Xstream SD-WAN

Flexible. Resilient. Easy

Online Demo   Get Pricing

Make Your SD-WAN Goals a Reality

Sophos Firewall and our Secure Access portfolio of products, all managed and orchestrated through Sophos Central, enable your SD-WAN networking goals simply and economically while offering zero-impact response to ISP disruptions and outages, even in the most challenging environments.

Powerful SD-WAN Link Management

Sophos Firewall supports SD-WAN load balancing across multiple links using round robin weighting or session persistence strategies. Sophos Firewall also enables performance-based SLA link selection and routing based on real-time packet loss, jitter and latency with zero-impact rerouting of application traffic when transitioning between links.

SD-Branch Orchestration Made Easy

Extending your network to remote locations or branch offices with our SD-RED remote edge devices couldn’t be simpler – in fact they are zero-touch and orchestrating your SD-WAN overlay network from Sophos Central is a simple point-and-click exercise.

Xstream FastPath Acceleration

The new Xstream Flow Processors in all XGS Series appliances accelerate SD-WAN IPsec VPN tunnel flows taking full advantage of the hardware crypto capabilities in XGS Series appliances. They can also offload and accelerate other important trusted traffic from the cloud.

Zero-Impact SD-WAN Link Selection

Performance Matters

Even the best ISPs have occasional disruptions. When that happens, you want your SD-WAN solution to seamlessly transition sessions to your healthy WAN connections without noticeable disruptions to VoIP, team meetings, and other important application traffic.

Real-Time Performance Monitoring

Sophos Firewall is automatically monitoring and reporting the performance of your ISP connections, including packet loss, jitter, and latency metrics. 

Zero-Impact Rerouting

When WAN link performance takes a hit, Sophos Firewall automatically reroutes traffic to a better performing link, including active sessions with zero impact and no disruption to users or their applications.


SD-WAN Orchestration Made Easy

A game-changer for anyone managing multiple sites.

If you’ve ever set up more than a couple of VPN tunnels between different sites, you know how time consuming and tedious this process can be. Sophos Central Orchestration makes interconnecting your SD-WAN overlay network in the cloud – a quick and easy task - from the cloud.

Setup full mesh, hub-and-spoke, or any type of SD-WAN overlay networks with full tunnel redundancy and fail-over with just a few clicks. You simply select what gets connected, and Sophos Central takes care of all the heavy lifting on the backend to automatically setup all the necessary tunnels and rules.


Remote and Branch Office Connectivity

Sophos Firewall and our suite of Secure Access products, including SD-RED (Remote Edge Devices) and Sophos Switch, enable you to build a flexible, affordable SD-WAN overlay network. Get set up quickly and easily, no matter what your where you're connecting, and manage it all through Sophos Central.



Biogas Domes


Wind Turbines


Emergency Vehicles


Cruise and Cargo Ships


Remote Observatories


Construction Sites


Retail Locations


CCTV Cameras


Public Buses


Home Workers


An Innovative Solution to SD-WAN VPN Connectivity

  • Zero-touch auto provisioning enables deployment by non-technical staff

  • Secure VPN tunnel connectivity with your Sophos Firewall from anywhere via our lightweight robust Layer 2 SD-RED tunnel

  • Selective routing options for any mix of VPN and local WAN access

  • Enterprise-grade encryption

  • Flexible connectivity options, including 3G/4G/LTE, copper, fiber, Wi-Fi, and PoE (SD-RED 60 only)

Zero-Touch Deployment to Your Remote Locations

How it works:

It requires no technical skills at the remote site. Simply enter the SD-RED device ID into your Sophos Firewall and ship it. As soon as it’s plugged in and connected to the internet, our provisioning service automatically connects it to your firewall and establishes a secure, dedicated VPN tunnel.

Ultra affordable:

SD-RED devices are very affordable, and there’s no added licensing cost for SD-REDS. It’s included in your Sophos Firewall Network Protection License.

Powerful and Reliable Application Routing

Sophos Firewall enables direct-to-the-cloud application-based routing for over 3,300 different applications, reducing your need to backhaul through your datacenter. Accelerate application performance and improve the user experience.

Synchronized SD-WAN

Identifying and routing custom or obscure application traffic can be a challenge for many firewalls. With Sophos Synchronized Security, your endpoints help identify these applications reliably to ensure every application on your network is prioritized and routed efficiently.

Application routing

Cloud and Hybrid
Deployments Made Simple

Sophos Firewall offers a powerful and modular line of hardware appliance models as well as software, virtual, and cloud deployment options, and unique affordable SD-RED devices to enable your network goals easily.


XGS Series Appliances

Sophos Firewall offers a full range of top-performing hardware appliances with modular connectivity options for all your LAN, WAN, and wireless needs, including Wi-Fi, cellular, copper, and fiber interfaces.


Cloud, Virtual, Software

Sophos Firewall is also available as a software appliance, supports all the popular virtualization platforms, and is available on both Azure and Amazon Web Services to protect and connect your public, private, and hybrid cloud networks.



Our unique zero-touch SD-RED edge devices make extending your secure network to branch offices and ICS devices easy. SD-RED lightweight Layer 2 tunnels provide a robust secure VPN solution. It works reliably even in the most hostile and high-latency network situations.


Azure Virtual WAN

Sophos Firewall’s integration with Azure Virtual WAN enables you to build a scalable SD-WAN network deployed across the global Microsoft enterprise WAN backbone, while utilizing Sophos Firewall’s full suite of protection capabilities for securing applications and traffic flows

Get Started

Online Demo   Get Pricing