Sophos XGS 5500
Unleash the full potential of your network

Zero-Touch Deployment

Zero-touch deployment enables the initial configuration to be performed in Sophos Central and then exported for loading onto the device from a flash drive at startup, automatically connecting the device back to Sophos Central.

SD-WAN Orchestration

Sophos Central makes interconnecting SD-WAN overlay networks between multiple Sophos Firewalls quick and easy. With just a few clicks you can setup a full mesh network, hub-and-spoke topology, or something in-between, and Sophos Central will automatically configure all the necessary VPN tunnel and firewall access rules to enable your SD-WAN network.

Security Heartbeat: Your firewall and your endpoints are finally talking

Sophos Firewall is the only network security solution that is able to fully identify the user and source of an infection on your network, and automatically limit access to other network resources in response. Our unique Security Heartbeat shares telemetry and health status between Sophos endpoints and your firewall and integrates endpoint health into firewall rules to control access and isolate compromised systems.

Synchronized Application Control

Using Security Heartbeat, we also have a solution to one of the biggest problems most network administrators face today – lack of visibility into network traffic.
Synchronized Application Control utilizes the Heartbeat connections with Sophos endpoints to automatically identify, classify, and control application traffic. All encrypted, custom, evasive, and generic HTTP or HTTPS applications which are currently going unidentified will be revealed.

Lateral Movement Protection

Lateral Movement Protection automatically isolates compromised systems at every point in the network to stop attacks. Healthy endpoints assist by ignoring all traffic from unhealthy endpoints, enabling complete isolation, even on the same network segment, to prevent threats and active adversaries from spreading or stealing data.

Synchronized User ID

User authentication is critically important in a nextgeneration firewall but often challenging to implement in a seamless and transparent way. Synchronized User ID eliminates the need for client or server authentication agents by sharing user identity between the endpoint and the firewall through Security Heartbeat.

Expose Hidden
Risks

Superior visibility into unknown applications, risky activity, suspicious traffic, and advanced threats helps you regain control of your network and get deeper insights.

Blocks unknown
threats

Powerful next-gen protection technologies like deep learning and intrusion prevention keep your organization secure from the latest hacks and attacks.

Automatically responds to incidents

Synchronized Security automatic threat response instantly identifies and isolates compromised systems on your network to prevent breaches and lateral movement.

Network Protection

• Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
• Xstream DPI engine: streaming deep-packet inspection
• IPS: Next-gen Intrusion Prevention
• ATP: Advanced Threat Protection
• Synchronized Security Heartbeat: integration with Sophos Endpoints to identify and isolate threats
• Clientless VPN: HTML5
• SD-RED VPN: Manage SD-RED devices
• Reporting: Extensive network and threat reporting

Web Protection

• Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
• Xstream DPI engine: streaming deep-packet inspection
• Web Control: by user, group, category, URL, keyword
• Web Threat Protection: malware, PUA, malicious JavaScript, pharming
• App Control: by user, group, category, risk, and more
• Synchronized App Control: integration with Sophos endpoints to identify unknown apps
• Synchronized SD-WAN: utilizing Synchronized App Control to route unknown apps
• Reporting: Extensive web and app reporting

Zero-Day Protection

• Xstream TLS Inspection: TLS 1.3 inspection with prepackaged exceptions
• Xstream DPI engine: streaming deep-packet inspection
• Zero-Day Threat Protection: analyze all unknown files using AI, ML, and sandboxing
• Powered by SophosLabs Intelix: cloud-based intelligence and analysis
• Machine Learning: using multiple deep learning models
• Cloud Sandboxing: dynamic runtime analysis of unknown files
• Reporting: Extensive threat intelligence analysis reporting

Sophos Central Management

• Group Firewall Management: Synchronized policy across firewall groups
• Backup and firmware updates: storage and scheduling
• Zero-touch deployment: for new firewalls from the cloud

Sophos Central Orchestration

• SD-WAN Orchestration: Point and click Site-to-Site VPN Orchestration
• Cloud Firewall Reporting: Multi-firewall reporting with save, schedule and export reports (30-day data retention)
• XDR and MDR Connector: Support for XDR and MDR services

XGS Series

Purpose-built devices to provide the ultimate in performance.

AWS/Azure

Protect your network infrastructure in the AWS or Azure cloud.

Virtual

Install on VMware, Citrix, Microsoft Hyper-V, and KVM.

Software

Install the Sophos Firewall OS image on your own Intel hardware or server.

Xstream SD-WAN and Networking

Includes all networking, routing, and SD-WAN capabilities including zone-based stateful firewall, NAT, VLAN, SDWAN profiles, performance-based WAN link selection and monitoring, load balancing, zero-impact WAN link transitions, and Xstream FastPath acceleration of trusted application traffic, IPSec VPN traffic, and TLS encrypted traffic flows.

VPN

Provides standards-based site-to-site and remote access VPN (free up to the capacity of the firewall) with support for IPsec and SSL. Sophos Connect remote access VPN client for Windows and Macs offers seamless and easy deployment and configuration options. SD-RED layer 2 siteto-site tunnels offers a light-weight robust VPN alternative.

Reporting

Extensive on-box reporting provides valuable insights into threats, users, applications, web activity, and much more. Note that specific reporting functionality may be dependent on other protection modules to get the full benefits (for example, Web Protection or web and app reports).

Xstream Architecture

Enables high performance TLS 1.3 inspection, deep-packet inspection, and network flow FastPath to accelerate trusted SaaS, SD-WAN, and cloud application traffic. Note that Network and Web Protection are required to get the full benefits of the Xstream Architecture.

Secure Wireless

Built-in wireless controller for Sophos APX wireless access points. Plug-and-play access point discovery makes setup easy. Support for multiple SSIDs, hotspots, guest networks, and the diverse encryption and security standards.

Next-Gen Intrusion Prevention System

Provides advanced protection from all types of modern attacks. It goes beyond traditional server and network resources to protect users and apps on the network as well.

Advanced Threat Protection

Instant identification and immediate response to today’s most sophisticated attacks. Multi-layered protection identifies threats instantly and Security Heartbeat provides an emergency response.

Security Heartbeat

Creates a link between your Sophos Central protected endpoints and your firewall to identify threats faster, simplify investigation, and minimize impact from attacks. Easily incorporate Heartbeat status into firewall policies to automatically isolate compromised systems.

Advanced VPN technologies

Adds unique and simple VPN technologies, including our clientless HTML5 self-service portal that makes remote access incredibly simple plus management for our exclusive light-weight secure SD-RED (Remote Ethernet Device) VPN technology.

Powerful user and group web policy

Provides enterprise-level Secure Web Gateway policy controls to easily manage sophisticated user and group web controls. Apply policies based upon uploaded web keywords indicating inappropriate use or behavior.

High-performance traffic scanning

Optimized for top performance, our Xstream SSL inspection provides ultra-low latency inspection and HTTPS scanning while maintaining performance

Application Control and QoS

Enables user-aware visibility and control over thousands of applications with granular policy and traffic-shaping (QoS) options based on application category, risk, and other characteristics. Synchronized Application Control automatically identifies all the unknown, evasive, and custom applications on your network.

Advanced Web Threat Protection

Backed by SophosLabs, our advanced engine provides the ultimate protection from today’s polymorphic and obfuscated web threats. Innovative techniques like JavaScript emulation, behavioral analysis, and origin reputation help keep your network safe.

Powered by SophosLabs

Powered by the industry-leading SophosLabs, the Zero-Day Protection subscription includes a fully cloud-based threat intelligence and threat analysis platform. This provides deep learning-based file analysis, detailed analysis reporting, and a threat meter to show the risk summary for a file

Threat Intelligence Analysis Reporting

Rich intelligence reports provide you with much more than just a ‘good,' ‘bad,' or ‘unknown’ verdict. Full insight into the nature and capabilities of a threat are delivered through the use of data science and SophosLabs research.

Dynamic File Analysis

Execute a file in a secure cloud-based sandbox to observe its behavior and intent. Screenshots provide added insight into any key events during the analysis.

Static File Analysis

By harnessing the power of multiple machine learning models, global reputation, deep file scanning, and more, you can quickly identify threats without the need to execute the files in real time.

Sophos Central SD-WAN Orchestration

Makes VPN orchestration easy. Wizard-based tunnel configuration helps create full mesh networks, hub-andspoke models, or complex tunnel setups between multiple firewalls a quick point-and-click exercise. Seamlessly integrates multiple WAN link and SD-WAN functionality and routing optimizations to improve resilience and performance and also integrates with user authentication and Synchronized Security Heartbeat to control access.

Central Firewall Reporting Advanced (30-day)

Cloud-based reporting with several pre-packaged common reports for threats, compliance, and user activity. Includes advanced options for creating custom reports and views with the option to save, schedule or export your custom reports. Includes 30 days of log data retention with the option to add additional storage for additional historical reporting needs.

MDR/XDR Connector

Sophos MDR provides optional 24/7 threat hunting, detection and response delivered by an expert team as a fully-managed service. Sophos XDR offers extended detection and response managed by your own team. Regardless of whether you manage it yourself, or Sophos manages it for you, your Sophos Firewall is ready to share the necessary threat intelligence and data to the cloud.

Integrated Message Transfer Agent

Ensures always-on business continuity for your email, allowing the firewall to automatically queue mail in the event servers become unavailable.

SPX Email Encryption

Unique to Sophos, SPX makes it easy to send encrypted email to anyone, even those without any kind of trust infrastructure, using our patent-pending password-based encryption technology.

Data Loss Prevention

Policy-based DLP can automatically trigger encryption or block/notify based on the presence of sensitive data in emails leaving the organization

Live Anti-Spam

Provides protection from the latest spam campaigns, phishing attacks, and malicious attachments.

Self-serve Quarantine

Gives employees direct control over their spam quarantine, saving you time and effort.

Business Application Policy Templates

Pre-defined policy templates let you protect common applications like Microsoft Exchange Outlook Anywhere or SharePoint quickly and easily.

Protection from the latest hacks and attacksn

With a variety of advanced protection technologies including URL and form hardening, deep-linking and directory traversal prevention, SQL injection and cross-site scripting protection, cookie signing and more.

Reverse proxy

With authentication options, SSL offloading, and server load balancing ensure maximum protection and performance for your servers being accessed from the internet.