SOPHOS XG238000ZZPCAU XGS 2380 Security Appliance

The Sophos XGS 2380 Security Appliance is a powerful, rackmount next-generation firewall designed to deliver advanced network security, high-speed connectivity and centralised threat protection for medium to large businesses, distributed organisations and demanding network environments.

Powered by Sophos Firewall OS and the Xstream architecture, the XGS 2380 combines deep packet inspection, intrusion prevention, application control, VPN connectivity and intelligent traffic management in a single security platform. Designed to protect modern business networks without unnecessarily compromising performance, the appliance provides a scalable foundation for securing users, applications, data and network infrastructure.

For organisations requiring more comprehensive protection, the optional Sophos Xstream Protection subscription adds advanced threat prevention, web security, zero-day threat analysis and enhanced visibility. When deployed alongside Sophos Endpoint or Sophos MDR, the XGS 2380 also supports Sophos Synchronized Security, allowing network and endpoint security to share threat intelligence and coordinate their response to attacks.

The Sophos XGS 2380 is an ideal choice for New Zealand organisations seeking a centrally managed, enterprise-grade firewall solution with flexible security licensing and room for future network growth.

Key Features and Benefits of the Sophos XGS 2380 Firewall

High-Performance Xstream Architecture

The Sophos XGS 2380 introduces a new single-CPU architecture with dedicated Xstream FastPath processing cores. This design accelerates eligible network traffic while allowing the firewall to perform sophisticated security inspection.

Key performance specifications include:

Firewall throughput

59.8 Gbps

Threat protection

23.3 Gbps

SSL/TLS inspection

8 Gbps

IPsec VPN throughput

48.5 Gbps

These capabilities make the XGS 2380 suitable for organisations that need to inspect substantial volumes of network traffic while maintaining responsive access to cloud applications, business systems and internet services.

Published laboratory performance figures. Actual throughput varies with traffic characteristics, inspection policies and enabled security services.

Multi-Gigabit Connectivity and Flexible Network Expansion

The Sophos XGS 2380 provides modern connectivity options for high-speed business networks, including:

• Eight integrated 2.5 Gigabit Ethernet copper ports.
• Two 10 Gigabit Ethernet fibre interfaces.
• Two 1 Gigabit Ethernet fibre interfaces.
• One Flexi Port expansion bay for additional connectivity.
• A compact 1U rackmount chassis suitable for server rooms and network cabinets.

This combination allows organisations to connect high-speed internet services, network switches, servers and segmented network environments without relying entirely on additional interface modules.

Business Continuity and Hardware Resilience

The XGS 2380 includes hardware features designed to simplify maintenance and improve service availability.

Its field-replaceable NVMe SSD allows a failed storage drive to be replaced through the Sophos RMA process without returning the complete appliance. An optional second internal power supply provides additional power redundancy.

The appliance also supports high-availability firewall configurations, helping organisations minimise disruption when deployed with a suitably configured second firewall.

Sophos XGS 2380 Base Firewall Licence – What's Included?

Every Sophos XGS 2380 appliance includes a Sophos Firewall Base Licence, providing the essential networking, firewall and VPN capabilities needed to establish a secure business network.

The base licence includes:

• Stateful firewall protection: Controls incoming and outgoing traffic using configurable firewall rules, network objects and security policies.
• Network routing and segmentation: Supports routing, VLANs and network zoning to separate users, systems and services.
• Site-to-site VPN: Establishes encrypted connections between offices, branches and other network locations.
• Remote access VPN: Provides secure connectivity for authorised remote and hybrid workers.
• SD-WAN and traffic management: Supports routing and traffic-management capabilities to help optimise multiple WAN connections.
• High availability: Supports firewall redundancy configurations for improved network continuity.
• Wireless and RED functionality: Includes relevant base wireless and Firewall RED capabilities, subject to compatible devices and applicable licensing requirements.
• Local reporting and administration: Provides on-appliance management, monitoring, logging and reporting capabilities.

What the Base Licence Does Not Include

The base licence provides core firewall and networking functions but does not include the full range of advanced security services.

Intrusion Prevention System (IPS), advanced web filtering, application control, zero-day malware analysis, Security Heartbeat and cloud-based DNS Protection require additional subscriptions.

Centralised firewall management through Sophos Central also requires an eligible paid subscription or support licence.

For businesses requiring comprehensive protection against ransomware, malware, malicious websites and sophisticated network threats, Sophos Xstream Protection is the recommended upgrade.

Sophos Xstream Protection – Advanced Security for the XGS 2380

Adding Sophos Xstream Protection transforms the XGS 2380 from a capable network firewall into a comprehensive next-generation security platform.

Xstream Protection combines multiple security technologies into a single subscription bundle, simplifying licensing while providing stronger protection against modern cyber threats.

Security capability	Benefit
Network Protection	Intrusion prevention, threat intelligence and advanced network threat detection
Web Protection	Website filtering, web malware protection and application control
Zero-Day Protection	Machine learning and sandbox analysis of suspicious files
TLS Inspection	Inspection of encrypted traffic to help identify concealed threats
DNS Protection	Cloud-based protection against malicious domains
Security Heartbeat	Shares security status between compatible Sophos endpoints and the firewall
Active Threat Response	Enables coordinated responses using supported Sophos and third-party threat intelligence
Central Orchestration	Centralised SD-WAN VPN orchestration and advanced reporting
Enhanced Support	24/7 support access, eligible firmware updates and enhanced hardware support entitlements

Deep Packet Inspection and Encrypted Traffic Security

Sophos Xstream Protection enables advanced inspection of network traffic, including encrypted TLS traffic, helping identify malware and malicious activity that traditional firewall filtering may miss.

The XGS 2380's Xstream architecture is designed to provide strong inspection performance while intelligently accelerating eligible trusted traffic.

Advanced Malware and Ransomware Protection

Sophos Zero-Day Protection uses machine learning, threat intelligence and sandbox-based file analysis to identify potentially malicious files, including previously unknown threats.

This provides an additional layer of defence against ransomware, malware and sophisticated attacks that may evade traditional signature-based detection.

Centralised Security Management with Sophos Central

With an eligible subscription, the XGS 2380 can be integrated into Sophos Central for centralised firewall management, monitoring and reporting.

This is particularly valuable for organisations operating multiple offices and for managed service providers (MSPs) responsible for maintaining customer security environments.

Sophos Synchronized Security – Connecting Firewall and Endpoint Protection

One of the major advantages of deploying a Sophos XGS 2380 firewall is its ability to work alongside other Sophos security products through Sophos Synchronized Security.

Traditional firewalls and endpoint protection products often operate independently. Sophos Synchronized Security helps bridge this gap by allowing compatible Sophos products to share information about potential threats.

How Sophos Security Heartbeat Works

Sophos Security Heartbeat enables supported Sophos endpoints and Sophos Firewall to exchange security status information.

When a protected computer or server becomes compromised, its security status can be communicated to the firewall, enabling automated responses based on configured policies.

For example:

1. Sophos Endpoint detects suspicious or malicious activity on a computer.
2. Security Heartbeat communicates the endpoint's security status to the XGS 2380.
3. The firewall can automatically restrict network access for the affected endpoint.
4. Security teams can investigate and remediate the threat.
5. Normal network access can be restored once the endpoint returns to a healthy security state.

This coordinated approach helps limit lateral movement, reduce the potential spread of malware and accelerate incident response.

Why Add Sophos Endpoint Protection to the XGS 2380?

A next-generation firewall protects traffic crossing network boundaries, but many attacks originate directly on endpoints through phishing, malicious downloads, compromised credentials or infected applications.

Adding Sophos Endpoint Protection extends security directly to computers, laptops and servers, providing an additional layer of defence beyond the firewall.

Benefits of Combining Sophos Firewall and Sophos Endpoint

Sophos Firewall	Sophos Endpoint
Protects network traffic	Protects computers and servers
Inspects network connections	Detects malicious processes and files
Blocks malicious websites and network threats with appropriate subscriptions	Helps prevent ransomware and exploits
Enforces network access policies	Monitors endpoint security status
Supports network-based threat response	Provides endpoint detection and remediation

Together, the solutions offer a more coordinated security posture through shared threat intelligence and automated response capabilities.

Further Protection with Sophos XDR and Sophos MDR

Organisations requiring more advanced detection and response can extend their security environment with Sophos Extended Detection and Response (XDR) or Sophos Managed Detection and Response (MDR).

Sophos XDR provides security teams with broader visibility and investigation capabilities across supported security products and data sources.

Sophos MDR adds a managed security service with expert-led threat monitoring, investigation and response, helping organisations that do not have dedicated in-house security operations resources.

Combining Sophos Firewall, Endpoint and MDR can provide a more comprehensive defence against advanced cyber threats.

Sophos XGS Firewall Hardware Comparison Chart

The Sophos XGS Series includes desktop, 1U rackmount and 2U rackmount security appliances, allowing businesses to select a firewall based on performance, connectivity, expansion requirements and future growth.

The following comparison focuses on the 14 XGS rackmount models, including the four new models introduced in November 2026. Desktop XGS 87/88 through XGS 136/138 models are also available for smaller networks and branch offices.

Sophos XGS Rackmount Models – Key Hardware Differences

Throughput in Gbps. Fixed ports exclude dedicated management and console interfaces.

XGS model	Chassis	Fixed ports	Flexi bays	Firewall throughput	Threat protection
2100	1U	10	1	30	5.6
2300	1U	10	1	39	5.9
2380 (New)	1U	12	1	59.8	23.3
3100	1U	12	1	47	8.3
3300	1U	12	1	58	12
3380 (New)	1U	12	1	80	32
4300	1U	12	2	75	28
4500	1U	12	2	80	34.75
4580 (New)	1U	12	2	105	45
5580 (New)	1U	12	2	112.5	58
5500	2U	16	3	110	46
6500	2U	20	4	120	60
7500	2U	22	4	160	70
8500	2U	22	4	190	92.5

Published comparative figures from the November 2026 range information. Performance is not guaranteed in real-world deployments. The new 2380, 3380, 4580 and 5580 models expand the range rather than directly replacing existing models.

Choosing the Right Sophos XGS Firewall

The Sophos XGS 2380 is particularly attractive for organisations seeking a substantial increase in threat inspection performance without moving to a larger 2U enterprise appliance.

Its combination of 23.3 Gbps threat protection throughput, 8 Gbps SSL/TLS inspection and integrated multi-gigabit connectivity makes it a strong option for growing organisations with increasingly demanding security requirements.

When comparing Sophos firewalls, businesses should consider actual inspected traffic requirements, encrypted traffic volumes, concurrent users, VPN demands, interface speeds and future growth rather than selecting a model based solely on headline firewall throughput.

Ideal Applications for the Sophos XGS 2380

The Sophos XGS 2380 is well suited to a variety of business environments, including:

• Medium to large businesses: Protecting users, servers, cloud applications and business-critical network services.
• Multi-site organisations: Connecting offices and branch locations through secure VPN and SD-WAN networking.
• Education and professional services: Providing network segmentation, application control and web security for diverse user groups.
• Managed service providers: Delivering centrally managed network security services to business customers.
• Organisations upgrading older firewalls: Improving threat inspection capacity and introducing multi-gigabit networking.
• Businesses adopting Sophos Endpoint or MDR: Building an integrated security platform with coordinated threat detection and response.

Why Choose the Sophos XGS 2380?

The Sophos XGS 2380 combines high-performance next-generation firewall capabilities with flexible security licensing, multi-gigabit connectivity and integrated threat protection.

Whether deployed as a standalone firewall, upgraded with Sophos Xstream Protection or integrated with Sophos Endpoint and MDR, the XGS 2380 provides a scalable security foundation for organisations seeking to strengthen their cybersecurity posture.

For New Zealand businesses, IT resellers and managed service providers, the XGS 2380 offers an attractive balance of performance, security capabilities, hardware resilience and future expansion options.

Contact SnapperNet for Sophos XGS 2380 appliance pricing, Xstream Protection licensing, subscription renewals and assistance selecting the most suitable Sophos firewall for your customer's requirements.