Both bundles run on the same Xstream architecture and include network and web protection, unlimited VPN, SD-WAN, and Enhanced Support. Xstream Protection adds the pieces that matter for busier or hybrid networks: Zero-Day Protection with cloud sandboxing, DNS Protection, and Central Orchestration for SD-WAN and 30-day cloud reporting. If you plan to run TLS inspection or manage several firewalls from Sophos Central, Xstream is the bundle we recommend. Standard Protection covers the essentials at a lower cost. Not sure which fits? Talk to a Sophos-certified expert and we'll size it with you.

The XGS 138 ships with a perpetual base license that covers core firewall features, unlimited IPsec and SSL VPN, wireless, and cloud management through Sophos Central. On its own the base license routes and firewalls traffic, but it does not include IPS, web filtering, or advanced threat protection. To get the security most organizations are buying a firewall for, you add a Standard or Xstream Protection bundle, which also includes the support you need for firmware updates. We sell the XGS 138 as a package that pairs the appliance with a subscription, so you get both in one SKU.

Yes. The XGS 138 has two built-in 2.5GbE PoE ports rated up to 30W each, so you can power a Sophos access point, IP camera, or VoIP phone straight from the appliance without a separate injector or switch. It also manages Sophos AP6 access points and CS-Series switches from the same Sophos Central console, so your firewall, Wi-Fi, and switching all live in one place.

Yes. Firewalls.com is an authorized Sophos partner, so every XGS 138 we sell comes with a valid factory warranty and full eligibility for licensing, renewals, RMAs, and Sophos support. Because we buy direct, you also get manufacturer-direct pricing and a certified rep who can help you quote, configure, and deploy.

Renewing is straightforward. When your XGS 138 subscription is coming up, we can quote a 1, 2, or 3 year renewal on the same bundle you already run, and multi-year terms lock in the best value while avoiding a coverage gap. Send us your serial number or existing order number and your rep will pull the exact renewal SKU. If your current term has already lapsed, we can still get you re-licensed, so reach out and we'll sort it.

Most in-stock XGS 138 orders placed by 3pm EST ship the same business day from our U.S. warehouse, and you pick the carrier and service level at checkout, including overnight. If you need it on-site by a specific date or want to confirm stock before you order, message us or request a quote and we'll give you a straight answer on availability.