SOPHOS XG558000ZZPCAU XGS 5580 Security Appliance

The Sophos XGS 5580 Security Appliance is a high-performance, next-generation firewall (NGFW) designed to protect large enterprises, data centres and organisations with demanding network security requirements. Powered by Sophos Xstream architecture and the advanced Sophos Firewall operating system, the XGS 5580 delivers powerful threat protection, high-speed network connectivity and comprehensive visibility into encrypted traffic.

Designed for organisations that cannot compromise on security or performance, the Sophos XGS 5580 combines advanced firewall capabilities, application control, intrusion prevention and centralised security management in a scalable enterprise platform. When combined with Sophos Xstream Protection, it provides an additional layer of defence against ransomware, malware, advanced cyber threats and malicious network activity.

The XGS 5580 also integrates with Sophos Endpoint Security through Sophos Synchronized Security, enabling firewalls and endpoints to share real-time threat intelligence, automatically isolate compromised devices and strengthen an organisation's overall cybersecurity posture.

Key Features and Benefits of the Sophos XGS 5580

High-Speed Xstream Firewall Performance

The Sophos XGS 5580 combines a powerful x86 processor with a dedicated Xstream Flow Processor to accelerate network traffic processing. This architecture helps organisations maintain high network performance while applying advanced security inspection.

Key performance specifications include:

Firewall throughput

112.5 Gbps

Threat protection

58 Gbps

IPsec VPN throughput

105 Gbps

Xstream SSL/TLS inspection

16 Gbps

Published laboratory performance figures. Actual throughput depends on traffic characteristics, enabled security services and configuration.

Avanet+1

25GbE Connectivity and Flexible Network Expansion

The XGS 5580 provides high-speed connectivity for demanding enterprise networks, supporting growing bandwidth requirements and modern network infrastructure.

• Eight integrated 2.5GbE copper interfaces for flexible network connectivity.
• Four integrated 25GbE fibre interfaces for high-bandwidth connections.
• Two Flexi Port expansion bays to accommodate additional network interfaces.
• Support for network segmentation, VLANs and multiple WAN connections.
• Scalable connectivity for enterprise networks, server environments and distributed organisations.

Enterprise Reliability and Redundancy

Built for business-critical environments, the Sophos XGS 5580 includes hardware features designed to improve availability, simplify maintenance and reduce the risk of service interruptions.

• Redundant power supplies included: Help maintain operation if a power supply fails.
• Dual SSD storage with RAID 1: Provides storage redundancy for improved resilience.
• Field-replaceable SSDs: Simplifies the replacement process without requiring the entire firewall appliance to be returned.
• 1U rackmount design: Integrates into standard enterprise network racks.
• High-availability support: Allows deployment in active-passive or supported active-active firewall configurations.

The XGS 5580 is particularly well suited to organisations that require high-speed security inspection and reliable operation without moving to a larger 2U firewall platform.

Sophos Firewall Base Licence – What's Included?

Every Sophos XGS 5580 includes the Sophos Firewall Base Licence, providing essential network security and connectivity features without requiring an additional security subscription.

The Base Licence provides the foundation for secure network operation, including:

Included feature	Description
Stateful firewall	Controls inbound and outbound traffic using firewall rules and connection tracking.
Network Address Translation (NAT)	Enables secure internal and external network connectivity.
VPN connectivity	Supports IPsec and SSL VPN connectivity for secure remote access and site-to-site networking.
SD-WAN capabilities	Provides routing and WAN connectivity features, including policy-based traffic steering.
VLAN and network segmentation	Separates networks and controls traffic between security zones.
High availability	Supports firewall redundancy configurations for business continuity.
Wireless functionality	Provides supported wireless network management capabilities.
Firewall RED	Enables supported remote Ethernet connectivity functionality.
Local management and reporting	Provides firewall configuration, monitoring, logs and local reporting.

Important: The Base Licence does not include the advanced security subscriptions required for intrusion prevention, comprehensive web and application protection, zero-day threat analysis or Security Heartbeat integration. Centralised firewall management and Sophos support services also have additional licensing requirements.

The Base Licence is therefore suitable for organisations needing essential firewall, routing and VPN functionality, while Xstream Protection is recommended where comprehensive next-generation threat prevention is required.

Sophos Xstream Protection – Advanced Threat Prevention and Security

Adding Sophos Xstream Protection transforms the XGS 5580 from a capable network firewall into a comprehensive next-generation cybersecurity platform.

Xstream Protection combines multiple security technologies into a single subscription, helping organisations detect, prevent and respond to increasingly sophisticated cyberattacks.

Network Protection and Intrusion Prevention (IPS)

Sophos Network Protection identifies and blocks malicious network activity before threats can compromise business systems.

Capabilities include intrusion prevention, advanced threat intelligence, Security Heartbeat and protection against known exploits and suspicious network traffic.

Web Protection and Application Control

Sophos Web Protection helps organisations control internet access, reduce exposure to malicious websites and manage application usage.

Administrators can apply web filtering policies, block risky websites, identify applications and restrict unauthorised network activity.

Zero-Day Protection and Sandboxing

Sophos Zero-Day Protection uses machine learning and sandbox analysis to identify previously unknown malware and suspicious files.

This provides an additional defence against ransomware, advanced malware and emerging threats that may evade traditional signature-based detection.

Xstream TLS Inspection

Encrypted traffic can conceal malware and other malicious activity. Sophos Xstream TLS inspection enables organisations to inspect supported encrypted connections for threats while maintaining high levels of network performance.

The XGS 5580's dedicated acceleration architecture helps reduce the performance impact of inspecting encrypted traffic.

DNS Protection

Sophos DNS Protection helps prevent users and devices from accessing malicious domains associated with phishing, malware and command-and-control infrastructure.

Central Orchestration and Reporting

Sophos Central Orchestration provides advanced SD-WAN VPN orchestration and enhanced reporting capabilities, helping administrators manage distributed firewall environments more efficiently.

Enhanced Support

Xstream Protection includes Sophos Enhanced Support, providing access to vendor technical support, software maintenance and eligible hardware replacement services in accordance with Sophos support terms.

Active Threat Response

Sophos Active Threat Response enables the firewall to act on threat intelligence from supported Sophos security services and third-party threat feeds, automatically blocking identified malicious activity.

This creates a more coordinated security environment, reducing the need for manual intervention when threats are detected.

Sophos Synchronized Security – Connecting Firewall and Endpoint Protection

One of the key advantages of the Sophos security ecosystem is Sophos Synchronized Security, which enables Sophos Firewall and compatible Sophos Endpoint Security products to communicate and share threat information.

Traditional security solutions often operate independently. A firewall protects the network perimeter, while endpoint software protects individual computers and servers. When these technologies are disconnected, threats can go undetected or require manual investigation across multiple systems.

Sophos Synchronized Security bridges this gap using Sophos Security Heartbeat technology.

How Sophos Security Heartbeat Works

When a Sophos-protected endpoint detects suspicious or malicious activity, it can communicate its security status to the Sophos Firewall.

The firewall can then automatically restrict network access for the affected device, helping prevent the threat from spreading to other systems.

Once the endpoint has been remediated and its security status returns to normal, network connectivity can be restored according to the configured security policies.

Benefits of Sophos Synchronized Security

• Automated threat containment: Restricts compromised endpoints to reduce lateral movement.
• Faster incident response: Enables coordinated action between endpoint and network security.
• Greater network visibility: Helps administrators identify devices presenting security risks.
• Synchronized Application Control: Helps identify and control applications that may otherwise be difficult to classify.
• Reduced administrative workload: Automates selected security responses that would otherwise require manual intervention.

Synchronized Security capabilities require compatible Sophos Endpoint licensing and the appropriate Sophos Firewall security subscriptions.

Why Add Sophos Endpoint Security to the XGS 5580?

While Sophos XGS 5580 protects traffic moving across the network, Sophos Endpoint Security protects individual computers, laptops and servers against threats that may originate inside or outside the corporate network.

This is particularly important for organisations with remote workers, mobile devices and cloud-based applications, where users may connect to services without traffic passing through the corporate firewall.

Sophos Endpoint Security can provide:

• Anti-ransomware protection and malicious activity detection.
• Behavioural analysis and exploit prevention.
• Protection against malware, malicious scripts and suspicious processes.
• Endpoint detection and response capabilities, depending on the selected licence.
• Integration with Sophos Firewall for coordinated threat containment.

For organisations requiring additional security monitoring, Sophos Endpoint can also be complemented by Sophos Extended Detection and Response (XDR) or Sophos Managed Detection and Response (MDR).

Together, Sophos Firewall and Sophos Endpoint provide a more comprehensive, layered security strategy, protecting both network traffic and the devices accessing business information.

Sophos XGS Firewall Range – Hardware and Performance Comparison

The following comparison covers the current second-generation desktop models and the full 1U and 2U rackmount ranges, including the four new XGS models announced in November 2026.

Throughput figures in Gbps, except where indicated.

Sophos model	Form factor	Firewall	Threat protection	TLS inspection
XGS 88 / 88w	Desktop	9.9	2.0	0.6
XGS 108 / 108w	Desktop	12.5	2.5	0.8
XGS 118 / 118w	Desktop	15.5	3.2	1.1
XGS 128 / 128w	Desktop	19.1	4.0	1.4
XGS 138	Desktop	19.1	4.7	1.7
XGS 2100	1U	30	5.6	2.0
XGS 2300	1U	39	5.9	2.1
XGS 3100	1U	47	8.3	3.2
XGS 3300	1U	58	12	3.7
XGS 2380	1U	59.8	23.3	8.0
XGS 4300	1U	75	28	9.0
XGS 3380	1U	80	32	9.5
XGS 4500	1U	80	34.75	10.6
XGS 4580	1U	105	45	12
XGS 5580	1U	112.5	58	16
XGS 5500	2U	110	46	13.5
XGS 6500	2U	120	60	18.1
XGS 7500	2U	160	70	19.5
XGS 8500	2U	190	92.5	24

 

Why Choose the XGS 5580 Over Other Sophos XGS Firewalls?

The Sophos XGS 5580 provides an attractive balance of performance, high-speed connectivity and hardware redundancy.

Compared with the XGS 4580, it delivers higher firewall throughput, greater threat protection capacity and faster TLS inspection performance.

Although the XGS 5500 and higher models provide larger 2U chassis options and additional expansion capacity, the XGS 5580 offers exceptionally strong performance in a compact 1U design.

For organisations evaluating enterprise firewalls, it is important to consider not only maximum firewall throughput but also threat protection performance, encrypted traffic inspection, port connectivity and future network growth.

Sophos XGS 5580 Technical Specifications

Specification	Sophos XGS 5580
Product type	Next-generation security firewall
Form factor	1U rackmount
Processor architecture	x86 CPU with dedicated Xstream Flow Processor
Firewall throughput	112.5 Gbps
Threat protection throughput	58 Gbps
NGFW throughput	44 Gbps
IPS throughput	48 Gbps
IPsec VPN throughput	105 Gbps
Xstream SSL/TLS inspection	16 Gbps
Integrated copper interfaces	8 × 2.5GbE
Integrated fibre interfaces	4 × 25GbE
Flexi Port expansion bays	2
Maximum network ports	28, including supported expansion modules
Storage	Dual SSD, RAID 1
SSD serviceability	Field-replaceable
Redundant power	Included
Operating system	Sophos Firewall OS
Management	Local firewall management; central management with eligible subscriptions

Frequently Asked Questions – Sophos XGS 5580

Does the Sophos XGS 5580 include a firewall licence?

Yes. The appliance includes the Sophos Firewall Base Licence, which provides essential firewall, VPN, routing and high-availability functionality. Advanced threat protection features require additional subscriptions.

Do I need Xstream Protection with the XGS 5580?

Xstream Protection is optional but recommended for organisations requiring comprehensive network security. It adds intrusion prevention, web filtering, zero-day protection, DNS protection, advanced orchestration and enhanced support.

Can the XGS 5580 work with Sophos Endpoint?

Yes. When appropriately licensed, Sophos Firewall and Sophos Endpoint can share security information through Sophos Synchronized Security, enabling coordinated threat detection and automated containment.

Does the XGS 5580 support 25GbE networking?

Yes. The XGS 5580 includes four 25GbE fibre interfaces, eight 2.5GbE copper interfaces and two Flexi Port expansion bays.

Can two XGS 5580 firewalls be configured for high availability?

Yes. Sophos Firewall supports high-availability configurations to improve business continuity and reduce downtime. Deployment requirements and licensing depend on the selected HA configuration.

What is the difference between the Sophos XGS 5580 and XGS 5500?

The XGS 5580 is a newer 1U appliance offering higher published threat protection throughput than the XGS 5500. The XGS 5500 uses a larger 2U chassis with additional physical expansion capacity. Selection should be based on inspection performance, interface requirements and redundancy needs.