Sophos XGS 2100 or FortiGate 100F? An honest comparison before you buy

Two quotes are sitting on your desk: FortiGate 100F and Sophos XGS 2100. The prices are close, the two spec sheets use almost identical vocabulary, and each supplier is confident in their box. What no spec sheet answers is the real question: which of the two is easier to live with for three years — with your team and your budget?

ZEMAVO supplies and installs both, and holds no accreditation from either manufacturer that would push us towards one of them. What follows is a comparison drawn from installing, running and renewing them, not a recommendation.

The first difference: who logs into the device after handover?

Both are managed locally from a web interface on the device itself, but the philosophy diverges from there.

FortiGate runs FortiOS, a deep system: almost everything is tunable, and the command line (CLI) reaches details that never appear in the GUI at all. That depth is a genuine advantage for someone who knows it, and a genuine burden for someone who does not. And if you have more than one branch, managing the devices centrally calls for FortiManager for policy and FortiAnalyzer for logging and reporting — each a separate product, bought and licensed on its own. FortiGate Cloud does offer a free tier that stores configuration backups and keeps seven days of logs; beyond that it is a subscription.

Sophos ties the device to the Sophos Central cloud platform. Managing the firewall from there — configuration backups, scheduled firmware updates, several devices on one screen — does not require buying a separate management product the way FortiGate does, but it is not unconditionally free: it depends on an active subscription or support licence on the device, and it falls away from a device whose licences have all expired. Reporting covers seven days of logs with any active subscription, and the Xstream bundle raises that to thirty days, calculated on the average log volume for each appliance size.

More important than that, the same console manages Sophos Intercept X on the endpoints, and Security Heartbeat has the firewall and the antivirus exchange health state: an infected user machine can be isolated, or have its access to the network restricted, automatically. If your plan is for endpoint protection to come from Sophos as well, nothing on the Fortinet side matches this short of building out FortiClient EMS with its own licences.

The practical summary: if you have an experienced network engineer with the time to spend, the depth of FortiOS is a gain. If management will land on a single IT administrator already doing ten other things, Sophos Central reduces the number of things that can be configured wrongly.

Licensing: what you are actually buying

In both cases you are buying two separate things: the appliance, and then the subscriptions that make it more than a router.

FortiGate

The appliance + FortiCare (support, RMA and firmware updates) + FortiGuard (the security services). They are sold together in bundles: ATP, which centres on antivirus, IPS, application control and cloud sandboxing; UTP, the most common one, which adds web filtering, DNS filtering and anti-spam on top; and Enterprise, the broadest. The services can also be bought individually if you have a reason to.

Sophos

The appliance ships with a Base Firewall licence, which on hardware appliances is tied to the lifecycle of the appliance itself rather than to an annual renewal date. On top of it sit subscriptions in two bundles: Standard Protection (Network Protection: IPS and Security Heartbeat; and Web Protection: web and application filtering and malware scanning, with support), and Xstream Protection, which adds Zero-Day Protection (sandboxing and automated analysis), Central Orchestration, DNS protection and extended reporting.

The difference that shows up on the day a subscription expires is worth your attention. On FortiGate, security updates stop while the device carries on passing traffic and enforcing your rules; the scanning engine stays running, but on signatures that age by the day. Web filtering is different, because it relies on a live category lookup against FortiGuard's servers: when the licence lapses the lookup fails, and the fate of the request is settled by whether the profile is set to allow or block when the rating cannot be resolved. Nothing on screen shouts about it, which is what we set out in detail here. On Sophos, as long as Base Firewall is intact the firewall rules stay applied and in control of traffic, but an expired Network Protection means IPS signatures are not downloaded and IPS policies are not enforced; you can leave the settings looking exactly as they were in the interface, but what has no subscription is not enforced. The trap is the same on both: the device looks healthy while it is not protecting anything.

Sophos has a sharper edge case you should know about in advance: if the Base Firewall licence itself lapses, firewall rules are not processed at all. The device then behaves like a router — it passes outbound traffic from the internal network and applies masquerading to it automatically even if you have a rule blocking it, while NAT rules, RED tunnels and managed wireless access points stop working; VPN tunnels may stay up in form without any traffic passing through them. This is not a first-year scenario, it is an end-of-life scenario, and it is reason enough to ask about the model's end-of-support date before you buy rather than after.

The published numbers, and how to read them

The figures published on the FortiGate 100F and Sophos XGS 2100 pages say: 20 Gbps of firewall throughput on the first, 23.5 on the second. That is the least important number on the whole sheet, because it measures traffic passing without inspection.

What actually consumes the appliance is inspection: IPS, and inspection of encrypted (TLS) traffic. The 100F is quoted at around 1 Gbps of IPS throughput, and the XGS 2100 at 1.7 Gbps of TLS inspection. And here a necessary warning: each manufacturer measures in its own way, with a different traffic mix, different rules and different cipher suites. Setting a number from a Fortinet sheet against a number from a Sophos sheet is not a fair comparison — read the figures as an order of magnitude, not as a verdict.

And the question that comes before all of them: will you turn on TLS inspection at all? Turning it on means distributing the firewall's certificate to every machine in the company, and it breaks applications that pin their certificates (certificate pinning), so you will need exclusion lists. It also has a legal dimension touching your employees' privacy that deserves to be written explicitly into your usage policy. If you decide not to enable it, the numbers you compare on are IPS throughput and concurrent sessions, and there is no sense in paying a price difference for a figure you will not use. If you decide to enable it, it is the only number that genuinely matters.

On ports, the 100F provides 22 copper gigabit ports and 4 SFP ports, while the XGS 2100 starts at 8 copper ports with expansion ports. If your network carries a large number of direct connections, that is a practical difference: it either saves you an extra switch or forces one on you, and that switch's price and installation belong in the comparison.

Where each device is stronger

FortiGate 100F

• Dedicated acceleration processors within the SoC4 package — the NP6XLite network processor and the CP9XLite content processor — shift part of the load off the general-purpose CPU, so you get high performance on uninspected traffic at a relatively low price.
• SD-WAN built into the system with no additional licence — which matters if you have branches on multiple internet lines. (Central orchestration across branches through FortiManager is another thing, bought on its own.)
• The ability to manage FortiSwitch switches and FortiAP access points from the same device over FortiLink — one console for the entire network edge.
• VDOMs: splitting the device into separate virtual firewalls, ten of them available by default with no additional licence — useful if you separate the management network from the guest network or the point-of-sale network with hard boundaries.
• Available expertise: going by the people we meet on installations and maintenance calls, more engineers in the Egyptian market know FortiOS. If your engineer leaves the company, finding a replacement who understands the device is easier.

Sophos XGS 2100

• The Xstream architecture with a fast-forwarding path (FastPath) that exempts trusted traffic from repeated inspection.
• TLS inspection built to be usable in practice: ready-made exclusion lists, and reports showing which sites failed inspection and why, which cuts out days of chasing after you switch it on.
• A single console for the firewall and the antivirus, with Security Heartbeat and Synchronized Application Control, which identifies unknown applications through the endpoint agent.
• A rule model closer to business language and less granular, and initial setup from Central that gets you a fair distance without deep expertise in the platform.

Against that: local Sophos expertise is less widespread than what we see with FortiGate, a core part of the platform's value is tied to the cloud, which may not suit an organisation that requires purely on-premises management, and complex networking scenarios remain more comfortable on FortiOS.

Two points that do not appear in the quotes

Remote access has changed at Fortinet. As of FortiOS 7.6.3, SSL-VPN tunnel mode no longer exists, neither in the interface nor on the command line, and its settings are not migrated on upgrade; the alternative is IPsec, which can be run on TCP port 443. The feature had already been removed before that, in 7.6.0, from models with 2 GB of memory or less. If your remote-access plan rests on the SSL-VPN client, take this into account from day one rather than after the upgrade, and plan the move to IPsec beforehand. On Sophos, the Sophos Connect client handles the job at no additional cost. And either way, remote access deserves hardening of its own that matters more than the choice of brand.

Neither of them has a clean security record. Fortinet has been through serious SSL-VPN vulnerabilities that were exploited at scale (CVE-2018-13379 and CVE-2022-42475), and Sophos has been through vulnerabilities in the user portal and the management interface that were exploited as well (CVE-2020-12271 and CVE-2022-1040). The lesson is not that one is worse than the other, but that the management interface must never be exposed to the internet, and that regular patching and two-factor authentication on admin and VPN accounts are not luxuries.

The Egyptian reality: renewal, support and spare parts

• Cost is calculated over three years, not one. Both are priced in dollars, so the renewal price in pounds moves with the exchange rate. Ask for the renewal price for the following years in writing alongside the purchase quote, and compare equivalent bundles over the same term — that is the only fair comparison.
• Delaying a renewal does not save money. Renewal is normally counted from the previous subscription's expiry date, not from the date of payment. Confirm this point explicitly with the supplier, because it means leaving a subscription lapsed for three months wastes three months you have paid for.
• Fast replacement depends on geographic coverage. Support bundles that promise next-business-day replacement are not available on the same terms in every country. Ask: how long does a replacement unit actually take to reach Cairo? And ask for the answer in writing. Sometimes a cold spare on the shelf is cheaper and faster than a premium support bundle.
• Register the serial in your company's name. A device registered under a supplier's account, or licences bought for another region, create a problem on the day you actually need support. Ask for confirmation of the registration and the warranty start date before you pay.
• Ask about the model's age. Fortinet stopped accepting orders for the 100F in April 2026 and nominates the FortiGate 120G as its successor, with support announced for the 100F until April 2031. That does not write the device off, but it does mean what is on offer today is channel stock and the life left ahead of you is shorter — which should be reflected in the price and in the subscription term you choose. Put the same question to the XGS 2100: what is its end-of-sale date, and what is its announced end-of-support date? And check the dates at the moment of purchase, because manufacturers update their schedules.
• Power supply. Check how many power supplies the model you are being offered has, and put the device on a decent UPS. Voltage fluctuation and frequent cuts damage power supplies, and a firewall that is switched off protects nothing.

How to decide

The decision is not settled by a spec table but by four questions about your own company:

• Who will run the device day to day? An experienced network engineer → FortiGate. A general IT administrator, or reliance on the supplier → Sophos.
• What will you put on the endpoints? If Intercept X, Sophos gives you a single console and a genuine link between endpoint and edge. If Kaspersky or anything else, that advantage drops out of the calculation entirely.
• How many branches, and what is the network plan? Multiple branches on multiple lines, with the intention of bringing switches and access points under the same platform → FortiGate. Branches managed from one cloud console with the least friction → Sophos.
• Will you enable TLS inspection? If yes, compare on the encrypted-inspection figure and plan certificate distribution and exclusion lists from the start. If no, do not pay for numbers you will not use.

In practice, we have installed both devices together across the Awlad Ragab chain — each platform with its own tooling and the same rule logic — and installed a single FortiGate at the network edge of El Morshedy Shoes. The choice between the two brands was not what made the difference in either case. What usually creates the problems is a wrongly sized device, rules left wide open, or a subscription that expired with nobody noticing.

If you want a comparison against your own situation, ask for a quote covering both devices on the same bundle and the same term from the firewall licensing page, browse the firewall appliances, or get in touch with your user count, line speed and number of branches.