Sophos XG Firewall

What Is Sophos XG Firewall?

When you need to connect remote users and branch offices back to a private network, “just spin up a VPN server” stops being enough fast. You also need routing, policy control, authentication, reporting, and a security stack that can inspect traffic without collapsing under load. That’s the problem Sophos XG Firewall was built to solve.

In 2026 terms, “Sophos XG Firewall” is mostly a legacy name: Sophos’ current product is branded Sophos Firewall, and Sophos’ own release notes explicitly say Sophos Firewall is formerly known as Sophos XG Firewall. If you’re looking at XG because you inherited it, or because a forum post still uses the old name, treat it as the same product line—just with important lifecycle caveats around older XG hardware.

Who it’s for: organizations running their own network perimeter (or cloud/virtual perimeter) that want remote-access VPN, site-to-site VPN, and “NGFW” features under one roof, with optional centralized management through Sophos Central/Sophos Fusion. Sophos positions it as an integrated platform: a base firewall/VPN layer with add-on protection bundles (Standard or Xstream) and support subscriptions that unlock broader security services and firmware updates.

Sophos XG Firewall Features and Performance

VPN protocols and remote-access options

Sophos Firewall supports multiple VPN approaches, and Sophos’ own admin docs are clear about the menu:

• Remote access IPsec VPN and remote access SSL VPN (with Sophos Connect, and compatibility with third-party clients).
• Clientless SSL VPN (browser-based access) as an option for specific internal resources when enabled by the admin.
• L2TP and PPTP are also available as remote-access VPN types (supported/configurable), even though PPTP is generally considered obsolete security-wise in modern environments.

VPNSpotter database specs (verified) list support for OpenVPN, IPsec, IKEv1, IKEv2, L2TP, PPTP, and that aligns with Sophos documentation and feature lists: Sophos’ VPN portal documentation shows SSL VPN configuration files are .ovpn and can be used with Sophos Connect or “other SSL VPN clients,” which is the practical OpenVPN interoperability angle. The Sophos Firewall feature list also calls out IKEv2 support and lists VPN options across IPsec/SSL/L2TP/PPTP.

VPN portal and client experience

For end users, Sophos provides a VPN portal where users can download Sophos Connect and retrieve VPN configuration profiles; the portal supports IPsec/SSL VPN plus clientless SSL VPN bookmarks when configured. Sophos also notes platform-specific client constraints in its own help: for example, at least in the SFOS 20.0-era portal docs, Sophos states macOS users may need to use OpenVPN Connect for SSL VPN in some scenarios. (That kind of detail matters if you’re trying to standardize remote access across Windows/macOS/mobile.)

Architecture and security feature stack (what’s “base” vs paid)

Sophos Firewall licensing is not “one price, everything included.” You get a Base License with the firewall (hardware, virtual, software, or cloud), and Sophos’ own brochure lists what that base tier includes:

• Networking and SD-WAN basics
• IPsec/SSL site-to-site and remote access VPN (described as unlimited)
• On-box reporting/logging during the active lifecycle
• The underlying “Xstream architecture” components Sophos markets for performance features like FastPath and TLS 1.3 inspection (with deeper security inspection capabilities expanding with subscriptions)

That breakdown is documented in Sophos’ brochure, along with the line that a valid support subscription is required to receive firmware updates and access customer support.

Above base, Sophos sells bundles:

• Standard Protection (e.g., Network Protection and Web Protection plus Enhanced Support)
• Xstream Protection (adds items Sophos describes as Zero-Day Protection, Central Orchestration, DNS Protection, plus Enhanced Support)

This isn’t marketing fluff; Sophos publishes a feature-by-subscription matrix and bundle definitions.

Performance expectations (what Sophos claims, and what it doesn’t)

Here’s what you can say without guessing: Sophos explicitly claims performance optimizations for VPN traffic, such as Xstream FastPath acceleration of IPsec tunnel traffic (site-to-site and remote access) in its feature list document. It also emphasizes an “Xstream architecture” with FastPath and TLS inspection as part of the platform.

What you shouldn’t assume: real-world throughput depends heavily on hardware model (XGS appliance class), enabled inspection features, cipher choices, packet sizes, and whether you’re doing full TLS inspection. Sophos publishes model-specific performance tables elsewhere, but unless you’re reviewing a specific appliance model and citing its tech specs, any blanket “fast” claim would be hand-wavy. (So this review won’t do that.)

Distinctive capabilities: Sophos ecosystem integration

Sophos leans hard into ecosystem features where the firewall cooperates with other Sophos products:

• Security Heartbeat: Sophos documents this as a mechanism to identify compromised endpoints and enforce policy actions (including limiting or isolating endpoints) based on endpoint health status.
• Central management / Sophos Fusion: Sophos describes Sophos Fusion as a centralized management layer, including SD-WAN VPN orchestration and deployment workflows, with access depending on licensing/support.
• ZTNA gateway integration: Sophos’ feature list calls out an “integrated Sophos ZTNA gateway” and lists ZTNA gateway availability in the base feature matrix.

Net: Sophos Firewall can be a straightforward VPN gateway, but its “distinctive” value is typically strongest when you’re already in the Sophos stack and want firewall + endpoint + centralized reporting/orchestration working together.

Pricing and Plans

Sophos XG/Sophos Firewall is a paid product in business deployments, but pricing is not a simple public checkout page for most buyers.

How Sophos sells it (structure)

Sophos’ “how to buy” page describes multiple procurement models:

• Hardware appliances (XGS series), and also cloud/hybrid options
• For cloud deployments, Sophos explicitly mentions PAYG (pay-as-you-go) and BYOL (bring-your-own-license) options.

For feature licensing, Sophos’ own brochure and feature list present this structure:

• A Base License is included with the firewall purchase (hardware/virtual/software/cloud).
• Security capabilities are added via bundles (Standard Protection or Xstream Protection) or via individual modules in some cases.
• Support subscriptions matter: Sophos states you need a valid support subscription to receive firmware updates and support; Enhanced Support is included in protection bundles.

Free tier (Home Edition)

Sophos also offers a free Home Edition (software appliance) for home users. Sophos positions it as “available at no cost” and lists a broad set of included features (VPN, IPS, reporting, etc.), with support provided via the community.

That Home Edition is not the same thing as a business subscription in terms of support and entitlements, but it is a real $0 option if your use case is genuinely home/lab.

Refunds and cancellations

Sophos does not present a universal consumer-style refund policy for firewall licensing on its public product pages in the sources reviewed here. In practice, business purchases usually go through partners/resellers and are governed by partner terms and contract paperwork. Since exact refund windows and cancellation rules aren’t confirmed in the cited sources, this review won’t invent them.

Privacy and Security Assessment

Jurisdiction

VPNSpotter database (verified) lists jurisdiction as the United Kingdom. That’s consistent with Sophos being a UK-based company (Sophos Limited is British).

Practical implication: Sophos Firewall is infrastructure you run (or your MSP runs). The “jurisdiction” mainly matters for Sophos as a vendor (support, licensing, cloud management services like Sophos Central) rather than as a consumer VPN provider handling all your browsing. If you’re using Sophos Central/Sophos Fusion cloud management, you should treat that as a vendor relationship with the usual enterprise privacy questions (what telemetry is sent, where it’s processed, retention, etc.). Those specifics aren’t laid out in the sources we pulled here, so we won’t speculate.

Logging and “no logs” reality

This is a firewall/VPN gateway, not a retail VPN service. Sophos explicitly includes on-box logging and reporting in the Base License feature description, and additional Central reporting is bundled with orchestration subscriptions.

So if you’re coming from the consumer VPN world looking for “no logs,” Sophos Firewall is basically the opposite: it’s designed to generate logs for security, compliance, troubleshooting, and auditing.

Open source posture

Sophos Firewall is not presented by Sophos as an open-source firewall project. It’s a commercial product with proprietary components plus standard protocols (IPsec, SSL VPN/OpenVPN compatibility). No credible source in the material reviewed indicates it is open source, so don’t buy it expecting community-audited code.

Security track record and incidents (documented)

Like any widely deployed perimeter product, Sophos Firewall has had serious vulnerabilities.

• CVE-2024-12727: Sophos published an advisory describing a pre-auth SQL injection in the email protection feature that could lead to remote code execution under specific conditions (SPX enabled + HA mode), with fixed versions listed.
• Sophos also has documented historical issues involving SQL injection and code execution scenarios, with remediation guidance and post-incident notes in support articles.

No BS takeaway: if you deploy Sophos Firewall, you need a real patching process, and you should minimize exposed management surfaces. Also note Sophos’ own licensing guidance that firmware updates require an active support subscription—if you don’t keep support current, you’re making it harder to stay patched.

Lifecycle risk (XG hardware EOL)

This matters specifically for “Sophos XG Firewall” buyers: Sophos states the XG Series hardware appliances reached end-of-life on March 31, 2025, and recommends migrating to XGS hardware to avoid degraded functionality and security.

Sophos also states that SFOS 21.0+ does not support XG and SG series hardware appliances, meaning modern firmware trains don’t run on that older hardware generation.

So: if your plan is to buy used XG hardware in 2026, that’s not “budget security.” It’s buying yourself an update dead-end.

Strengths and Limitations

Strengths

• Broad VPN options: IPsec and SSL VPN for remote access, plus L2TP/PPTP and clientless SSL VPN options when needed.
• User-facing VPN portal: reduces helpdesk load for distributing profiles and client downloads.
• Clear bundle licensing model: base functionality plus defined bundles (Standard/Xstream) and add-on modules, with published matrices.
• Ecosystem features: Security Heartbeat and Sophos Central/Fusion management are real differentiators if you’re standardized on Sophos.

Limitations

• XG hardware is EOL (March 31, 2025). In 2026, that name strongly signals “legacy deployment” risk.
• Updates/support are subscription-tied: Sophos states firmware updates require a valid support subscription.
• Not a privacy VPN service: logging/reporting is part of the product’s design, and “no logs” isn’t the goal.
• Vulnerability exposure is real: Sophos has published advisories for serious issues including pre-auth injection chains in specific modules/configurations.

Who Should Use Sophos XG Firewall?

Good fit

1. Small and mid-size orgs that want one box for firewall + VPN and prefer a single vendor for security services and support subscriptions (especially if they already use Sophos endpoints and want Security Heartbeat).
2. IT teams that need mixed remote-access options: IPsec for managed endpoints, SSL VPN/OpenVPN-style profiles for compatibility, and the occasional clientless access use case for browser-based access to internal resources.
3. Organizations that value centralized orchestration/reporting via Sophos Central/Sophos Fusion and are willing to license bundles to get those features.

Not a good fit

1. Anyone shopping for a consumer privacy VPN (streaming geo-unblocker, “no logs,” anonymous payments, etc.). Sophos Firewall is enterprise infrastructure with logging and admin control by design.
2. Buyers trying to save money with used XG hardware in 2026. XG hardware is end-of-life as of March 31, 2025, and newer SFOS versions don’t support that platform.
3. Teams that can’t commit to ongoing support/updates. If you won’t keep support active, you’re likely undermining your ability to apply firmware updates—which is not optional for an internet-facing security gateway.