Description
Sophos XGS 87 Firewall — Next-Generation Firewall
Introduction
The Sophos XGS 87 is a desktop next-generation firewall designed to provide network security and connectivity for small businesses, branch offices, and similar distributed environments. It belongs to Sophos’ first-generation XGS desktop firewall family and combines a high-speed CPU with the dedicated Xstream Flow processor for hardware acceleration.
The appliance provides 4 × Gigabit Ethernet copper ports and 1 × Gigabit SFP fiber interface, giving organizations both copper and fiber connectivity options. The SFP interface supports separately purchased transceivers, allowing the appliance to adapt to supported network media requirements.
The Sophos XGS 87 supports security functions including firewall protection, IPS, IPsec VPN, and TLS inspection. Sophos lists firewall throughput of up to 3,850 Mbps, IPsec VPN throughput of up to 3,000 Mbps, and TLS inspection throughput of up to 375 Mbps under its stated test conditions.
For organizations purchasing this model, availability should also be considered because Sophos currently identifies the XGS 87 as a first-generation model available as long as stock lasts.
Key Features of Sophos XGS 87
1. Xstream Flow Processor
The Sophos XGS 87 combines a high-speed CPU with Sophos’ dedicated Xstream Flow processor. This architecture provides hardware acceleration for suitable traffic while retaining the flexibility of an x86-based firewall platform.
2. Gigabit Ethernet Connectivity
The appliance includes 4 × Gigabit Ethernet copper interfaces for connecting LAN, WAN, and other network segments.
3. 1G SFP Connectivity
One 1G SFP fiber interface provides an option for fiber-based network connectivity. Sophos specifies that SFP transceivers are sold separately.
4. Advanced Network Protection
The XGS 87 supports multiple security functions, including firewall protection, intrusion prevention, IPsec VPN, and TLS inspection. These capabilities allow the appliance to protect traffic while supporting secure remote and site-to-site connectivity.
5. Desktop Form Factor
The XGS 87 uses a compact desktop design suitable for environments where a larger rackmount firewall is not required. Sophos documentation also identifies wall, rack, and DIN-rail mounting options.
6. Optional Wireless Model
The XGS 87 is also available in the XGS 87w variant with integrated Wi-Fi 5. The standard XGS 87 does not include built-in wireless connectivity.
Technical Specifications
| Category | Sophos XGS 138 | Typical Use |
| Firewall Throughput | 19.1 Gbps | High-speed network traffic |
| Interfaces | 2 × 10GbE SFP+, 4 × GE, 2 × 2.5GbE PoE | High-speed fiber, standard LAN & powered devices |
| IPS / Threat Protection | 5.85 Gbps IPS / 4.75 Gbps Threat | Advanced security & intrusion prevention |
| IPsec VPN | 6.6 Gbps | Site-to-site & remote VPN |
| Expansion & Power | 1 bay (Optional Gen.2 5G), Optional 2nd PSU | Cellular WAN backup & power redundancy |
Sophos’ official documentation specifies the XGS 87’s four Gigabit Ethernet interfaces, one 1G SFP interface, 4 GB DDR4 main memory, 2 GB DDR4 NPU memory, 16 GB eMMC storage, and 230 × 205.5 × 44 mm dimensions.
Performance Overview
| Performance Metric | Sophos XGS 87 |
| Firewall | Up to 3,850 Mbps |
| Firewall IMIX | Up to 3,000 Mbps |
| IPsec VPN | Up to 3,000 Mbps |
| IPS | Up to 1,200 Mbps |
| NGFW | Up to 700 Mbps |
| Threat Protection | Up to 850 Mbps |
| TLS Inspection | Up to 375 Mbps |
Sophos notes that these are maximum throughput measurements obtained under specified test conditions, and actual performance can vary depending on network conditions and activated security services.
Connectivity and Interface Options
The Sophos XGS 87 provides a combination of copper and fiber connectivity for small network deployments.
4 × Gigabit Ethernet
Four RJ45 Gigabit Ethernet ports provide the primary wired connectivity for network segments and connected infrastructure.
1 × 1G SFP
The dedicated SFP interface provides a fiber connectivity option when paired with a compatible SFP transceiver. Sophos states that transceivers are sold separately.
Management Connectivity
The appliance includes both an RJ45 COM port and a Micro-USB COM interface for console access. It also provides USB 2.0 and USB 3.0 interfaces for supported peripherals.
Why Choose Sophos XGS 87?
1. Advanced Firewall Protection
The XGS 87 combines firewall capabilities with additional security services such as IPS, VPN, and TLS inspection for broader network protection.
2. Hardware-Accelerated Architecture
Its Xstream Flow processor is designed to accelerate suitable traffic at the hardware level while the main CPU handles other firewall functions.
3. Flexible Connectivity
Four Gigabit Ethernet ports and one 1G SFP interface provide both copper and fiber connectivity options.
4. Compact Deployment
The desktop form factor makes the XGS 87 suitable for locations that do not require a conventional 1U or larger rackmount firewall.
5. VPN Connectivity
With IPsec VPN throughput rated up to 3,000 Mbps under Sophos’ test methodology, the appliance can support secure VPN connectivity for appropriate deployments.
6. Multiple Mounting Options
Sophos documentation lists wall, rack, and DIN-rail mounting for the XGS 87, allowing deployment in different physical environments.
Typical Use Cases
1. Small Business Network Security
The XGS 87 can be deployed as the central firewall for smaller business networks that need integrated security and routing functions.
2. Branch Office Protection
Its desktop form factor and multiple mounting options make it suitable for branch locations where space and deployment flexibility are important.
3. Secure Internet Gateway
The appliance can be positioned at the network edge to inspect and control traffic between internal networks and external connections.
4. Site-to-Site VPN
Organizations can use the XGS 87 for IPsec VPN connectivity between offices and other supported network environments.
5. Fiber Connectivity
The 1G SFP interface can be used when a supported fiber connection is required.
6. Retail and Distributed Locations
The compact design can suit retail outlets and other distributed sites requiring centralized network security capabilities.
Sophos XGS 87 vs XGS 87w
The XGS 87 and XGS 87w share the same core platform, but the wireless variant includes integrated Wi-Fi.
| Feature | XGS 87 | XGS 87w |
| 4 × GE Copper | Yes | Yes |
| 1 × 1G SFP | Yes | Yes |
| Built-in Wi-Fi | No | Yes |
| Wi-Fi Standard | N/A | Wi-Fi 5 / 802.11ac |
| Wi-Fi MIMO | N/A | 2×2:2 |
| External Antennas | N/A | 2 |
| Desktop Form Factor | Yes | Yes |
Sophos identifies the XGS 87w as the wireless version with Wi-Fi 5, 2×2:2 MIMO, and two external antennas.
Installation and Deployment
The Sophos XGS 87 can be deployed on a desktop, wall, rack, or DIN-rail installation depending on the environment and available mounting accessories. Sophos’ hardware documentation lists these mounting options for the XGS 87.
For rack installation, Sophos provides a dedicated rackmount kit for the XGS 87/87w and XGS 107/107w. The official mounting instructions state that the kit is specifically designed for these models and includes mounting brackets and power adapter trays.
When installing the appliance in a rack, ensure sufficient airflow, appropriate mechanical support, and suitable operating conditions. Sophos’ rackmount safety guidance specifically highlights airflow, mechanical loading, circuit loading, and reliable earthing considerations.
Sophos XGS 87 Accessories
The XGS 87 can be complemented by supported accessories depending on the installation requirements.
SFP Transceivers
The built-in 1G SFP interface can use compatible SFP transceivers for fiber or copper connectivity. Sophos lists SFP transceivers as an optional add-on for the XGS 87.
Rackmount Kit
A dedicated rackmount kit is available for the XGS 87/87w and XGS 107/107w. It provides mounting brackets and power adapter trays for rack deployment.
Mounting Hardware
Depending on the installation environment, appropriate mounting hardware may be required for rack, wall, or DIN-rail deployment.
Benefits for IT Teams
The Sophos XGS 87 provides a compact security appliance for organizations that need firewall protection without deploying a larger rackmount platform.
Key benefits include:
- Compact desktop form factor
- 4 × Gigabit Ethernet interfaces
- 1 × 1G SFP interface
- Hardware-accelerated Xstream architecture
- Integrated firewall, IPS, VPN, and TLS inspection capabilities
- Multiple physical mounting options
- Dedicated rackmount accessory availability
- Support for compatible SFP transceivers
- Suitable for small business and branch deployments
Who Should Buy Sophos XGS 87?
The Sophos XGS 87 can be considered by organizations looking for a compact Sophos Firewall appliance for small offices, branch locations, retail environments, or other distributed deployments.
It is particularly relevant where four Gigabit Ethernet interfaces and one SFP interface provide sufficient connectivity and where a desktop-sized firewall is preferred over a larger rackmount appliance.
Because Sophos currently lists the XGS 87 among its first-generation models available as long as stock lasts, buyers should verify current availability before purchasing.
Organizations comparing current-generation hardware may also want to review the newer XGS desktop range, which includes the XGS 88/88w, XGS 108/108w, XGS 118/118w, XGS 128/128w, and XGS 138.
Sophos XGS 87 Selection Guide
For Small Offices
Consider the XGS 87 when the deployment requires a compact firewall with Gigabit Ethernet connectivity and standard Sophos security capabilities.
For Fiber Connectivity
Use the integrated 1G SFP interface with a compatible transceiver when the network requires fiber connectivity.
For Rack Installation
Use the dedicated XGS 87/87w rackmount kit rather than relying on a generic shelf or mounting solution.
For Wireless Requirements
If built-in wireless connectivity is required, compare the XGS 87 with the XGS 87w variant.
For New Deployments
Check current Sophos availability because the XGS 87 is a first-generation model that Sophos currently identifies as available while stock lasts.
Always Verify
Confirm the exact hardware model, software requirements, licensing, accessory compatibility, and current availability before placing an order.
Frequently Asked Questions
What is Sophos XGS 87?
The Sophos XGS 87 is a first-generation desktop next-generation firewall designed for small businesses, branch offices, and distributed network environments.
How many Ethernet ports does Sophos XGS 87 have?
The XGS 87 has 4 × Gigabit Ethernet copper ports and 1 × 1G SFP interface.
Does Sophos XGS 87 have Wi-Fi?
The standard XGS 87 does not include built-in Wi-Fi. Sophos offers the XGS 87w variant with integrated Wi-Fi 5.
Does XGS 87 support SFP?
Yes. The XGS 87 includes one 1G SFP interface, and compatible SFP transceivers are sold separately.
Can Sophos XGS 87 be rack mounted?
Yes. Sophos provides a dedicated rackmount kit for the XGS 87/87w and XGS 107/107w models.
What is the firewall throughput of Sophos XGS 87?
Sophos lists firewall throughput of up to 3,850 Mbps under its specified test methodology.
What is the IPsec VPN throughput of XGS 87?
Sophos lists IPsec VPN throughput of up to 3,000 Mbps under its stated test conditions. Actual performance depends on network conditions and enabled services.
Is Sophos XGS 87 still available?
Sophos currently lists the XGS 87 under its first-generation XGS desktop models and states that these models are available as long as stock lasts. Current availability should therefore be confirmed before ordering.
What is the difference between XGS 87 and XGS 88?
The XGS 87 is a first-generation model with 4 × Gigabit Ethernet ports and 1 × 1G SFP interface. The newer XGS 88 is a second-generation model with 4 × 2.5 Gigabit Ethernet ports and a newer platform architecture.
