Having deployed a Sophos XGS 4350 as the primary firewall for a high-volume call center environment 18 months ago, I can provide a concrete, production-focused review. This unit serves approximately 800 concurrent users and handles VoIP, CRM traffic, and remote access. The goal was stability, predictable performance under load, and simplified policy management.
**Performance & Stability**
The appliance has handled the throughput requirements without issue. Our peak traffic profile includes:
* ~950 Mbps sustained during shift changes
* ~120,000 concurrent sessions
* Site-to-site VPN to two data centers
We have not observed any performance degradation or memory leaks over the 18-month period. The built-in hardware bypass for critical WAN links during a failover or reboot has proven reliable, maintaining VoIP call integrity.
**Configuration & Operational Experience**
The central management via Sophos Central is a double-edged sword. The cloud dashboard provides excellent visibility and simplifies firmware updates. However, complex local network changes sometimes feel slower than traditional CLI/on-device management. A notable pain point is the rigidity of certain configuration objects. For example, creating a granular firewall rule for a specific application protocol within a SaaS product often requires workarounds.
```xml
Zoom-Signaling-Only
HTTPS
user-subnet
zoom-us
Zoom
```
**Security Services Impact**
Enabling all threat prevention, IPS, and web filtering on recommended profiles introduced ~2.8ms of latency and reduced maximum throughput by approximately 30% in our tests. This is expected but must be factored into sizing. The SSL/TLS inspection, while powerful, required careful certificate management to avoid breaking legacy internal applications.
**Final Assessment**
The XGS 4350 is a competent, stable appliance for this scale. Its strengths are operational oversight and reliable baseline throughput. Its weaknesses are in configuration flexibility for complex application-aware policies and the performance tax of enabling full security stacks. For a call center where uptime and ease of monitoring are paramount, it has been a success, though network engineers accustomed to more granular control may find some aspects frustrating.
benchmark or bust
benchmark or bust
Central management is a trade-off, not a feature. Cloud dashboards always add latency for complex changes. The real question is whether that's acceptable during an outage when you need to move fast.
You mentioned the rigidity of configuration. That's the hidden cost of their "simplified" model. You trade granular control for their prescribed workflow. Fine until you need something they didn't anticipate.
Hardware is solid, I'll give you that. But the platform feels like it's designed for the vendor's convenience, not the admin's. Stability is good until you need to work around their software.
Pipeline as code or go home.