Quick Information

Overview of the Sophos XGS 118

The Sophos XGS 118 is positioned within the second-generation XGS desktop family for small and medium businesses and branch-office environments. It is built for organizations that have outgrown basic routers but do not require a large rackmount firewall. The appliance provides nine fixed 2.5 Gigabit Ethernet copper ports, one SFP fiber port, an expansion bay for an optional second-generation 5G module, an optional second power supply and support for the security capabilities available through Sophos Firewall and the chosen protection subscription.

This combination makes the appliance relevant for companies modernizing from 1 Gigabit access networks, adopting 2.5 Gigabit switches or Wi-Fi 6 access points, consolidating multiple WAN links, or replacing a legacy unified threat management device. It can serve as the security gateway between users, servers, cloud services, branch links, guest networks and internet connections while applying policy controls and generating operational visibility.

The XGS 118 is the wired model. It does not include built-in wireless. Organizations that specifically require integrated Wi-Fi should consider the XGS 118w or use separate managed wireless access points. A separate access-point design is often preferred where coverage, capacity, roaming or placement requirements extend beyond the firewall room. FourTeck can review the floor plan, switching topology, internet circuits and user profile before recommending the more suitable approach.

Why This Appliance Matters for Business Security

Business networks now carry far more than web browsing and email. Cloud accounting platforms, customer databases, video meetings, remote-desktop sessions, voice traffic, SaaS applications, backups and encrypted connections all share the same perimeter. A firewall must therefore do more than allow or deny ports. It must identify applications, inspect traffic where policy permits, enforce access rules, segment systems, support reliable remote connectivity and help administrators understand what is happening across the network.

The XGS 118 gives smaller organizations a platform with substantial throughput headroom and multi-gigabit interfaces. That does not mean every environment will achieve headline laboratory rates. Real performance depends on packet size, enabled security services, TLS inspection, rule complexity, VPN use, firmware version and the traffic mix. Correct sizing should be based on protected throughput and real workloads rather than only the raw firewall number. FourTeck assists buyers in translating internet speed, user count, branch count, VPN requirements and inspection policies into a practical appliance and license recommendation.

Key Business Benefits

Product Highlights

• 15.5 Gbps published firewall throughput under vendor test conditions
• 11 Gbps firewall IMIX throughput
• 3.5 Gbps published IPS throughput
• 3.95 Gbps published NGFW throughput
• 3.25 Gbps published threat-protection throughput
• 13 Gbps published IPsec VPN throughput
• 1.1 Gbps TLS inspection throughput
• Nine fixed 2.5 GE copper interfaces
• One SFP fiber interface; transceiver sold separately
• Optional second power supply
• Optional Gen.2 5G expansion module
• Wall, rack or DIN-rail mounting options with suitable accessories

Published performance is measured under controlled test conditions. Actual results vary by configuration, enabled services and network traffic.

Sophos XGS 118 Technical Specifications

Configuration and Buyer Guidance

Size for protected traffic, not only internet speed

A 1 Gbps internet service does not automatically mean that any firewall with more than 1 Gbps raw throughput will be suitable. IPS, malware scanning, application control, TLS inspection, VPN encryption, reporting and concurrent sessions all consume resources. Buyers should estimate peak internet utilization, east-west segmentation traffic, remote-access demand, site-to-site tunnels, cloud backup windows and projected growth. FourTeck can map these factors against the published protected-throughput figures and recommend whether the XGS 118 provides enough operational headroom.

Choose the protection subscription deliberately

The appliance hardware and the security subscription are separate buying considerations. Features such as advanced threat protection, web security, application control, reporting or enhanced support may depend on the selected bundle and term. A lower initial license cost may not cover the controls the organization expects. FourTeck reviews required features, renewal period and support expectations before preparing the quote.

Plan every interface before deployment

Nine 2.5 GE ports provide useful flexibility, but a port map should still be created. Typical assignments include primary WAN, backup WAN, corporate LAN, server VLAN trunk, guest network, voice network, management segment and dedicated branch links. The SFP interface can support fiber connectivity when used with a compatible transceiver, which is sold separately. Cable category, switch capability and VLAN design should also be confirmed.

Ideal Business Use Cases

Application Visibility and Policy Control

Traditional firewall rules based only on IP addresses and ports can struggle with modern applications that use shared cloud infrastructure and encrypted connections. Sophos Firewall can identify applications and help administrators apply policies based on business need. This can support controls for streaming, remote-access tools, file sharing, social platforms and unsanctioned services. The purpose is not simply to block applications; it is to classify risk, protect productivity and permit approved services with the correct restrictions.

A practical rollout begins with visibility. FourTeck can help administrators review traffic reports, identify critical applications, create sensible categories and introduce controls gradually. Overly aggressive blocking can interrupt legitimate workflows, while overly broad rules can expose the network. Policy design should reflect departments, user roles, device types and business hours. Where directory integration is appropriate, user-aware policies can provide more useful control than network-address rules alone.

VPN, SD-WAN and Branch Connectivity

The XGS 118 can support IPsec VPN, SSL VPN and SD-WAN designs according to the deployed firmware, policy and license. Site-to-site VPNs are commonly used to connect branch offices, data centers, hosted applications and cloud environments. Remote-access VPNs provide authorized staff with encrypted access to internal resources. SD-WAN policies can select links based on availability, quality or business priority, improving resilience where multiple internet services are present.

Good VPN design includes more than creating a tunnel. Encryption settings, route ownership, overlap checks, DNS behavior, user authentication, split tunneling, logging, failover and bandwidth allocation must all be considered. FourTeck can review the existing topology and migration constraints before implementation. For organizations considering optional 5G, the module can be used as a backup or fixed wireless path, but coverage, carrier service, antenna location and data-plan terms should be validated at the deployment site.

Encrypted Traffic and Threat Inspection

A large share of modern internet traffic is encrypted. Encryption protects confidentiality, but it can also conceal malicious downloads, command traffic and policy violations. TLS inspection enables the firewall to decrypt eligible sessions, apply security controls and then re-encrypt the traffic. This capability should be implemented selectively because it affects performance, privacy, certificate management and application compatibility.

The published XGS 118 TLS inspection figure is 1.1 Gbps under Sophos test conditions with IPS enabled. Actual performance depends on cipher suites, session behavior and policy. Organizations should decide which user groups and destinations require inspection, which categories should be excluded, how certificates will be distributed and how regulated or privacy-sensitive services will be handled. FourTeck can develop a staged inspection policy and test key applications before broader enforcement.

Buyer Checklist

UAE Availability and Service Support

FourTeck assists UAE buyers with product selection, current availability checks, subscription comparisons, accessory review and quotation. Availability can change by hardware revision, bundle, license term and regional supply, so the page does not claim fixed stock. The quotation should clearly state the appliance, selected protection bundle, subscription duration, support level, optional power supply, rackmount option, SFP transceiver, 5G module and any professional services.

Deployment support can include pre-configuration planning, interface mapping, VLAN creation, firewall rule design, NAT, VPN setup, web and application policies, administrative access controls, logging, backup and handover. Scope depends on the agreed project. Visit the FourTeck firewall services page or contact the team with your network details.

Dubai, Abu Dhabi, Sharjah and Ajman Coverage

FourTeck coordinates firewall consultation, supply enquiries and service planning for businesses across Dubai, Abu Dhabi, Sharjah and Ajman. The exact delivery, installation or onsite-visit arrangement is confirmed during quotation and depends on project scope, engineer scheduling and product availability. Remote planning may be used before a site visit to collect internet details, current configuration, IP addressing, VLAN requirements and migration objectives.

GCC and Africa Availability

Organizations managing branches beyond the UAE can ask FourTeck about regional coordination for GCC and African locations. Commercial terms, licenses, logistics and service delivery vary by destination. Relevant regional resources include FourTeck Kuwait, FourTeck Africa, FourTeck Kenya and FourTeck Uganda. A multi-site project should standardize firmware, templates, VPN naming, monitoring and renewal records while respecting local connectivity and compliance requirements.

Related FourTeck Products and Services

Why Buyers Choose FourTeck

FourTeck does not treat firewall selection as a model-number exercise. The correct outcome depends on security policy, traffic inspection, network architecture, operational ownership and the organization’s tolerance for downtime. Buyers receive guidance designed to reduce specification gaps and avoid purchasing a bundle that does not match the intended deployment.

Frequently Asked Questions

Get the Right XGS 118 Configuration

Share your user count, internet speed, VPN requirement, number of sites, preferred license term and existing firewall model. FourTeck will help identify the appliance, subscription and deployment scope that best match your environment.

Check UAE AvailabilityContact FourTeck Sales