Sophos XGS Firewalls Maintenance
side by side.
TechCare TPM vs. Sophos Hardware-Garantieverlängerung (an Subscription gekoppelt). Cost range, EOSL advantages, migration path and DACH compliance at a glance — for IT leadership and procurement.
Cost comparison
Example 40 XGS 2300 in HA pairs at 20 sites with NBD replacement: TechCare roughly 30–45 % below the hardware extension, for XG fleets without manufacturer option up to 70 % below a new purchase.
Which Sophos XGS models we service
- XGS desktop · 1st generation
- XGS 87 · XGS 87w · XGS 107 · XGS 107w · XGS 116 · XGS 116w · XGS 126 · XGS 126w · XGS 136 · XGS 136w
- XGS desktop · 2nd generation
- XGS 88 · XGS 108 · XGS 118 · XGS 128 · XGS 138 (jeweils auch w-Varianten)
- XGS 1U rack · mid-market
- XGS 2100 · XGS 2300 · XGS 3100 · XGS 3300 · XGS 2300 2. Gen
- XGS 2U rack · enterprise
- XGS 4300 · XGS 4500 · XGS 5500 · XGS 6500 · XGS 7500 · XGS 8500
- Flexi-Port modules and power supplies
- 8-Port 1GbE · 2/4-Port 10GbE SFP+ · 2-Port 40GbE QSFP+ · redundante Netzteile für 2U-Modelle
Manufacturer support status of major generations
| Generation | Released | End of vendor support | TechCare TPM |
|---|---|---|---|
| XGS 87 – 136 (1. Gen Desktop) | 2021 | aktiv | Supported |
| XGS 2100 – 3300 (1U) | 2021 | aktiv | Supported |
| XGS 4300 – 8500 (2U) | 2021 | aktiv | Supported |
| XGS 88 – 138 (2. Gen Desktop) | 2024 | aktiv | Supported |
Why TPM for Sophos XGS hardware
The XGS hardware warranty is tied to the subscription and ends with the licence term or the hardware-support end of the series. Many companies renew the licence but not the hardware cover — until a power supply or SSD fails.
We secure the appliance: replacement unit per SLA, cold spare for HA pairs and critical sites, Flexi-Port modules and power supplies, backup restore and guidance for licence transfer. Sophos Central, signatures and SFOS firmware stay with the manufacturer.
OEM vs. TechCare — where the switch pays off
The full OEM-vs-TPM matrix (spare parts, SLA tiers, language, sub-outsourcing, compliance docs, reporting) is the same for every Sophos line — see the Sophos battle card.
Stays with Sophos
- Firewall licence incl. transfer in Sophos Central, signatures, Xstream Protection
- Hardware base licence (ends with Sophos hardware EOL)
- Firmware releases (SFOS, UTM 9)
Moves to TechCare
- Appliance replacement or spare part per SLA (Parts Only, NBD, 24×7×4)
- Cold spares for HA pairs and critical sites
- Configuration restore from backup, guidance for licence transfer
- One contract for Sophos plus all other manufacturers
DACH compliance by design.
BAIT/MaRisk documentation package, DORA Art. 28 contract template, ISO 27001 and GDPR-compliant media handling apply identically to every Sophos line — details on the Sophos battle card.
Migration path from first contact to hand-over.
Same four steps for every Sophos line: inventory → fixed-price quote in 48 h → contract (BAIT/MaRisk/DORA hooks) → hand-over with spare-parts provisioning. Details on the Sophos battle card.
FAQ on Sophos XGS maintenance
- Do you service the firewall software or only the hardware?
- Only the hardware layer. Firewall licence, Xstream protection, signatures and Sophos Central continue via your subscription with the manufacturer. We make sure the appliance stays available.
- What happens to the Sophos licence when a unit is replaced — and what applies to XG and SG?
- Sophos allows licence transfer to an identical or equivalent model in your own Sophos Central account; the old unit is deregistered and then works only as a router. We deliver the replacement unit and guide the step; you or your Sophos partner perform the transfer. For XG and SG, additionally: the Sophos base licence ends with the hardware end-of-life in the Sophos retirement calendar, after which the appliance no longer filters. We therefore keep XG/SG under SLA until that date and plan the change with you. Our core business is hardware break-fix — licence, signatures and firmware stay with Sophos.
- Do you also take current devices into the contract, not only old ones?
- Yes. Model designation and serial number are all we need, regardless of age. We take current generations after the manufacturer warranty ends or in parallel as hardware cover.
- How is the licence transferred to the replacement unit?
- Via your Sophos Central or licensing portal to the new serial number; we prepare and guide the step. The licence remains yours.
- Which SLA tiers do you offer?
- Parts Only, 5×9 NBD and 24×7×4 — selectable per device and site. For 4-hour commitments we keep cold spares at the site.
- How quickly do we get a quote?
- 48 hours after receipt of your inventory with model, serial number and site.