Sophos
SOPHOS · XGS FIREWALL · XSTREAM · SYNCHRONIZED SECURITY
Sophos XGS Firewalls & Synchronized Security in Oman
Explore Sophos firewall technology for organizations in Oman and GCC markets. Novatelia supports model-specific sourcing discussions for XGS appliances, protection subscriptions, renewals, and the endpoint and management licenses a design still has to name.
A brand listing is not a manufacturer appointment, a warranty, or proof of stock. Hardware does not include every subscription. Endpoint licenses and MDR are separate. Laboratory throughput figures are not a production guarantee.
Explore a Synchronized Security Architecture
Each zone is a procurement discussion. It is not a commissioned network, a live console, or a record of a security incident.
WAN
Purpose: the internet and private circuits that arrive at the site. Sophos family: the XGS appliance selected for that edge. Requirements: circuit count, addressing, and who provides the links. Compatibility: a firewall model does not create the circuit.
XGS firewall
Purpose: the policy enforcement point. Sophos family: XGS desktop or 1U rack appliances. XG is an earlier hardware generation and is not the same chassis. Requirements: the exact model, revision, and whether the order is hardware only or a bundle.
Xstream
Purpose: the XGS processing path Sophos describes as a CPU plus a dedicated Xstream Flow processor on current XGS models. Requirements: the software release and the licenses that turn inspection on. Compatibility: the architecture name is not a throughput promise.
IPS
Purpose: intrusion prevention on traffic the policy selects. Sophos family: Network Protection, which the SFOS 20 licensing help places inside both Standard Protection and Xstream Protection. Requirements: the subscription registered to that appliance.
TLS inspection
Purpose: decrypted inspection of TLS sessions where policy and certificates allow it. Sophos’s how-to-buy page describes an Xstream TLS and DPI engine inside Network Protection and Web Protection. Requirements: certificates, privacy review, and the performance headroom of that model. A laboratory TLS figure is not the site result.
Web protection
Purpose: web and application control. Sophos family: Web Protection, listed in both Standard and Xstream bundles on the SFOS 20 licensing help. Requirements: the categories and applications the policy must cover.
Security Heartbeat
Purpose: a health signal between a Sophos firewall and Sophos Central protected endpoints, used in firewall policy. Sophos lists Security Heartbeat under Network Protection. Requirements: compatible endpoint software and that firewall subscription. This page shows no live endpoint status.
Endpoint
Purpose: the devices that report health. Sophos family: endpoint products managed in Sophos Central. Requirements: their own licenses. A firewall bundle does not include endpoint seats.
Central management
Purpose: administration beyond one local console. Sophos Central Firewall Management needs a paid protection or support license; the base firewall license is not sufficient, per the SFOS 20 help. Current product pages also name Sophos Fusion. This page opens neither console.
VPN
Purpose: remote access and site-to-site tunnels. Sophos lists VPN on the base license. Requirements: the tunnel type, identity method, and peer devices. IPsec laboratory throughput is not the throughput of a tunnel on a loaded appliance.
SD-WAN
Purpose: path selection across more than one WAN. Base features include networking and traffic shaping. SD-WAN VPN orchestration is listed under Central Orchestration, which the SFOS 20 help places in the Xstream bundle. A multi-WAN design is still a project document.
Reporting
Purpose: logs and reports for the firewall. Base reporting and Central Firewall Reporting Advanced are different licenses. The SFOS 20 help places CFR Advanced with Central Orchestration. Retention and storage are subscription terms, not a local disk assumption.
Sophos Portfolio Navigator
Desktop firewalls
XGS desktop models for branches, including the XGS 116 family. The source label XG11T1TUS is not a published catalog record.
Rackmount firewalls
1U XGS models, including the XGS 2100 and XGS 3100 names. Source label XG21T1TUS is not a published catalog record.
Protection subscriptions
Standard Protection and Xstream Protection are license bundles. They are not physical appliances.
Renewals
A renewal continues a subscription on an existing serial. It is not a new chassis and it is not assumed to transfer to a different appliance.
Endpoint integration
Security Heartbeat needs compatible Sophos endpoint software and the firewall subscription that includes it. Endpoint seats are a separate license.
Management
Local firewall administration, Sophos Central, and Sophos Fusion are management surfaces. No console is embedded here.
Accessories
Flexi Port modules, transceivers, redundant power, and rack kits are model-bay options. A module for one XGS chassis is not assumed to fit another.
Support
Enhanced Support and Enhanced Plus are support subscriptions. Response and replacement terms follow the registered support license, not the hardware name alone.
Sophos XGS Firewall Architecture
XGS is the current Sophos firewall appliance family. XG is an earlier hardware generation. A part number that begins with the same letters can still be a different chassis, revision, or bundle. Hardware-only, hardware with a protection bundle, a renewal, and a support contract are separate commercial records.
Sophos describes current XGS models as a CPU plus a dedicated Xstream Flow processor. Fixed ports, management ports, and expansion bays differ by model. Desktop PoE and a rackmount Flexi Port PoE module are different designs.
XGS 116 Explorer
The Sophos quick-start guide for XGS 116(w), 126(w), and 136(w) says LAN port 8 on the XGS 116(w) can power a connected device with up to 30 W under 802.3at, and it also describes 802.3af devices up to 15.4 W. The current desktop product page lists 1 x GE PoE at 802.3at, 30 W maximum, for that first-generation desktop class, and it says built-in PoE is on the XGS 116, 126, and 136 models.
The source label XG11T1TUS is titled Sophos XGS 116 Desktop Firewall Appliance and says the unit has an integrated PoE port. That label is not a published catalog record. It was not matched to a current Sophos order code in this review, so the port-8 description is not copied onto the suffix as a certified identity. Wi-Fi belongs to the w model. A plain XGS 116 and an XGS 116w are not the same appliance.
XGS 2100 Explorer
The current Sophos 1U comparison places XGS 2100 first in its accessory table: one Flexi Port bay, optional external redundant power, and rack ears included. The first performance block on that page lists firewall 30 Gbps, TLS inspection 1.1 Gbps, firewall IMIX 16.5 Gbps, IPS 6 Gbps, IPsec VPN 17 Gbps, NGFW 5.2 Gbps, and threat protection 5 Gbps. Sophos states these are maximum figures under ideal laboratory conditions with Keysight-Ixia BreakingPoint, and that actual performance varies with network conditions and activated services.
An earlier published XGS 2100 table, including a 2022 reseller copy of a Sophos datasheet, lists threat protection at 1,250 Mbps, with different IPS, IMIX, and IPsec figures. The original Novatelia source sentence uses 1.25 Gbps threat protection together with 30 Gbps firewall throughput. Those two threat-protection figures describe different published tables. This page does not assign either table to the source label XG21T1TUS. The suffix was not decoded from an official Sophos SKU guide opened in this session. PoE on this 1U class is an optional Flexi Port module, up to four ports and 60 W maximum on the current page, not a built-in desktop PoE port.
XGS 3100
The same 1U accessory table names XGS 3100 after XGS 2300. The performance blocks on that page are unlabeled in extracted text, so a later column is not treated as a certified XGS 3100 datasheet. Fixed 10 GE SFP+ ports appear on a later connectivity block than the XGS 2100 block. Lifecycle, end-of-sale, and the exact revision of a serial remain a manufacturer lookup. No XGS 3100 record is published in the Novatelia catalog.
Firewall, IPS, NGFW, Threat Protection, VPN and TLS
Sophos defines these measurements separately. Firewall throughput on the current 1U page uses HTTP with a 512 KB response. Firewall IMIX and IPS use a UDP mix of 66, 570, and 1518 byte packets. IPsec VPN uses HTTP across multiple tunnels and a 512 KB response. TLS inspection is measured with IPS enabled on HTTPS sessions and different cipher suites. Threat protection is measured with firewall, IPS, application control, and malware prevention enabled, using Enterprise Mix traffic.
A firewall-throughput number is not an IPS number, an NGFW number, a threat-protection number, or a TLS number. None of them is a guaranteed production throughput.
Xstream Technology and TLS Inspection
Xstream is Sophos’s name for stream-based processing and hardware acceleration of trusted flows on XGS appliances. Turning on TLS inspection, IPS, and malware prevention changes the load. Decryption also needs a certificate design and a privacy review for the traffic that will be inspected. This page does not publish a site throughput after those features are enabled.
Web, Application and DNS Protection
The SFOS 20 licensing help lists Web Protection inside both Standard Protection and Xstream Protection: web security and control, application control including Synchronized Application Control, and web malware protection. DNS Protection is listed on the Xstream bundle. Sophos’s how-to-buy page says DNS Protection is not sold separately. A base firewall license does not include these modules.
Security Heartbeat
Security Heartbeat is the link Sophos describes between a firewall and endpoints protected through Sophos Central, so firewall policy can use endpoint health. The SFOS 20 help lists it under Network Protection. The firewall subscription, the endpoint product, and the Central account all have to be present. No endpoint status and no incident are shown on this page.
VPN, SD-WAN and High Availability
The base license includes stateful firewall, VPN, wireless, high availability, and RED, per the SFOS 20 help. IPsec and remote-access VPN still need peers, identity, and addressing. SD-WAN VPN orchestration is under Central Orchestration, which that help places in the Xstream bundle.
High availability is a supported configuration, commonly discussed as an active/passive pair. It needs compatible appliances, licensing on the pair, and a tested failover design. A base-license feature name is not a measured failover time.
Standard Protection and Xstream Protection
Sophos Firewall help for SFOS 20 lists the Standard appliance bundle as Base License, Network Protection, Web Protection, and Enhanced Support. It lists the Xstream appliance bundle as Base License, Network Protection, Web Protection, Zero-Day Protection, Central Orchestration, DNS Protection, and Enhanced Support. Zero-Day Protection covers machine learning, sandboxing, and threat intelligence. Central Orchestration covers SD-WAN VPN orchestration and Central Firewall Reporting Advanced.
The public how-to-buy page also describes Xstream TLS and DPI inside Network Protection and Web Protection, and it lists bundle-only MDR/XDR threat feeds and NDR Essentials. Enhanced Plus is an upgrade, not the same subscription as Enhanced Support. Email Protection and Web Server Protection are separate. A hardware serial does not include these bundles until they are registered.
Modules, Accessories and Support
The current 1U page lists optional Flexi Port modules, transceivers sold separately, and an optional second power supply. The XGS 2100 and XGS 2300 note recommends rack rails when the external redundant supply is used. A module occupies a bay that the model must have.
Enhanced Support on the how-to-buy page is described as 24/7 support access, firmware updates, and an advanced-replacement hardware warranty for the term. That description belongs to the support subscription, not to every used or unlicensed appliance. Regional power cords and warranty country follow the ordered SKU.
Licensing and Renewal
A new appliance, a hardware-only spare, a protection bundle, a renewal, and a support contract are different line items. Sophos states that an active subscription is what provides ongoing feature entitlement. Transfer of a subscription to another serial is a manufacturer process, not an assumption. Endpoint and MDR subscriptions are not created by a firewall hardware line.
Sophos for Oman and GCC Organizations
Possible discussions include commercial offices, smaller businesses, larger enterprises, education, healthcare administration, hotels, and multi-site organizations. These are application areas. They are not completed customer installations, and local stock is not promised for every Sophos item.
Firewall Sizing Studio
Collect the inputs a sizing discussion still needs. The summary is a checklist. It does not select an XGS model or certify a throughput.
Requirements summary
- Users: not selected
- Internet bandwidth: not selected
- TLS inspection: not selected
- IPS: not selected
- VPN: not selected
- Session scale: not selected
- Interfaces: not selected
- High availability: not selected
- Growth: not selected
Missing inputs. Users, Internet bandwidth, TLS inspection, IPS, VPN, Session scale, Interfaces, High availability, Growth
Relevant family. XGS desktop or 1U, chosen after the circuit, inspection, and license are named. No Sophos appliance is published in the catalog to link.
No certified sizing result is produced. Laboratory datasheet figures stay off this checklist.
Standard and Xstream Protection Comparison
Record which bundle the request is asking about. The notes follow the SFOS 20 licensing help. They are not a quotation and they do not register a serial.
Requirements summary
- Bundle under discussion: not selected
- Endpoint licenses: not selected
- Support: not selected
- Term: not selected
Missing inputs. Bundle under discussion, Endpoint licenses, Support, Term
Relevant family. Standard Protection, on the SFOS 20 help, is Base, Network Protection, Web Protection, and Enhanced Support. Xstream Protection adds Zero-Day Protection, Central Orchestration, and DNS Protection. Hardware only is not those bundles.
MDR, endpoint seats, Email Protection, and Web Server Protection stay separate. A selection here does not transfer a license.
Explore Sophos Products
These cards read the existing product master where the manufacturer field is exactly “Sophos”. A catalog sample specification is not a certified datasheet, a price, or proof of stock. No second product list is stored on this page.
0 of 0 published Sophos records shown.
No published catalog record uses the manufacturer name Sophos. Source part labels below are request references. They are not live inventory.
View All cannot open a filtered products page. The products filter accepts a manufacturer only when that name already exists on a published record, and Sophos has none.
Source part references
These identifiers come from the original brand source. A row is a live catalog card only when the same part number exists on a published record for this manufacturer.
XG21T1TUS
Source label: Sophos XGS 2100 Firewall Appliance
Source reference only. It is not a published catalog record. The original sentence says dual-processor Xstream architecture, 30 Gbps firewall throughput, and 1.25 Gbps threat protection. The current Sophos 1U page lists 5 Gbps threat protection on the first performance block, beside 30 Gbps firewall and 1.1 Gbps TLS inspection, and labels those figures as ideal laboratory maxima. The suffix was not confirmed from an official SKU guide, so neither throughput table is assigned to this code.
XG11T1TUS
Source label: Sophos XGS 116 Desktop Firewall Appliance
Source reference only. It is not a published catalog record. The original sentence says the desktop appliance has an integrated PoE port. Sophos documentation for the XGS 116(w) describes LAN port 8 as PoE, up to 30 W under 802.3at. That description is not copied onto this suffix until the ordering code and hardware revision are matched.
Related Novatelia Solutions
Sophos Knowledge Hub
What is Sophos?
Sophos is a United Kingdom cybersecurity company. On this page the name covers XGS firewalls, protection subscriptions, and the endpoint integration those subscriptions require. The catalog manufacturer string used by the products filter is Sophos. No published product currently uses it.
What is Sophos XGS?
XGS is the current Sophos firewall appliance family, in desktop and rackmount models. XG is an earlier hardware generation. The names are not interchangeable chassis.
What is the Sophos XGS 116?
A desktop XGS model. Sophos documentation for the XGS 116(w) describes eight LAN copper ports, with port 8 able to supply PoE. The w suffix adds wireless. XG11T1TUS is a source label, not a catalog record.
Does the XGS 116 have PoE?
The Sophos quick-start guide for XGS 116(w) says port 8 can power a device with up to 30 W under 802.3at, and it describes 802.3af up to 15.4 W. That statement is for the documented XGS 116(w) hardware. It is not automatically applied to a different revision or to the unmatched source code XG11T1TUS.
What is the Sophos XGS 2100?
A 1U XGS firewall. The current Sophos accessory table gives it one Flexi Port bay and optional external redundant power. XG21T1TUS is a source label, not a catalog record, and its suffix was not decoded from an official SKU guide in this review.
What throughput does the XGS 2100 publish?
The current Sophos 1U page lists a first performance block of 30 Gbps firewall, 5 Gbps threat protection, and 1.1 Gbps TLS inspection, and says the figures are ideal laboratory maxima. An earlier XGS 2100 table lists threat protection at 1,250 Mbps. The Novatelia source sentence uses 1.25 Gbps. Neither figure is assigned to XG21T1TUS, and neither is a production guarantee.
What does XG21T1TUS identify?
It is the original source identifier for an XGS 2100 appliance discussion. It is not a published Novatelia product, and this review did not match it to a current Sophos order code.
What does XG11T1TUS identify?
It is the original source identifier for an XGS 116 desktop appliance discussion. It is not a published Novatelia product, and the PoE description stays on the documented XGS 116(w) hardware until the code is matched.
What is the Sophos XGS 3100?
A larger 1U XGS model named in the current accessory table after the XGS 2300. Performance columns on that page were unlabeled in the text extracted for this review, so a specific throughput is not assigned here. No XGS 3100 catalog record exists.
What is Xstream?
Sophos’s name for the XGS processing architecture, including a dedicated Xstream Flow processor and stream-based inspection. The name does not fix the throughput of a site.
What is Standard Protection?
On the SFOS 20 licensing help, the Standard appliance bundle is the base license, Network Protection, Web Protection, and Enhanced Support. It is a subscription, not a firewall chassis.
What is Xstream Protection?
On the same help page, the Xstream appliance bundle adds Zero-Day Protection, Central Orchestration, and DNS Protection to the Standard set. DNS Protection is described on the how-to-buy page as not sold separately.
What is the difference between firewall throughput and threat protection?
Sophos measures firewall throughput with HTTP and a 512 KB response. Threat protection is measured with firewall, IPS, application control, and malware prevention enabled, using Enterprise Mix traffic. The two numbers are different tests.
What is IPS on a Sophos firewall?
Intrusion prevention is listed under Network Protection. That module is inside both Standard and Xstream bundles on the SFOS 20 help. IPS throughput is its own laboratory test, using a UDP packet mix.
What is TLS inspection?
Inspection of encrypted sessions after the firewall can decrypt them. Sophos’s how-to-buy page describes an Xstream TLS and DPI engine inside Network Protection and Web Protection. The TLS laboratory test uses IPS on HTTPS and different cipher suites. A certificate and privacy review still belong to the project.
What is Sophos Central?
Sophos’s central administration account. Central Firewall Management requires a paid protection or support license. The base firewall license is not sufficient, per the SFOS 20 help. This page does not open the console.
What is Security Heartbeat?
A status link between a Sophos firewall and endpoints protected through Sophos Central, so policy can use endpoint health. It is listed under Network Protection. No live status is shown here.
What is Synchronized Security?
Sophos’s name for coordinating the firewall with endpoint health and related controls. It needs the firewall subscription that includes Heartbeat and compatible endpoint software. It is not a live monitoring service on this page.
Are endpoint licenses included with an XGS firewall?
No. Endpoint products have their own licenses. A firewall bundle does not create endpoint seats.
Is MDR included with every Sophos firewall?
No. MDR is a separate service. The how-to-buy page describes some threat-feed and data-lake items as bundle features, which is not the same as an MDR retainer.
What VPN does the base license include?
The SFOS 20 help lists VPN on the base license, including the remote-access and site-to-site functions Sophos describes with that license. Peers, authentication, and addressing are still design inputs.
What is Sophos SD-WAN?
Base networking and traffic shaping are on the base license. SD-WAN VPN orchestration is listed under Central Orchestration, which the SFOS 20 help places in the Xstream bundle.
How does Sophos high availability work?
High availability is named on the base license. An active/passive pair still needs compatible appliances, the right subscriptions, and a tested failover design. No failover time is published here.
How are Sophos licenses renewed?
A renewal is a subscription term for an existing serial. It is not a new appliance, and it is not assumed to move to a different serial without the manufacturer’s process.
What hardware support can be ordered?
Enhanced Support is the support subscription in the Standard and Xstream bundles. Enhanced Plus is a further upgrade. Replacement terms follow the registered support license and the country of the SKU.
How is an XGS model sized?
From users, bandwidth, TLS inspection, IPS, VPN, sessions, interfaces, high availability, and growth. The sizing studio on this page only records those inputs. It does not certify a model.
Are Sophos products in stock at Novatelia?
No Sophos product is published in the product master, so no stock figure exists.
Does Novatelia publish Sophos prices?
No Sophos price is published, because no Sophos catalog record exists.
Does a Sophos listing prove authorized distributor status?
A brand listing is not a manufacturer appointment, a warranty, or proof of stock.
What information does a Sophos RFQ need?
The exact model or source label, hardware-only or bundle, protection term, endpoint seats if required, quantity, and delivery country. The RFQ page keeps a browser draft. It does not submit a quotation or issue a reference.
How can customers view all Sophos products on Novatelia?
They cannot, through a manufacturer filter. The products page keeps a manufacturer value only when a published record already uses that name, and Sophos has none. An unfiltered products page would mix other manufacturers, so this page does not offer that link.
Can a protection bundle be treated as a firewall appliance?
No. A subscription is a license. An XGS chassis is hardware. A renewal is neither a new chassis nor proof that the license can move.
Do laboratory benchmarks guarantee office throughput?
No. Sophos states that the published maxima use ideal test conditions and that results vary with the network and the services that are enabled.
What is a Flexi Port module?
An optional interface card for an XGS expansion bay. The current 1U page lists copper, fiber, bypass, and PoE modules. The appliance must have a free bay of the right type. Transceivers are sold separately.
Where does Sophos name its company for this hardware?
The XGS 2100 operating instructions name Sophos Technology GmbH in Wiesbaden, Germany, for the EU declaration of conformity. The Novatelia brand record lists the manufacturer origin as the United Kingdom. Both statements are kept. Neither is a partner appointment.
Request Sophos Firewalls, Subscriptions and Security Equipment
Include the exact model, whether the line is hardware, a protection bundle, a renewal, or support, the term, quantity, endpoint seats if they are in scope, and the delivery country. A requested date is not a confirmed lead time.
The RFQ page keeps a browser draft. It does not submit a quotation or issue a reference.