Sophos XGS-136 Rev.1 Security Appliance

The Sophos XGS 136 is a compact desktop next-generation firewall designed for small businesses, branch offices, and retail locations supporting up to 200 users. Powered by Sophos’ Xstream Architecture — a dual-processor design combining a high-performance multi-core CPU with a dedicated Xstream Flow Processor — it delivers hardware-accelerated security without the performance penalties of traditional firewalls.

Xstream Architecture — Speed Meets Security

The dedicated Xstream Flow Processor offloads TLS decryption, IPsec VPN processing, and trusted traffic directly to the FastPath, delivering 11.5 Gbps firewall throughput, 950 Mbps TLS inspection, and 4.8 Gbps IPsec VPN throughput simultaneously. This eliminates the traditional trade-off between enabling security features and maintaining network performance.

Rich Connectivity with Built-In PoE

Ten GbE copper ports, two 2.5 GbE PoE ports (30W per port), two SFP fiber uplinks, and a single expansion bay provide flexible connectivity for diverse network environments. The built-in 2.5 GbE PoE ports directly power access points or cameras without separate injectors, while the expansion bay accommodates optional 3G/4G, VDSL2 DSL, or a second Wi-Fi radio module (on 136w).

Comprehensive Threat Protection

With a subscription, the XGS 136 delivers next-gen IPS, Xstream TLS 1.3 inspection without downgrade, streaming DPI, zero-day sandboxing via SophosLabs Intelix, Synchronized Security with automatic lateral movement isolation, SD-WAN with zero-impact failover, and unlimited IPsec/SSL site-to-site VPN — all managed centrally through Sophos Central.

Backed by a 1-year hardware warranty (extendable to 5 years with Enhanced Support), the XGS 136 is a proven, cost-effective security platform for growing SMBs and distributed branch networks.

—

Technical Specifications

Performance

• Firewall Throughput: 11,500 Mbps
• Firewall IMIX: 4,700–6,500 Mbps
• Firewall Latency (64-byte UDP): 8 µs
• IPS Throughput: 3,300–4,000 Mbps
• NGFW Throughput: 3,000 Mbps
• Threat Protection Throughput: 1,000 Mbps
• IPsec VPN Throughput: 4,800 Mbps
• SSL VPN Concurrent Tunnels: 1,500
• Xstream TLS Inspection: 950 Mbps
• Xstream TLS Concurrent Connections: 18,432
• Concurrent Connections: 6,400,000
• New Connections/Second: 74,500
• Recommended Users: 100–200

Fixed Interfaces

• GbE Copper Ports: 10x GbE RJ45
• 2.5 GbE PoE Ports: 2x 2.5 GbE RJ45 (PoE, 30W max per port)
• SFP Fiber Ports: 2x SFP (transceivers sold separately)
• Management Ports: 1x COM RJ45, 1x Micro-USB (cable included)
• USB Ports: 1x USB 2.0 (front), 1x USB 3.0 (rear)
• Expansion Slots: 1x expansion bay

PoE

• PoE Ports: 2x 2.5 GbE (fixed)
• Max per Port: 30W
• Total PoE Budget: 60W (+ up to 76W with PoE expansion module)

Storage

• Internal SSD: 64 GB (local quarantine/logs)

Expansion Options

• 3G/4G module (via expansion bay)
• SFP DSL module (VDSL2)
• Second Wi-Fi radio — XGS 136w model only
• Optional second redundant power supply

Security Features (subscription-dependent)

• Firewall: Stateful inspection, DoS/DDoS, application-aware policy
• TLS Inspection: Xstream TLS 1.3 (no protocol downgrade)
• DPI Engine: Xstream streaming deep packet inspection
• IPS: Signature + behavioural next-gen IPS
• Threat Protection: Deep learning, zero-day sandbox (SophosLabs Intelix)
• Web Protection: URL filtering, app control, shadow IT visibility
• Synchronized Security: Sophos Security Heartbeat — auto lateral movement isolation
• Active Threat Response: Automated breach containment
• SD-WAN: Xstream SD-WAN with FastPath, zero-impact failover, SLA-based routing
• VPN: IPsec IKEv1/IKEv2, SSL VPN, SD-RED tunnels (unlimited site-to-site)

Networking

• Routing: Static, OSPF, BGP, RIP, policy-based
• IPv6: Full dual-stack
• DHCP: Server, client, relay
• NAT: Full NAT, PAT, DNAT, SNAT
• VLAN: 802.1Q (unlimited)
• High Availability: Active-Active, Active-Passive

Management

• Cloud: Sophos Central (zero-touch provisioning, centralised policy)
• On-Box: WebAdmin GUI (HTTPS), CLI (SSH/console)
• API: REST API
• Reporting: 7-day on-box / 30-day Sophos Central (Xstream licence)
• SNMP: v1/v2c/v3

Physical

• Form Factor: Desktop (rackmount kit available separately)
• Dimensions (W x H x D): 320 x 44 x 213 mm
• Weight: 2.4 kg / 5.29 lbs (unpacked)
• Cooling: Active fan

Power

• Supply: External auto-ranging AC-DC
• Input: 100-240V AC, 2.5A, 50-60Hz (12VDC / 12.5A / 150W)
• Idle: 30W / 102 BTU/hr
• Max (XGS 136): 62W / 212 BTU/hr
• Max with PoE: +76W / 260 BTU/hr
• Redundant PSU: Optional (rear connector provided)

Environmental

• Operating Temp: 0°C to 40°C
• Storage Temp: -20°C to +70°C
• Humidity: 10% to 90% non-condensing

Certifications

• CB, CE, UL, FCC, ISED, VCCI, CCC, KC, BSMI, NOM, Anatel
• RoHS compliant

Subscriptions (sold separately)

• Standard Protection: Base licence + Network Protection + Web Protection + Enhanced Support
• Xstream Protection: All Standard features + Zero-Day sandbox + Central Orchestration + XDR/MDR connector + 30-day cloud reporting
• Terms: 1, 3, 5-year options
• Base Licence (free): Firewall, VPN, SD-WAN, basic reporting, Sophos Central management

Warranty

• Standard: 1-year hardware warranty
• Extended: Up to 5 years with Enhanced Support licence
• Firmware: 3 free SFOS updates included without subscription

Package Contents

• 1x Sophos XGS 136 Appliance
• 1x External power adapter (12V/12.5A)
• 1x Micro-USB console cable
• 1x Quick Start Guide
• Note: SFP transceivers, rackmount kit, and redundant PSU sold separately