We take cryptocurrency — so the coins you hold can buy real hardware.Pay in crypto, spend it on real hardware. Free insured shipping worldwide over $399. Plain, unbranded boxes, sent from Germany.Free insured shipping over $399. Your rate is locked for 30 minutes once checkout opens.Rate locked 30 minutes. Every item sealed, serial-checked and covered by a 24-month warranty.Sealed, 24-month warranty.

Saved items Sign in
Sophos XGS 138 desktop firewall appliance, matte black metal case with front port array

Sophos

Sophos XGS 138 XX138Z12ZZPCUS firewall appliance

SKU CH-GJMZ-X33FP MPN XX138Z12ZZPCUS

Desktop firewall appliance with 4×GE, 2×2.5GE and 2×SFP+ ports, 19,100 Mbps firewall throughput and 1,700 Mbps TLS inspection, bundled with one year Xstream Protection licensing

  • Port count4 x GE copper 2 × 2.5GE copper 2 x SFP+ fiber 1 x COM RJ45 1
  • Appliance typeFirewalls / Security Appliances
  • Ethernet speed2.5 Gigabit Ethernet
  • Product typeWired
  • Key featuresForm Factor: Desktop CPU: AMD x86 CPU Memory: 8 GB DDR4 Xstr
  • Product dimensions320 × 212 × 44 mm

Model XGS 138

Model 1-Year Xstream Protection

  • TLS 1.3 inspection reveals hidden threats in encrypted traffic
  • Zero-day protection blocks unknown malware with machine learning and sandboxing
  • FastPath acceleration offloads trusted traffic to boost throughput
  • SD-WAN orchestration simplifies multi-link branch connectivity
  • Desktop fanless design runs silently in noise-sensitive spaces

Purpose and audience

The Sophos XGS 138 is a desktop firewall appliance with 8 GB DDR4 system memory, 4 GB DDR4 NPU memory and a 64 GB M.2 SSD. It delivers 19,100 Mbps firewall throughput and 1,700 Mbps TLS 1.3 inspection for small to mid-size sites that need encrypted-traffic visibility and zero-day sandboxing.

Pre-installation checks

Verify that your rack or bench can accommodate a 320 x 212 x 44 mm fanless chassis weighing 2.4 kg. Confirm you have SFP+ transceivers for the two fiber ports and that your ISP handoff matches the 2.5GBase-T or 1000Base-T copper interfaces. No expansion slots are present, so all connectivity is fixed.

Build and daily use

The fanless aluminum enclosure runs silently in offices or wiring closets with an MTBF of 200,091 hours. Four RJ-45 GE ports, two 2.5GBase-T ports and two SFP+ cages handle WAN, LAN and DMZ links while front USB 2.0 and rear USB 3.0 ports allow quick log export or license-key import. Dual COM ports (RJ-45 and micro-USB) give console access without adapters.

How it compares

Measured against everything we stock in Firewall Appliances & VPN Gateways, at today’s prices. Recalculated every night.

Price $2,318.99
Pricier than about 78% of the 669 comparable items (median $806.99).

Specifications

Product
Brand nameSophos
Product lineXGS
Model nameXGS 138
Part numberXX138Z12ZZPCUS
Appliance typeFirewalls / Security Appliances
Product typeWired
Connectivity
Wireless typeNone
Ethernet speed2.5 Gigabit Ethernet
Ports & slots
Port count4 x GE copper
2 × 2.5GE copper
2 x SFP+ fiber
1 x COM RJ45
1 x COM Micro-USB (cable included)
1 x USB 2.0 (front)
1 x USB 3.0 (rear)
Size & build
Product dimensions320 × 212 × 44 mm
Product weight2.4 kg / 5.29 lb (unpacked)
4.4 kg / 9.7 lb (packed)
Shipping weight2.27 kg
Package size376 × 269 × 135 mm

Other versions of this model

5 more in the same range

Questions about this item

What cables and accessories ship with the XGS 138 appliance?

The box includes the appliance, a COM Micro-USB cable, a power cord, a rack-mount kit and a quick-start guide. No SFP+ transceivers or fiber patch cables are supplied.

Should I choose the Xstream Protection bundle or the Standard Protection bundle for this model?

Xstream Protection adds Zero-Day Protection, DNS Protection, MDR and third-party threat feeds, NDR Essential Protection and Enhanced Support on top of the Base, Network, Web and Central Orchestration licences.

What does the 1700 Mbps TLS inspection figure mean for daily traffic?

It is the maximum sustained throughput when the appliance decrypts and inspects TLS 1.3 sessions. Encrypted traffic above that rate will bypass inspection unless policies are adjusted.

More in Firewall Appliances & VPN Gateways

Similar items