I'm currently evaluating Sophos XGS for a planned SD-WAN rollout across approximately 50 retail branch locations. Each site will have 2-3 primary internet circuits (mix of fiber, cable, LTE backup) and need to support POS traffic, inventory sync, and video surveillance backhaul.
My main interest is in raw performance data and operational overhead at scale. I've run some basic lab benchmarks on an XGS 3300, but I'm looking for real-world deployment metrics, especially regarding the SD-WAN logic and HA failover.
Key questions for anyone running a similar deployment:
* **Control Plane Management:** How is the Central Management experience with 50+ nodes? Any latency in policy push or config sync? We're looking at using Sophos Central.
* **SD-WAN Performance:** What's the actual packet loss/duplication/jitter detection sensitivity? Have you measured failover times for a VoIP stream during a circuit outage?
* **Throughput with Features:** Our required baseline is 500 Mbps per site with all security features enabled (IPS, SSL Inspection, Application Filter). Are you seeing the claimed throughput numbers in production, or a significant drop?
* **Automation & IaC:** How are you handling templated deployments? Any APIs or methods for zero-touch provisioning? I'm particularly interested in avoiding manual per-device config.
Example of a simple health check probe I'm testing in the lab:
```
# Custom SD-WAN rule to monitor critical SaaS endpoint
sdwan-health-check {
name "Sales-API-Probe"
target api.salesplatform.com
probe-type https
interval 10
threshold 3
timeout 2000
}
```
I'd appreciate any hard numbers on:
* Config deployment time per device.
* CPU/Memory utilization at steady state with your feature set.
* Any observed scaling limits in Central (e.g., maximum rules per policy before management becomes sluggish).
Also, pitfalls to avoid in the staging and rollout phases would be invaluable. We're comparing this against Fortinet and Palo Alto, so concrete data points are crucial.
Numbers don't lie
Hold on, have you actually built your test plan around a lab unit's benchmarks? The XGS 3300 datasheet numbers and real-life, feature-on throughput are two completely different universes.
> 500 Mbps per site with all security features enabled (IPS, SSL Inspection, Application Filter)
You will not get that. Not consistently. Expect a 40-60% drop when you flip on full SSL inspection across 50 sites. The control plane in Sophos Central gets sluggish around 30-40 nodes for config pushes; for 50+, you're looking at staged deployments unless you enjoy watching paint dry.
Before you ask about failover times, define what constitutes an "outage" for your SD-WAN logic. The default sensitivity thresholds are often too lenient for POS traffic. Have you mapped your specific app traffic to the SD-WAN rules, or are you just trusting the default "optimize for voip" profile? That's usually the first postmortem finding.
- Nina