SOPHOS XG458000ZZPCAU XGS 4580 Security Appliance

The Sophos XGS 4580 Security Appliance is a powerful, next-generation firewall (NGFW) designed for large businesses, enterprise networks, data centres and organisations requiring high-speed network security without compromising performance. Featuring Sophos Xstream architecture, a dedicated Xstream Flow Processor and high-speed 25GbE connectivity, the XGS 4580 delivers exceptional firewall throughput, advanced threat protection and efficient inspection of encrypted network traffic.

Built for demanding network environments, the Sophos XGS 4580 combines enterprise-grade security, flexible connectivity, hardware redundancy and centralised management in a compact 1U rackmount appliance. With the addition of Sophos Xstream Protection, organisations gain advanced intrusion prevention, web and application security, zero-day threat detection and coordinated threat response.

The XGS 4580 also integrates with Sophos Endpoint Security through Sophos Synchronized Security, enabling firewalls and endpoints to share real-time threat intelligence, automatically respond to compromised devices and strengthen an organisation's overall cybersecurity posture.

Key Features and Benefits of the Sophos XGS 4580

High-Performance Xstream Firewall Architecture

The Sophos XGS 4580 combines a high-performance x86 processor with a dedicated Xstream Flow Processor to accelerate network traffic processing and improve security inspection efficiency.

This architecture is designed to handle demanding enterprise workloads, including encrypted applications, high-speed internet connections, site-to-site VPN traffic and large numbers of simultaneous network sessions.

Firewall throughput

105 Gbps

Threat protection throughput

45 Gbps

25GbE fibre interfaces

4

Flexi Port expansion bays

2

Published Sophos laboratory performance figures. Actual throughput depends on network configuration, traffic characteristics and enabled security services.

High-Speed 25GbE Networking and Flexible Expansion

The XGS 4580 provides high-speed network connectivity for enterprise environments with substantial bandwidth requirements.

Key connectivity features include:

• 8 × 2.5GbE copper interfaces for flexible LAN, WAN and network segmentation.
• 4 × 25GbE fibre interfaces for high-speed connections to switches, servers and network infrastructure.
• 2 × Flexi Port expansion bays for additional network interface options.
• Support for VLANs, multiple WAN connections, SD-WAN routing and network segmentation.
• Flexible deployment for enterprise campuses, data centres and distributed organisations.

Enterprise Reliability and Hardware Redundancy

The Sophos XGS 4580 is designed for business-critical environments where network availability is essential.

• Dual SSD storage with RAID 1: Provides storage redundancy and improved resilience.
• Field-replaceable SSDs: Simplifies hardware servicing without returning the entire appliance.
• Redundant power supplies: Helps maintain availability in the event of a power supply failure.
• 1U rackmount chassis: Offers high performance while conserving rack space.
• High-availability configurations: Supports deployment with a second compatible Sophos Firewall for additional redundancy.

The combination of high-speed connectivity, dedicated traffic acceleration and resilient hardware makes the XGS 4580 suitable for organisations upgrading from older enterprise firewalls or expanding their security infrastructure.

Sophos Firewall Base Licence – What's Included?

Every Sophos XGS 4580 includes the Sophos Firewall Base Licence, providing essential network security and connectivity features without requiring an additional security subscription.

The Base Licence provides the foundation for secure network operations.

Included feature	Description
Stateful firewall	Controls inbound and outbound network traffic using firewall policies and connection tracking.
Network Address Translation (NAT)	Enables internal and external network connectivity and address translation.
IPsec and remote access VPN	Supports encrypted site-to-site and remote access connections.
Routing and SD-WAN	Provides network routing, WAN connectivity and traffic steering capabilities.
VLANs and network segmentation	Enables separation of networks and control of traffic between security zones.
High availability	Supports firewall redundancy configurations for improved business continuity.
Wireless functionality	Provides supported wireless network management capabilities.
Firewall RED	Supports compatible remote Ethernet connectivity features.
Local reporting and management	Provides firewall administration, monitoring, logging and reporting.

What Isn't Included in the Base Licence?

The Base Licence does not include the advanced security services that many organisations expect from a fully featured next-generation firewall.

These require additional subscriptions, including:

• Intrusion Prevention System (IPS) and advanced network threat protection.
• Web filtering, web malware protection and application control.
• Zero-day malware analysis and sandboxing.
• Sophos Security Heartbeat integration.
• Advanced central orchestration and reporting.
• Enhanced Sophos technical support.

The Base Licence is suitable for essential firewall, routing and VPN functionality. For organisations requiring comprehensive cybersecurity protection, Sophos Xstream Protection is the recommended subscription.

Sophos Central Firewall Management also requires an eligible paid subscription or support entitlement; the Base Licence alone is insufficient.

Sophos Xstream Protection – Advanced Network Security

Adding Sophos Xstream Protection transforms the XGS 4580 into a comprehensive next-generation firewall security platform.

Xstream Protection combines multiple security technologies into one subscription, helping organisations prevent ransomware, block malicious activity, inspect encrypted traffic and respond more quickly to emerging cyber threats.

Network Protection and Intrusion Prevention (IPS)

Sophos Network Protection helps identify and block malicious network traffic before it can compromise business systems.

Features include:

• Intrusion Prevention System (IPS) to detect and block known exploits.
• Sophos X-Ops threat intelligence to identify malicious network activity.
• Active Threat Response to automatically block identified threats.
• Security Heartbeat integration with compatible Sophos Endpoint products.
• SD-RED management for supported remote connectivity deployments.

Web Protection and Application Control

Sophos Web Protection helps organisations manage internet access, reduce exposure to malicious websites and control application usage.

Administrators can block dangerous websites, apply category-based web filtering, restrict unauthorised applications and protect users from web-based malware.

Sophos also provides Synchronized Application Control, which uses information shared by compatible Sophos endpoints to help identify applications that conventional firewall inspection may not recognise.

Zero-Day Protection and Advanced Malware Analysis

Sophos Zero-Day Protection provides additional defence against previously unknown malware, ransomware and emerging cyber threats.

Using machine learning and sandbox-based file analysis, suspicious files can be examined for malicious behaviour before they are allowed into the network.

This helps organisations detect threats that may not yet have traditional malware signatures.

Xstream TLS Inspection – Visibility into Encrypted Traffic

A significant proportion of modern internet traffic is encrypted using TLS. While encryption protects legitimate communications, attackers can also use encrypted connections to conceal malware and malicious activity.

Sophos Xstream TLS inspection allows organisations to inspect supported encrypted traffic for security threats.

The XGS 4580's dedicated acceleration architecture helps maintain network performance while applying security inspection policies.

DNS Protection

Sophos DNS Protection provides an additional layer of defence by blocking access to malicious domains associated with phishing, malware and command-and-control infrastructure.

Cloud-based DNS filtering helps protect users and devices against known dangerous destinations.

Central Orchestration and Advanced Reporting

Sophos Central Orchestration helps simplify the management of distributed firewall environments.

Capabilities include SD-WAN VPN orchestration, advanced central firewall reporting and integration with supported Sophos security services.

This is particularly useful for organisations managing multiple locations or large firewall deployments.

Active Threat Response and Security Integration

Sophos Active Threat Response allows the firewall to respond automatically to threat intelligence from Sophos security services and supported third-party threat feeds.

This enables coordinated threat containment, reducing the time between identifying a threat and blocking malicious communications.

Xstream Protection also includes NDR Essentials capabilities and integrations with supported Sophos MDR and XDR threat feeds.

Enhanced Support

Xstream Protection includes Sophos Enhanced Support, providing 24/7 access to Sophos technical support, firmware and feature updates, and eligible advance replacement hardware services under the applicable support terms.

Sophos Synchronized Security – Connecting Firewall and Endpoint Protection

One of the key advantages of the Sophos cybersecurity ecosystem is Sophos Synchronized Security, which enables compatible Sophos Firewall and Sophos Endpoint products to communicate and share security information.

Traditional security solutions often operate independently. Firewalls protect network traffic, while endpoint security software protects computers and servers.

When these systems are disconnected, threats may require manual investigation and coordination across multiple security tools.

Sophos Synchronized Security connects these layers, enabling faster detection, automated containment and improved visibility.

How Sophos Security Heartbeat Works

Sophos Security Heartbeat allows compatible endpoints to communicate their security status to the Sophos Firewall.

When an endpoint detects suspicious activity, malware or another security incident, its security status can change.

The firewall can then automatically restrict network connectivity for the affected device, helping prevent malware from spreading or communicating with other systems.

Once the endpoint has been remediated and its security status returns to normal, network access can be restored according to the configured security policies.

Benefits of Sophos Synchronized Security

• Automated threat containment: Helps isolate compromised endpoints and reduce lateral movement.
• Faster incident response: Enables the firewall and endpoint to coordinate their response.
• Greater security visibility: Helps administrators identify devices presenting potential security risks.
• Synchronized Application Control: Improves identification and control of applications running on protected endpoints.
• Reduced administrative workload: Automates selected responses that would otherwise require manual intervention.

Synchronized Security requires compatible Sophos Endpoint licensing and the appropriate Sophos Firewall security subscriptions.

Why Add Sophos Endpoint Security to the XGS 4580?

While the Sophos XGS 4580 protects network traffic, Sophos Endpoint Security protects the individual computers, laptops and servers used to access business applications and information.

This is particularly important for organisations with remote workers, cloud applications and mobile devices that may connect to the internet without passing through the corporate firewall.

Sophos Endpoint Security can provide:

• Anti-ransomware protection and malicious activity detection.
• Behavioural analysis and exploit prevention.
• Malware and malicious script protection.
• Endpoint detection and response capabilities, depending on the selected licence.
• Integration with Sophos Firewall for coordinated threat containment.

For organisations requiring additional security monitoring and investigation capabilities, Sophos Endpoint can also be complemented by Sophos Extended Detection and Response (XDR) or Sophos Managed Detection and Response (MDR).

Together, Sophos Firewall and Sophos Endpoint deliver a more comprehensive, layered security strategy, protecting both the network and the devices accessing business information.

Sophos XGS Firewall Range – Hardware and Performance Comparison

The following table compares the current second-generation desktop models and the full XGS rackmount range, including the four new models announced in November 2026.

Performance figures in Gbps. The wireless desktop variants share the performance specifications of their corresponding non-wireless models.

Sophos model	Form factor	Firewall throughput	Threat protection	TLS inspection
XGS 88 / 88w	Desktop	9.9	2.0	0.6
XGS 108 / 108w	Desktop	12.5	2.5	0.8
XGS 118 / 118w	Desktop	15.5	3.2	1.1
XGS 128 / 128w	Desktop	19.1	4.0	1.4
XGS 138	Desktop	19.1	4.7	1.7
XGS 2100	1U	30	5.6	2.0
XGS 2300	1U	39	5.9	2.1
XGS 2380	1U	59.8	23.3	8.0
XGS 3100	1U	47	8.3	3.2
XGS 3300	1U	58	12	3.7
XGS 3380	1U	80	32	9.5
XGS 4300	1U	75	28	9.0
XGS 4500	1U	80	34.75	10.6
XGS 4580	1U	105	45	12
XGS 5500	2U	110	46	13.5
XGS 5580	1U	112.5	58	16
XGS 6500	2U	120	60	18.1
XGS 7500	2U	160	70	19.5
XGS 8500	2U	190	92.5	24

Indicative published laboratory performance specifications. Figures should be checked against the latest model-specific Sophos datasheets before publication. First-generation desktop appliances are excluded.

Why Choose the Sophos XGS 4580?

The Sophos XGS 4580 offers a compelling combination of high firewall throughput, advanced threat protection, 25GbE connectivity and compact 1U design.

Compared with the XGS 4500, it provides significantly greater firewall and threat protection throughput, making it an attractive option for organisations planning higher-speed network connections or expanding their security inspection requirements.

The XGS 4580 also provides an alternative to larger 2U enterprise firewalls, delivering substantial processing capability in a smaller chassis.

For organisations considering the XGS 5580, the higher-end model provides additional performance headroom, particularly for advanced threat protection and TLS inspection.

Sophos XGS 4580 Technical Specifications

Specification	Sophos XGS 4580
Product type	Next-generation firewall security appliance
Form factor	1U rackmount
Processor architecture	x86 CPU with dedicated Xstream Flow Processor
Firewall throughput	105 Gbps
Threat protection throughput	45 Gbps
Xstream SSL/TLS inspection	12 Gbps
Integrated copper interfaces	8 × 2.5GbE
Integrated fibre interfaces	4 × 25GbE
Flexi Port expansion bays	2
Storage	Dual SSD with RAID 1
SSD serviceability	Field-replaceable, not hot-swappable
Redundant power supply	Optional
High availability	Supported
Operating system	Sophos Firewall OS
Management	Local firewall management; central management with eligible subscription

Hardware note: Unlike the XGS 5580, which includes redundant power supplies, the XGS 4580 supports an optional second internal power supply.

Frequently Asked Questions – Sophos XGS 4580

Does the Sophos XGS 4580 include a firewall licence?

Yes. The Sophos Firewall Base Licence is included with the appliance, providing essential firewall, VPN, routing and high-availability capabilities. Advanced security services require additional subscriptions.

Do I need Xstream Protection with the XGS 4580?

Xstream Protection is optional but recommended for organisations requiring comprehensive next-generation security. It adds intrusion prevention, web and application protection, zero-day threat detection, DNS Protection, advanced orchestration and Enhanced Support.

Can the Sophos XGS 4580 work with Sophos Endpoint?

Yes. With compatible licensing, Sophos Firewall and Sophos Endpoint can share threat information through Sophos Synchronized Security, helping automatically contain compromised devices and improve incident response.

Does the XGS 4580 support 25GbE networking?

Yes. The appliance includes four 25GbE fibre interfaces, eight 2.5GbE copper interfaces and two Flexi Port expansion bays for additional connectivity.

Does the Sophos XGS 4580 have redundant power supplies?

The XGS 4580 supports an optional second internal power supply for redundancy. Unlike the XGS 5580, the redundant supply is not included as standard.

What is the difference between the Sophos XGS 4580 and XGS 5580?

Both models feature a 1U rackmount design, dedicated Xstream Flow Processor, four 25GbE interfaces and dual SSD storage with RAID 1. The XGS 5580 provides higher firewall and threat protection throughput and includes redundant power supplies as standard.

Can the XGS 4580 be configured for high availability?

Yes. Two compatible Sophos XGS 4580 appliances can be deployed in supported high-availability configurations to improve network resilience and business continuity. Licensing and configuration requirements depend on the deployment.