XGS Series next-gen firewall appliances

Distributed edge: 1U rackmount models

XGS firewalls 2300 3300 4500 models - 1762411489748-2l5jye

Midsize and distributed organizations needing a versatile solution to power and protect their networks will be well-served with our 1U models. These rackmount firewalls offer excellent performance, a diverse range of high-speed built-in interfaces, and a choice of add-on connectivity modules. Whether your priority is ensuring maximum uptime for your SD-WAN links, securely connecting your remote users, or protecting the network in a growing organization, you can tailor them to your dynamic environment. All models are powered by a high-speed CPU plus a dedicated Xstream Flow processor for hardware acceleration.

Compare XGS 1U models

XGS 2100

Performance

FIREWALL	TLS INSPECTION
30,000 Mbps	1,100 Mbps

FIREWALL IMIX	IPS
16,500 Mbps	6,000 Mbps

IPSEC VPN	NGFW
17,000 Mbps	5,200 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
5,000 Mbps	6 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 2300

Performance

FIREWALL	TLS INSPECTION
39,000 Mbps	1,450 Mbps

FIREWALL IMIX	IPS
20,00 Mbps	7,000 Mbps

IPSEC VPN	NGFW
20,500 Mbps	6,300 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
5,500 Mbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 3100

Performance

FIREWALL	TLS INSPECTION
47,000 Mbps	2,470 Mbps

FIREWALL IMIX	IPS
23,500 Mbps	10,500 Mbps

IPSEC VPN	NGFW
25,000 Mbps	9,000 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
7,400 Mbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 3300

Performance

FIREWALL	TLS INSPECTION
58,000 Mbps	3,130 Mbps

FIREWALL IMIX	IPS
27,000 Mbps	14,000 Mbps

IPSEC VPN	NGFW
31,100 Mbps	12,500 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
10,000 Mbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

8 x GE copper

2 x SFP fiber*

2 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

1 x USB 2.0 (rear)

MAX. POE (USING FLEXI PORT MODULE)

1 module: 4 ports, 60W max.

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 4300

Performance

FIREWALL	TLS INSPECTION
75,000 Mbps	8,000 Mbps

FIREWALL IMIX	IPS
33,000 Mbps	29,500 Mbps

IPSEC VPN	NGFW
62,500 Mbps	23,000 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
25,200 Mbps	3 µs

Connectivity

ETHERNET INTERFACES (FIXED)

4 x GE copper

4 x 2.5 GE copper

4 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

2 modules: 4 ports, 60W max. per module

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional external

DUAL SSD / RAID

N/A

* Transceivers sold separately

XGS 4500

Performance

FIREWALL	TLS INSPECTION
80,000 Mbps	10,600 Mbps

FIREWALL IMIX	IPS
37,000 Mbps	36,500 Mbps

IPSEC VPN	NGFW
75,550 Mbps	30,000 Mbps

THREAT PROTECTION	LATENCY (64 BYTE UDP)
31,850 Mbps	4 µs

Connectivity

ETHERNET INTERFACES (FIXED)

4 x GE copper

4 x 2.5 GE copper

4 x SFP+ 10 GE fiber*

BYPASS PORT PAIRS (FIXED)

MAX. PORT DENSITY (INCL. MODULES)

MANAGEMENT INTERFACES

1 x RJ45 MGMT

1 x COM RJ45

1 x COM Micro-USB

OTHER I/O INTERFACES

2 x USB 3.0 (front)

MAX. POE (USING FLEXI PORT MODULE)

2 modules: 4 ports, 60W max. per module

Modularity

FLEXI PORT SLOTS

OTHER OPTIONAL ADD-ON MODULES

Transceivers

FLEXI PORT MODULES (OPTIONAL)

8-port GE copper

8-port GE SFP fiber*

4-port 10 GE SFP+ fiber*

4-port GE copper bypass (2 pairs)

4-port GE copper PoE + 4-port GE copper

2-port GE fiber (LC) bypass + 4-port GE SFP fiber

2-port 10 GE NBASE-T + 2-port 10 GE SFP+

Redundancy

2ND POWER SUPPLY

Optional internal

DUAL SSD / RAID

Included

SW RAID-1 support

* Transceivers sold separately

Performance test methodology

General	Maximum throughput measured under ideal test conditions using industry-standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services
Firewall	Measured using HTTP traffic and 512 KB response size
Firewall IMIX	UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes
IPS	UDP throughput based on a combination of 66 byte, 570 byte, and 1518 byte packet sizes
IPsec VPN	HTTP throughput measured using multiple tunnels and 512 KB HTTP response size
TLS inspection	Measured with IPS enabled on HTTPS sessions and different cipher suites
Threat Protection	Measured with firewall, IPS, application control, and malware prevention enabled using Enterprise Mix traffic

Product highlights

Dual-processor architecture supports all key protection features without compromising performance
A wide selection of copper and fiber ports plus various management interfaces are built into every model
Fixed LAN bypass ports are on every model to support diverse deployment scenarios
Modular Flexi Port expansion bay(s) on every model allow you to adapt connectivity
A second power supply is optional for all models
Optional PoE Flexi Port modules are centrally powered and benefit from power redundancy when using the second power option
Rackmount kit is included

Accessories

Flexi Port modules

For all XGS 1U models

Our 1U models come with one or more expansion bays to flexibly add to the diverse range of built-in interfaces on every box. Changes in your environment, workforce, or edge infrastructure may require additional fiber ports or a change in your connectivity. With Flexi Port modules, you have a cost-effective way to adapt your appliance, rather than having to purchase new hardware mid-term.

External redundant power supply

For XGS 2xxx, 3xxx, 4300

All of our 1U models offer an optional second power supply for redundancy. The external power supply can be connected to the rear of the appliance.

When using this power supply with either the XGS 2100 or 2300, we suggest that you purchase rackmount rails (rather than using the rackmount ears supplied) for a more stable deployment in your data center.

Transceivers

Sophos offers a range of transceivers to use in the SFP and SFP+ interfaces on your appliance or Flexi port module.

A list of compatible third-party transceivers can be found in our knowledge base article.

Internal redundant power supply

For XGS 4500 only

The second power supply for the XGS 4500 provides a simple way to add redundancy to our most powerful 1U unit.

For added reliability, the XGS 4500 also offers a second integrated SSD (RAID).

Showing model XGS 4300

XGS Series 1U accessories matrix

Model	Redundant power	Redundant SSD	Flexi Port bays	Flexi Port modules	Rackmount kit
XGS 2100	Optional external	N/A	1	8-port 1 GE copper 8-port 1 GE SFP 4-port 10 GE SFP+ 4-port 1 GE copper bypass 4-port 1 GE copper PoE + 4-port 1G copper 2-port GE fiber (LC) bypass + 4-port GE SFP fiber 2-port 10 GE NBASE-T + 2-port 10 GE SFP+	Rackmount ears incl. Optional sliding rails
XGS 2300	Optional external	N/A	1		Rackmount ears incl. Optional sliding rails
XGS 3100	Optional external	N/A	1		Rackmount ears incl. Optional sliding rails
XGS 3300	Optional external	N/A	1		Rackmount ears incl. Optional sliding rails
XGS 4300	Optional external	N/A	2		Sliding rails included
XGS 4500	Optional internal	Included	2		Sliding rails included

XGS Series next-gen firewall appliances

Distributed edge: 1U rackmount models

Compare XGS 1U models

XGS 2100

XGS 2300

XGS 3100

XGS 3300

XGS 4300

XGS 4500

Performance test methodology

Product highlights