I'm evaluating a perimeter firewall refresh for our platform engineering team, and the "set and forget" ideal is paramount. We have a heavy Kubernetes footprint, CI/CD pipelines that trigger dynamic ACL requirements, and a team that would rather write Terraform than click through a web UI. The shortlist is down to a Sophos XGS appliance (likely the 2300 series) versus a roll-your-own OPNSense box on decent hardware.
My primary criterion is operational overhead over a 3-5 year horizon, not initial setup cost. I define "set and forget" as:
* Stability of updates: Needing a rollback once a year is acceptable. Needing emergency patches or manual intervention quarterly is not.
* Configuration integrity: The system should reliably retain complex configurations across updates and power events.
* Automated response: Capability to integrate with external systems (think webhooks, APIs) for dynamic policy adjustments is a significant plus.
* Observability: Logging and metrics must be exportable in standard formats (e.g., Syslog, OpenTelemetry) to our central stack, without requiring a proprietary agent on every consumer.
For OPNSense, the appeal is the pure API/CLI-driven control via `curl` or Ansible, and the `os-firewall` plugin for dynamic updates. However, I'm deeply skeptical of its long-term stability on bare metal when managing stateful inspection for numerous VLANs and site-to-site IPsec tunnels. The community edition update quality can be inconsistent.
For Sophos XGS, the centralized management (even standalone) and the integrated reporting are attractive. But the "Sophos way" of doing things often feels like a black box. My specific technical concerns are:
* How truly granular is the REST API? Can I script the entire lifecycle of a firewall rule, including service definitions and application identification, or am I forced to the GUI for core tasks?
* Does the Dynamic Group functionality allow for membership based on external API calls? We need to pivot rules based on ephemeral Kubernetes node IPs or deployment pipeline source IPs.
* What's the real-world experience with major firmware upgrades? Does the XGS line handle jumping several versions reliably, or is it a multi-hour, hands-on migration with high risk of config drift?
The comparison I'm not finding is from an infrastructure-as-code and automation-centric viewpoint. Most reviews focus on GUI usability or basic SOHO features. I need to know which platform will silently, reliably enforce policy while the team's focus is elsewhere.
– A
Show me the benchmarks.
I manage cloud infrastructure for a mid-sized fintech, and we've run both OPNSense on bare metal and Sophos SG/XGS appliances across a couple dozen sites over the last five years. Currently, we're migrating from Sophos to Palo Alto, but our primary edge firewalls are still XGS devices.
- **Realistic operational overhead**: Sophos wins for the "forget" part. The vendor-supplied hardware and integrated firmware updates mean you patch when the stable track is released, reboot, and it's done. Complex OPNSense configurations involving multiple gateways, VPNs, and stateful filtering can break in subtle ways after major OS updates, requiring someone who knows the BSD underpinnings to troubleshoot. We averaged one problematic update every 18 months with Sophos, versus two or three per year with OPNSense in our more complex setups.
- **Automation and API maturity**: This is where OPNSense is the clear winner. Its REST API is complete and predictable, and you can manage the entire config via the CLI. Sophos has a REST API, but it's a second-class citizen to the Web UI; many advanced features, especially around VPN configuration, require the UI or undocumented CLI commands. For a team that wants Terraform, OPNSense is the only real choice.
- **Observability and logging**: Both export standard syslog. Sophos's logging feels geared toward a human reviewing the GUI; extracting useful machine-readable logs for a central SIEM requires more parsing effort. OPNSense logs are straightforward BSD pf logs, which are easier to ingest and parse programmatically.
- **Total 5-year cost**: The XGS 2300 you're looking at is roughly $6-8k upfront plus a yearly subscription (around 20-25% of list) for updates and support. A comparable Supermicro box with OPNSense is a $2-3k capital cost. The trap is internal labor. If your team's time is expensive and the firewall isn't their primary focus, the Sophos TCO can easily be lower over five years. If you have spare cycles and BSD/networking expertise in-house, OPNSense saves significant cash.
Given your description of a tech-heavy team that prefers Terraform and has dynamic ACL needs from CI/CD, I'd recommend OPNSense. The automation capability outweighs the slightly higher operational risk from updates. The deciding factor would be two things: your team's depth in BSD networking for when things go wrong, and whether you need the proprietary VPN clients or advanced threat features that come with the Sophos subscription.
You're spot on about the API thing being a dealbreaker. I pushed our Sophos XGS to its limits trying to automate site to site VPN configs and it was a joke. Half the time the API just echoed back "success" while the config was silently mangled.
That's not set and forget. That's set and pray it doesn't break when you need to scale.
CRM is a necessary evil
Your point about API reliability is critical. I've seen similar issues with vendor APIs where the configuration drift becomes a hidden operational tax. You're constantly verifying state via a separate channel, which defeats the "forget" part.
Given your team's preference for Terraform, have you evaluated the state of the Terraform providers for each? A brittle provider can make your automation the source of overhead, not the solution. Sometimes the more "enterprise" option has a worse provider because their API is an afterthought.
For your dynamic ACL needs from CI/CD, the ability to push changes via a reliable, idempotent API is non-negotiable. If the Sophos API is echoing false successes, that alone disqualifies it for your use case, regardless of hardware stability.
CloudCostHawk
Your experience with the Sophos firmware update cadence mirrors what I've seen in managed service environments. That 18-month problem cycle for a black-box appliance is indeed the trade-off for reduced surface area.
You're correct that the OPNSense API is more complete, but its reliability for state synchronization under high-frequency automation is often overstated. I've had to build external state verification layers for both systems, which negates some of the "set and forget" premise. The true cost isn't just the API's feature coverage, but the idempotency guarantees and configuration drift detection it provides, or often lacks.
For a team living in Terraform, the provider's maturity matters more than the underlying API's breadth. A limited but predictable API with a solid Terraform provider can be more 'forgettable' than a fully-featured but flaky one. Have you measured the actual configuration drift on your OPNSense nodes between automated pushes? That delta often reveals the hidden management overhead.
—BJ
You're already romanticizing the OPNSense API because it's not a black box. That's the trap. The appeal of "pure API/CLI-driven control" means you're now responsible for the stability of the integration layer, which never ends.
Vendors like Sophos treat their API as a compliance checkbox, not a core control plane. So when your pipeline pushes a dynamic ACL change at 2am and gets a silent failure, your "set and forget" system just created a Sev-1 incident. The OPNSense API might be more complete, but you'll be the one writing and maintaining the idempotency wrappers and state verification it lacks.
For your 3-5 year horizon, the question isn't which API looks better on paper. It's which system lets you sleep when your team is automating it aggressively. Neither is truly forgettable, but one leaves you debugging BSD kernel modules.
— skeptical but fair