Standard Protection covers the Base License plus Network Protection and Web Protection, which gets you a full firewall with IPS, app control, and web filtering. Xstream Protection adds Zero-Day Protection with cloud sandboxing, Central Orchestration for SD-WAN, and longer Central Firewall Reporting retention. For a firewall handling this much enterprise traffic, we recommend Xstream Protection so you get the full sandboxing and reporting stack from day one. Talk to a Sophos-certified expert if you want help matching a bundle to your environment.

Yes. The appliance ships with a Base License that covers core firewall, networking, and wireless functions on its own. Most customers still add Enhanced Support at minimum, since that's what unlocks firmware updates, full Sophos Central management, and warranty coverage. If you already hold licensing elsewhere or are moving from another appliance, let us know and we'll quote the hardware-only configuration.

Yes. The XGS 5500 supports active-active and active-passive HA, so you can pair two appliances for automatic failover with no single point of failure. It's a common ask for organizations running this class of firewall at a data center or main office edge, since downtime isn't an option. We can help size and configure an HA pair, just ask a Sophos-certified rep for a quote on two units.

Out of the box, you get 8 GbE copper ports and 8 SFP+ 10 GbE fiber ports. Beyond that, the 5500 has 2 standard Flexi Port bays plus 1 high-density bay, so you can add more copper, fiber, or bypass ports as your network grows instead of replacing the appliance. Fully populated, it supports up to 48 ports total.

Send us your serial number or current license details and we'll confirm exactly which subscription tier and term you're on before quoting the renewal. This keeps your protection and support active without a gap, and it's a good time to decide if you want to move up from Standard to Xstream Protection. As a Sophos Platinum Partner, we can also flag if your appliance is nearing end of life and worth replacing instead of renewing.

Yes. Our professional services team can pre-configure firewall rules, VPN, HA, and SD-WAN policies before the appliance leaves our warehouse, so it's ready to drop into your network on arrival. This is a popular option for larger deployments like the 5500, where getting the configuration right the first time matters. Ask about Config & Managed Services when you request a quote.