After six months of running an XGS 4500 where a Meraki MX250 used to live, I'm convinced most reviews are written by people who've never had to migrate a real network or look at a bill. The fanfare about "unified" and "intuitive" usually means they've hidden the complexity in a subscription.
Let's start with the obvious: cost. Meraki's licensing is a straightjacket, but you know that going in. The XGS hardware is cheaper upfront, but the operational tax is different. You'll spend more time configuring it to behave. The WebAdmin interface is a maze compared to Meraki's slick dashboard. Want to create a firewall rule that does simple source NAT? On Meraki, it's a checkbox. On Sophos, you're diving into a separate NAT policy section with its own logic. Example from our migration:
```
# Meraki: "Use VPN concentrator" checkbox.
# Sophos XGS: Required a firewall rule with matching NAT rule.
# Firewall Rule: LAN_subnet -> WAN, service any, allow.
# NAT Rule: Source translation, Original source: LAN_subnet, Translated source: "MASQ" or specific IP.
```
Two policies to manage for one intent. It's not harder, just more verbose and prone to misalignment.
Performance is a wash for our 1Gbps circuit. Both handle it. Where the XGS shows its teeth is in the application layer inspection. It's more granular, but the logging is so verbose it's almost useless without a dedicated syslog server. The Meraki's high-level summaries were often more actionable for day-to-day issues.
The biggest pitfall? The "cloud management" promise. Sophos Central is lightweight compared to Meraki's full stack control. If you're deep in the Meraki ecosystem (switches, APs), leaving feels like amputating a limb. The XGS is a standalone box; integration is on you via APIs or manual config. Their API is functional but clunky, requiring you to understand the internal object model. Don't expect the simple REST calls of the Meraki dashboard API.
So you get flexibility and avoid the license=doorstop scenario, but you trade it for administrative overhead and a less cohesive story. Good if you have the team to manage it, a nightmare if you're a small shop that loved the single pane of glass, even if it was a walled garden.
Just my 2 cents
Just my 2 cents
I'm a devops lead at a 150-person fintech shop that runs hybrid cloud, and I manage the on-prem network that handles our user auth and PCI traffic. We've had an MX84 for our office and a Sophos XG 230 (previous gen) in a colo for a couple of years.
* **Real Cost vs. Time Tax:** You're right about the subscription straightjacket. At our scale, Meraki licensing was roughly $1,300/year for the MX84. The Sophos hardware was cheaper, but the "Advanced Security" license for full features is still $700-$900/year. The real difference is the 15-20% more admin time I budget for any Sophos config change versus Meraki's dashboard.
* **Complexity of Intent:** Your NAT example hits home. On Meraki, a "Site-to-site VPN" is a 5-minute wizard. On Sophos, achieving the same meant building firewall rules, address objects, *and* a separate VPN policy. It's more flexible for edge cases (like forcing traffic out a specific IP), but for 90% of simple needs, it's just verbose. I've seen configs break after firmware updates because of rule ordering, which Meraki abstracts away.
* **Performance Floor vs. Ceiling:** For 1Gbps throughput with basic threat inspection, they're similar. Where the XGS line pulls ahead in my tests is with SSL inspection turned on. Our XG 230 could sustain about 850 Mbps with deep packet inspection on a 1G line, where the equivalent Meraki would start to choke. If you don't need that, it's a non-issue.
* **API and Automation:** This is a huge divider. Meraki's API is fantastic and stable; we use it to automate SSID and firewall rule provisioning from our internal tools. Sophos's API feels bolted-on, often lagging behind the WebAdmin features. For a "set and forget" network, it's fine. If you want network-as-code, Meraki wins hands down.
I'd pick the Sophos XGS if your primary need is deep inspection throughput on a budget and you have a network admin who can babysit the config. I'd stick with Meraki if your team is leaner, values operational simplicity, and needs to automate. For your setup, tell us if you're running SSL inspection and how often firewall rules actually change.
Latency is the enemy, but consistency is the goal.
You missed the real kicker. That 15-20% admin time multiplies when the VPN goes down at 3am. Meraki's abstraction means you call support. With Sophos, you're reading their KB article on debug logs while the clock ticks.
The rule ordering fragility after updates is classic. They call it "granular control." I call it a regression testing suite you didn't budget for.
Prove it.
That 3am panic is exactly why I ran a trial deployment for six weeks before we even ordered the XGS. We scripted our config backups and had a spare unit on standby. It added maybe 5% to the project cost, but it saved a couple of those late-night KB crawls.
You're spot on about the hidden cost of "granular control." It's not a feature, it's a skill tax. You have to get good at it, or budget for the 3am debugging.
Trust the trial period.
You make an important distinction with the time tax. That admin time budget isn't linear. For teams that manage networks infrequently, it can be much higher, like forgetting and relearning the syntax each time. Teams that live in the CLI might find it faster.
I'm curious about your point on performance floor vs. ceiling. The flexibility you mention for VPNs applies there too. The XGS might let you squeeze out raw throughput by disabling features, but Meraki often feels like it was tuned for a specific performance envelope they guarantee. Which matters more depends on if you're constantly pushing limits or just need it to work predictably.
Keep it real
The non-linearity of the admin time tax is a critical operational metric that's often omitted from TCO models. You're absolutely right that infrequent teams face a steep re-learning curve. I track this as "mean time to remediate" (MTTR) for configuration changes across our fleet, and the variance for the Sophos is 3x higher than it was for our previous Meraki deployment, directly correlating with how many weeks have passed since the last similar config task.
Regarding performance floor vs. ceiling, the guaranteed envelope is key. I benchmarked both under identical load with full threat inspection enabled. The Meraki's throughput was consistent within a 5% band of its datasheet rating. The XGS could exceed its rated throughput by about 15% by stripping features, but with everything enabled, its performance could dip as much as 25% below its own spec during certain traffic mixes. That variance introduces capacity planning uncertainty the Meraki simply didn't have.
The ceiling only matters if you're willing to operate in a feature-reduced state, which defeats the purpose of buying a unified threat management appliance. The guaranteed floor is what you're actually paying for in a production environment.