB response size |
Firewall IMIX | UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes |
IPS | Measured using HTTP traffic, default IPS ruleset, and 512 KB object size |
IPsec VPN | HTTP throughput measured using multiple tunnels and 512 KB HTTP response size |
TLS inspection | Measured with IPS enabled on HTTPS sessions and different cipher suites |
Threat protection | Measured with firewall, IPS, application control, and malware prevention enabled using Enterprise Mix traffic |
Product highlights
All protection features are supported on every XGS 1xx model and most are available on XGS 87 and 87w.
- Hardware acceleration: Xstream Flow processor for hardware-level acceleration of trusted and previously verified apps and traffic
- Extensive built-in connectivity: SFP interface on every model, all models available with optional integrated Wi-Fi 5 (802.11ac), and built-in Power-over-Ethernet (PoE) on all XGS 116, 126, and 136 models (2.5 GE on XGS 136)
- Power and environment: Redundant power option for all XGS 1xx models and optimized energy consumption. For highly noise-sensitive environments, we recommend the fanless XGS 88 and XGS 108 (Gen.2) models
- Add-on connectivity options: Optional 3G/4G and 5G using the expansion bay on all XGS 116/126/136 models. AnoptionalsecondWi-Firadiomodulecanalso be added to w-models with an expansion bay
- Dual-processor architecture: All Gen.1 models include an x86 CPU plus an Xstream Flow processor
Accessories
3G/4G or 5G connectivity
For XGS 116, 126, and 136 models only
Our desktop appliances are often deployed in remote locations where flexible connectivity is essential. The expansion bay on the XGS 116, 126, and 136 models provides the option to add either a 3G/4G or a 5G module to your appliance. These optional modules can be securely mounted and managed from your Sophos Firewall console for optimum compatibility.
- Better performance with common standards supported
- 3G/4G module supports LTE Cat 6 and up to 300 Mbps download/50 Mbps upload
- 5G module supports 5G sub-6 bands with download speeds of up to 4.5 Gbps and upload speeds of up to 660 Mbps (depending on carrier and region)
- Full protection from theft and damage
3G/4G module:
- Two different versions: Europe/Americas and Asia-Pacific
5G module (Gen.1):
- One version for all regions
Second Wi-Fi radio module
For XGS 116w, 126w, and 136w only
Improve Wi-Fi coverage and performance in your office by adding a second Wi-Fi radio to selected XGS models. Adding a second radio with two extra antennas to a model with built-in Wi-Fi allows you to broadcast in both the 2.4 and 5 GHz bands simultaneously for an overall better Wi-Fi experience.
XGS Series Gen.1 desktop accessories matrix
Model | Power redundancy | Expansion bay | 3G/4G/5G modules | Wi-Fi options | Rackmount kit |
|---|---|---|---|---|---|
XGS 87 | N/A | N/A | N/A | N/A | Optional |
XGS 87w | N/A | N/A | N/A | N/A | Optional |
XGS 107 | Optional 2nd power supply | N/A | N/A | N/A | Optional |
XGS 107w | Optional 2nd power supply | N/A | N/A | Wi-Fi 5 built in | Optional |
XGS 116 | Optional 2nd power supply | 1 | Optional | N/A | Optional |
XGS 116w | Optional 2nd power supply | 1 | Optional | Wi-Fi 5 built in | Optional |
XGS 126 | Optional 2nd power supply | 1 | Optional | N/A | Optional |
XGS 126w | Optional 2nd power supply | 1 | Optional | Wi-Fi 5 built in | XGS 126w |
XGS 136 | Optional 2nd power supply | 1 | Optional | N/A | Optional |
XGS 136w | Optional 2nd power supply | 1 | Optional | Wi-Fi 5 built in | Optional |
Related products
XGS Desktop (Gen.1)
Our first-gen SMB and branch office firewalls with great connectivity at a great price
FLEXIBLE SMB FIREWALLS
- All-in-one security
- Optional Wi-Fi 5 on all models
- Modular, add-on connectivity options for Wi-Fi and 4G/5G
- Redundant power options
Now viewing
XGS Desktop (Gen.2)
Best-in-class performance, protection, and power efficiency for SMBs and branch offices
THE ULTIMATE SMB FIREWALLS
- Industry-leading price-performance
- Power-saving operation
- Optional Wi-Fi 6 and 5G support on select models
- 2.5 GE and 10 GE SFP+ interfaces
- Redundant power options
XGS 1U Rackmount
Performance and versatile connectivity for midsize distributed organizations
POWER FOR THE DISTRIBUTED EDGE
- Dual-processor performance to accelerate traffic and apps
- Diverse range of high-speed interfaces built in plus flexible, add-on modules
- Redundant power options
XGS 2U Rackmount
No-compromise performance for the enterprise and campus edge
PERFORMANCE AND REDUNDANCY
- Enterprise-grade performance and hardware acceleration
- High-speed connectivity on board and via optional modules
- Built-in redundancy
Sophos SD-RED
Plug-and-play security for smaller branch offices and remote sites
CLICK-AND-CONNECT EDGE DEVICES
- Extend security to branch offices and remote locations
- Simple, plug-and-play connectivity
- No technical staff required on site
- Managed via your Sophos Firewall
Sophos Wireless
Our scalable, cloud-managed Wi-Fi solution with support for the Wi-Fi 6/6E AP6 Series
SIMPLE, SECURE WIRELESS LAN
- Easy setup and management via Sophos Central
- Diverse options for guest access
- Integration with Sophos MDR/XDR or third-party solutions via API to block compromised hosts
Sophos Switch
Network access-layer switches to connect, power, and control at the LAN edge
CONNECT, POWER, AND CONTROL
- Sophos Central or local user interface management
- Power-over-Ethernet
- Integration with Sophos MDR/XDR or third-party solutions via API to block compromised hosts
Sophos ZTNA
Zero Trust Network Access to securely connect users to applications
SECURELY CONNECT YOUR USERS
- Micro-segmentation for better security
- Device-health-based policy control
- Single console management via Sophos Central
- Single agent with Sophos Endpoint