XGS Series next-gen firewall appliances

Distributed edge: 1U rackmount models

XGS firewalls 2300 3300 4500 models - 1762411489748-2l5jye

Sophos XGS Series 1U appliances deliver high-performance protection, flexible connectivity, and resilience for midsize, distributed, and growing organizations. Choose from a broad range of price and performance options, with flexible expansion to meet your connectivity requirements today and as your network grows.

Compare XGS 1U models

Choose the right model based on your performance, connectivity, redundancy, and capacity requirements.

XGS 2100

Performance

FIREWALL	TLS INSPECTION
30 Gbps	2 Gbps

FIREWALL IMIX	IPS
16.5 Gbps	6 Gbps

IPSEC VPN	NGFW
17 Gbps	5.2 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
5.6 Gbps	6 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 2300

Performance

FIREWALL	TLS INSPECTION
39 Gbps	2.1 Gbps

FIREWALL IMIX	IPS
20 Gbps	7 Gbps

IPSEC VPN	NGFW
20.5 Gbps	6.3 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
5.9 Gbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 3100

Performance

FIREWALL	TLS INSPECTION
47 Gbps	3.2 Gbps

FIREWALL IMIX	IPS
23.5 Gbps	10.5 Gbps

IPSEC VPN	NGFW
25 Gbps	9 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
8.3 Gbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 3300

Performance

FIREWALL	TLS INSPECTION
58 Gbps	3.7 Gbps

FIREWALL IMIX	IPS
27 Gbps	14 Gbps

IPSEC VPN	NGFW
31.1 Gbps	12.5 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
12 Gbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 2380

Performance

FIREWALL	TLS INSPECTION
59.8 Gbps	8 Gbps

FIREWALL IMIX	IPS
30 Gbps	26 Gbps

IPSEC VPN	NGFW
48.5 Gbps	20 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
23.3 Gbps	6 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x 2.5 GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

N/A

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

N/A

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional internal

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 4300

Performance

FIREWALL	TLS INSPECTION
75 Gbps	9 Gbps

FIREWALL IMIX	IPS
33 Gbps	29.5 Gbps

IPSEC VPN	NGFW
62.5 Gbps	23 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
28 Gbps	3 µs

Connectivity

ETHERNET INTERFACES (FIXED)

4 x GE copper

4 x 2.5 GE copper

4 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

2 modules: 4 ports, 60W max. per module

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 3380

Performance

FIREWALL	TLS INSPECTION
80 Gbps	9.5 Gbps

FIREWALL IMIX	IPS
35 Gbps	32 Gbps

IPSEC VPN	NGFW
74 Gbps	26 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
32 Gbps	7 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x 2.5 GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

N/A

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

N/A

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional internal

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 4500

Performance

FIREWALL	TLS INSPECTION
80 Gbps	10.6 Gbps

FIREWALL IMIX	IPS
37 Gbps	36.5 Gbps

IPSEC VPN	NGFW
75.55 Gbps	30 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
34.75 Gbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

4 x GE copper

4 x 2.5 GE copper

4 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

2 modules: 4 ports, 60W max. per module

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional internal

DUAL SSD / RAID

Included

SW RAID-1 support

* Transceivers sold separately

XGS 4580

Performance

FIREWALL	TLS INSPECTION
105 Gbps	12 Gbps

FIREWALL IMIX	IPS
37 Gbps	38.5 Gbps

IPSEC VPN	NGFW
97 Gbps	35 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
45 Gbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x 2.5 GE copper

4 x SFP28 25 GE fiber*

BYPASS PORT PAIRS (FIXED)

N/A

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

N/A

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber

4-port 10 GE SFP+ fiber

4-port GE copper bypass (2 pairs)

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

2-port 10 GE Fiber (LC) bypass

1-port 40 GE QSFP+ Fiber

Redundancy

2ND POWER SUPPLY

Optional internal

DUAL SSD / RAID

Included

SW RAID-1 support

* Transceivers sold separately

XGS 5580

Performance

FIREWALL	TLS INSPECTION
112.5 Gbps	16 Gbps

FIREWALL IMIX	IPS
52 Gbps	48 Gbps

IPSEC VPN	NGFW
105 Gbps	44 Gbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
58 Gbps	5 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x 2.5 GE copper

4 x SFP28 25 GE fiber*

BYPASS PORT PAIRS (FIXED)

N/A

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

N/A

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber

4-port 10 GE SFP+ fiber

4-port GE copper bypass (2 pairs)

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

2-port 10 GE Fiber (LC) bypass

1-port 40 GE QSFP+ Fiber

Redundancy

2ND POWER SUPPLY

Internal included

DUAL SSD / RAID

Included

SW RAID-1 support

* Transceivers sold separately

Performance test methodology

General	Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services
Firewall	Measured using HTTP traffic and 512 KB response size
Firewall IMIX	UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes
IPS	UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes
IPsec VPN	HTTP throughput measured using multiple tunnels and 512 KB HTTP response size
TLS inspection	Measured with IPS enabled on HTTPS sessions and different cipher suites
Threat Protection	Measured with firewall, IPS, application control, and malware prevention enabled using Enterprise Mix traffic

Product highlights

Performance and efficiency: Choose from models with integrated Xstream FastPath cores or a dedicated Xstream Flow Processor to match performance needs.
High-speed connectivity: Built-in copper and fiber interfaces, with speeds up to 25G on select models.
Resilience: Built-in or optional LAN bypass and optional redundant power, depending on model.
Flexible expansion: Flexi Port bays let you adapt connectivity as requirements change.
Rack-ready: Mounting kit included as standard.

Xstream FastPath acceleration

XGS Series 1U appliances use two purpose-built FastPath designs. Select models integrate dedicated FastPath cores within the main processor, while other models use a dedicated Xstream Flow Processor. Both accelerate trusted and previously seen traffic while providing excellent price-performance and efficiency.

Modular options and accessories

Flexi Port modules

Optional for all XGS 1U models

Customize your firewall with optional Flexi Port modules, giving you the flexibility to adapt connectivity as your network evolves.

Redundant power

Optional for all 1U models; included for XGS 5580

Add an optional second power supply for greater resilience, with internal or external options depending on the model.

Transceivers

Sophos offers a range of transceivers to use in the copper and fiber interfaces on your appliance or Flexi port module.

A list of compatible third-party transceivers can be found in our knowledge base article.

Showing model XGS 5580

XGS Series: 1U accessory matrix by model

	Redundancy		Modularity			Mounting
Model	Power	2nd SSD	Removable SSD	Flexi Port Bays	Flexi Port Modules	Rackmount Kit
XGS 2100	Optional external	n/a	n/a	1	8-port 1 GE copper 8-port 1 GE SFP 4-port 10 GE SFP+ 4-port 1 GE copper bypass 4-port 1 GE copper PoE + 4-port 1G copper* 2-port GE fiber (LC) bypass + 4-port GE SFP fiber* 2-port 10 GE NBASE-T + 2-port 10 GE SFP+ 2-port 10 GE Fiber (LC) bypass 1-port 40 GE QSFP+ Fiber Not supported on XGS 2380, 3380, 4580, 5580 *Only supported on XGS 4580, 5580	Rackmount ears included. Optional sliding rails.
XGS 2300	Optional external	n/a	n/a	1		Rackmount ears included. Optional sliding rails.
XGS 3100	Optional external	n/a	n/a	1		Rackmount ears included. Optional sliding rails.
XGS 3300	Optional external	n/a	n/a	1		Rackmount ears included. Optional sliding rails.
XGS 2380	Optional internal	n/a	Field-replaceable for RMA. Not sold separately.	1		Rackmount ears included. Optional sliding rails.
XGS 4300	Optional external	n/a	n/a	2		Sliding rails included.
XGS 3380	Optional internal	n/a	Field-replaceable for RMA. Not sold separately.	1		Rackmount ears included. Optional sliding rails.
XGS 4500	Optional internal	Internal redundant SSD	n/a	2		Sliding rails included.
XGS 4580	Optional internal	Redundant SSD	Field-replaceable for RMA. Not sold separately.	2		Sliding rails included.
XGS 5580	Included internal	Redundant SSD	Field-replaceable for RMA. Not sold separately.	2		Sliding rails included.

What are field-replaceable SSDs?

Field-replaceable SSDs make Return Material Authorization (RMA) handling simpler by allowing you to leave the appliance in place and only remove and replace the SSD in case of failure. Available on XGS 2380/3380/4580/5580 models only.

SSDs can be removed by the customer/partner for RMA purposes without impacting the appliance warranty
Only Sophos-supplied SSDs are supported
SSDs are not sold separately
SSDs are not interchangeable between different XGS models

XGS Series next-gen firewall appliances

Distributed edge: 1U rackmount models

Compare XGS 1U models

XGS 2100

XGS 2300

XGS 3100

XGS 3300

XGS 2380

XGS 4300

XGS 3380

XGS 4500

XGS 4580

XGS 5580

Performance test methodology

Product highlights

Xstream FastPath acceleration