Looking at firewalls for a 20-person startup. Everyone is remote, using cloud apps (G Workspace, AWS, Salesforce). Need solid VPN and visibility into app traffic, not just port blocking.
Evaluating WatchGuard Firebox T40 and Sophos XG 135. Need real-world feedback on:
* Remote access VPN setup and stability for a scattered team.
* Cloud app reporting and control. Can it actually identify Salesforce vs random web traffic?
* True total cost. Hardware is one line. What's the annual subscription hit for the necessary features?
* Management overhead. We have no dedicated network security person.
Just the facts.
Trust but verify.
I'm a cloud infrastructure lead for a 35-person SaaS company, fully remote. I migrated us from a mishmash of consumer firewalls to a Sophos XG 230 two years ago and manage it myself.
* **Remote VPN Stability:** Sophos SSL VPN (now called Client VPN) has been more stable for us. The WatchGuard IPSec client had more profile corruption issues for mobile users in my last role. The Sophos client handles network swaps (Wi-Fi to cellular) better without requiring a full reconnect.
* **Cloud App Identification:** Both will identify Salesforce. Sophos does this slightly better out of the box for SaaS apps because its App Control database categorizes by service (Salesforce, AWS console, GitHub) not just port. WatchGuard requires more initial tuning of its Application Control to achieve the same, adding about 3-4 hours of policy setup.
* **True Annual Cost:** The hardware is the smallest cost. For a T40 or XG 135 with full UTM subscriptions (AV, IPS, App Control, Web Filtering), budget $1,200 to $1,700 per year. Sophos charges separately for their central cloud management dashboard (Sophos Central), which adds about $200/year for your size. WatchGuard's basic management is included. Both require licenses for the VPN client beyond a certain number of concurrent users.
* **Management Overhead:** Sophos Central gives you a single pane for firewall, endpoint, and mobile client policy, which drastically cuts overhead for a small team. WatchGuard's on-box management is simpler initially but doesn't scale as cleanly for managing remote user policies. For a team with no dedicated security person, the integrated platform of Sophos reduces context switching.
My pick is the Sophos XG. For a remote-first startup where the admin is also wearing ten other hats, the unified management in Sophos Central and more precise SaaS traffic visibility are worth the slight annual premium. If your top priority is minimizing the absolute dollar subscription cost and you have some prior network knowledge for the initial setup, the WatchGuard is a viable, leaner option.
Show me the bill.