Every XGS 128 ships with a perpetual base license that covers the firewall itself, IPsec and SSL VPN, wireless, and management through Sophos Central. To turn on active security you add a subscription bundle. Standard Protection layers on Network Protection, Web Protection, and Enhanced Support, which fits most small and midsize offices. Xstream Protection adds Zero-Day Protection and Central Orchestration on top, and it is the bundle Sophos and our team recommend for networks with heavy encrypted traffic or compliance requirements. As a Sophos Platinum Partner we can size the right bundle for your environment.

The two appliances are identical in throughput, ports, and licensing. The only difference is wireless. The 128w adds an integrated Wi-Fi 6 (802.11ax) radio with two external antennas and 2x2 MIMO, running the 2.4 GHz and 5 GHz bands at the same time. Pick the 128w if you want the firewall to double as an access point at a small site. Pick the standard 128 if your wireless is handled by separate Sophos access points.

Size to your user count and your real traffic, not just your ISP speed. The XGS 128 pushes 19.1 Gbps of raw firewall throughput and holds 4 Gbps of threat protection throughput with the full security stack running, which comfortably covers a growing office or busy branch site on a gigabit or multi-gigabit connection. If you inspect a lot of encrypted traffic, treat the 1,450 Mbps Xstream TLS inspection figure as your real ceiling. Not sure where you land? Talk to a Sophos-certified rep and we will match the model to your load.

Yes. Our team can pre-configure your XGS 128 before it ships so it arrives ready to drop in, and we offer professional services for full deployment, migration from an older XG or SG appliance, and ongoing management. Plenty of customers hand us the setup and the VPN or SSL configuration rather than doing it in house. Ask about our config and managed services when you request a quote.

Support is what keeps your firewall eligible for firmware updates and gives you access to Sophos technical support, so it is not optional on a production box. Enhanced Support gives you 24x7 coverage and is included in both the Standard and Xstream bundles. Enhanced Plus adds faster next business day hardware replacement for sites that cannot wait on a shipment. We can quote whichever tier matches how critical the site is.

Yes. We handle new licenses, renewals, and multi-year terms for the XGS 128 and the rest of the Sophos lineup, including mixed fleets and HA pairs. Send us your serial number and current subscription and we will pull the correct renewal SKU so you do not end up with a coverage gap. Multi-year terms usually carry the best pricing.