Sophos XGS 128 Gen 2 Review: Multigigabit Ports, Policy-Dependent Capacity

The platform fit is more valuable than an isolated benchmark

Cartennas would consider the XGS 128 for a branch whose operators already use Sophos Firewall or have chosen that management and security approach deliberately. Consistent policy administration and a familiar support workflow can make the appliance more useful than a slightly cheaper platform that creates a separate operating burden.

The benefit depends on the organization actually using the supported protection and managing its exceptions. A powerful appliance with poorly understood rules can still interrupt a business application or leave important traffic outside the intended policy. The purchase should assign ownership for that work, rather than treat deployment as a one-time configuration exercise.

The TLS figure changes the sizing conversation

Sophos lists 19.1Gbps firewall throughput, 4Gbps threat protection and 1.45Gbps TLS inspection for the XGS 128. The published methodology uses different traffic and security conditions for each. TLS inspection is tested with IPS enabled on HTTPS sessions; the basic firewall test does not represent that same processing task.

A branch with a multigigabit internet circuit and broad decryption requirements should therefore focus on the encrypted workload. A 2.5GbE link can negotiate successfully while the selected security policy becomes the practical throughput constraint. Port speed demonstrates interface capability, not application capacity with every protection enabled.

Cartennas would define the important encrypted applications and expected concurrency before judging headroom. A result measured with the actual inspection policy is a stronger basis for approval than multiplying the number of users by a generic per-user allowance.

Gen 2 is not one processor design

Sophos identifies the XGS 88 through XGS 128 as single-CPU appliances using virtual FastPath with SFOS 21 or later. The XGS 138 uses a dedicated Xstream Flow processor and includes 10GbE SFP+ interfaces. Statements about a separate acceleration processor on another XGS model should not be copied into an XGS 128 review.

The implication is to compare the documented behavior of the exact model. A buyer needing a native 10GbE fiber connection has a different requirement from a branch with several 2.5GbE copper handoffs. A family-wide performance claim cannot resolve that distinction.

The ISP handoff can defeat a faster firewall

A January 2026 discussion concerned an XGS 128 running SFOS 21.5.1 whose provider proposed two 1Gbps fiber connections for a faster service. The discussion distinguished a provider-supported aggregated handoff from two separately addressed WAN services. The requester intended to push for one physical higher-speed connection.

This is an important purchasing distinction. Distributing separate sessions across two connections does not automatically make one session twice as fast. Nor does a firewall's link-aggregation capability prove that the provider has supplied a compatible service. Cartennas would obtain the actual handoff specification, including media, addressing and aggregation behavior, before finalizing the hardware design.

Application reports reveal a different acceptance problem

A May 2026 XGS 128 operator reported intermittent cloud-voice failures after implementation. Direct access through the upstream router restored calls, while changes to helpers and UDP timers had not resolved the protected path. Replies proposed several configuration checks, but the thread did not establish the original deployment's root cause.

The report is evidence of an application problem in one configuration, not proof that XGS 128 hardware cannot support voice. Its useful lesson is that usable service must be tested through the intended policy. A successful internet speed test cannot establish that call setup, media, reconnects and long-lived sessions will behave correctly.

Cartennas would investigate the actual dropped or rejected traffic against the voice provider's documented requirements. Broadly removing security services may isolate a cause during a controlled investigation, but it should not become the permanent outcome of a security-appliance purchase.

Resilience is an ordered configuration

The XGS 128 supports an optional second power supply and an optional Gen 2 5G module; built-in wireless belongs to the 128w variant. These choices address different failures. A cellular path can preserve connectivity after a fixed-circuit outage, while a second supply can address a particular power-source failure.

Neither feature protects every part of the service. Cellular coverage and capacity must support the priority applications, and two supplies on one failing electrical source retain that dependency. The complete configuration should identify which interruption each additional component is intended to reduce.