FortiGate 90G vs Sophos XGS 128 Gen 2: Compare the Protected Workload

Begin with the traffic the firewall must inspect

Basic firewall forwarding is a poor sizing metric for a branch that will decrypt traffic, identify applications and apply threat controls. The useful workload includes the services that will remain enabled in production, along with the number and behavior of concurrent sessions.

Fortinet publishes separate threat-protection and SSL-inspection figures for the 90G. Sophos separately publishes firewall and TLS-inspection results for the XGS 128 Gen 2. The labels and test methods differ, so placing the largest numbers in one column creates a misleading comparison.

Cartennas would compare the same intended traffic policy on a workload-sized configuration. If encrypted traffic dominates the branch, a bare firewall number can obscure the capacity that matters most.

Interfaces and architecture change the installation

The 90G is the more natural candidate when the physical design requires its 10G interfaces. Those shared-media pairs are not four independent 10G ports. The XGS 128's copper layout may fit a different branch without requiring the same media or adapters.

Neither interface arrangement establishes the speed of a fully inspected application. A faster socket is useful only when the appliance and policy can sustain the required workload through it.

Remote access can decide the software path

FortiOS changes have removed SSL-VPN tunnel mode from the relevant newer release path. An older 90G datasheet's SSL-VPN performance figure therefore should not be treated as a durable promise that the same workflow exists in every current release.

An organization depending on that workflow needs a supported migration design, including client software, authentication and access policy. Buying the appliance first and discovering the remote-access change during deployment can turn an ordinary refresh into a separate user migration.

The Sophos alternative should receive the same scrutiny for the actual remote-access and identity design. Brand familiarity does not replace validation of the chosen release and client combination.

Operator reports are most useful when they expose acceptance gaps

90G owners have described stable deployments on particular older FortiOS releases, including routing and overlay use. Those reports show that real configurations can work well; they do not certify an arbitrary later release or another site's policy.

A May 2026 XGS 128 report described cloud-voice problems that disappeared on a direct upstream connection. The discussion did not establish a root cause. It is a reason to exercise call setup, media and reconnect behavior through the intended policy, not evidence that the hardware cannot support voice.

The comparison should therefore include application behavior under protection. A fast download through either firewall leaves important questions unanswered if calls fail, remote sessions cannot reconnect or authentication behaves differently after failover.

Choose the appliance the team can operate successfully

Favor the 90G when its interfaces and Fortinet integration fit the branch, with a supported remote-access design and suitable logging. Favor the XGS 128 Gen 2 when its interface layout and Sophos operating environment better match the application and support requirements.

On either side, include subscriptions, administrative effort and the recovery path in the delivered cost. A slightly lower hardware quote loses its advantage quickly if the support team cannot diagnose policy behavior or restore the site predictably.

The final decision should come from a protected-workload pilot with the important applications. That produces a stronger recommendation than declaring a winner from incomparable marketing throughput figures.