Most engineers think…
Most people picture a next-gen firewall as 'a box that runs each security engine in turn' — IPS scans, then AV re-scans, then the web filter re-scans the same content. On a busy link that model collapses under its own overhead.
Sophos Firewall is built the other way around. SFOS streams a flow through a single DPI engine that scans it once and shares the result across IPS, anti-malware, web filtering and app control. Xstream TLS inspection decrypts TLS 1.3 first so there is plaintext to scan, and once a flow is trusted the rest is offloaded to the Xstream Flow Processor (FastPath) so the CPU only works on new or risky traffic. That 'scan once, use many, then offload' design is exactly why XGS appliances hit high throughput with full inspection on — and it is what an interviewer is listening for.
① What Sophos Firewall and SFOS actually are
Sophos Firewall (formerly XG Firewall) is a next-gen firewall that runs SFOS, the Sophos Firewall OS. The single idea to hold onto: SFOS is one OS across many form factors. The current hardware is the XGS series (including an XGS Desktop range for small sites), but the same SFOS also ships as virtual, software and cloud editions on AWS and Azure.
Internally SFOS splits into a control plane (the web admin, configuration and management) and a data plane (the part that actually forwards and inspects packets). So when you log into the firewall you are talking to the control plane; the traffic you care about is being handled, at speed, by the data plane underneath.
Sophos Firewall is best described as…
② The Xstream architecture — three pillars
The Xstream platform is the inspection design that makes SFOS fast. It rests on three pillars. First, Xstream TLS inspection: native TLS 1.3 decryption at high performance, because most traffic is encrypted and you cannot scan what you cannot read.
One engine, then hardware
Second, the single streaming DPI engine: one stream is scanned once and the result is shared across IPS, anti-malware, web filtering and app control — 'scan once, use many'. Third, FastPath acceleration on the dedicated Xstream Flow Processor in XGS appliances: once a flow has been inspected and trusted, the remainder is offloaded to that hardware so the CPU is freed for the next risky flow. TLS to see it, one pass to scan it, hardware to speed it up.
Sophos Firewall OS — the OS behind Sophos Firewall (formerly XG), running on XGS, virtual, software and cloud. Control plane + data plane.
The hardware accelerator on XGS appliances. Offloads trusted, inspected flows (FastPath) so the main CPU is free for new traffic.
One stream scanned once and shared across IPS, anti-malware, web filtering and app control — 'scan once, use many', no re-buffering.
Native TLS 1.3 decryption at high performance, so the DPI engine has plaintext to scan instead of opaque encrypted bytes.
In an interview, the phrase that lands is the single streaming DPI engine scanning a flow once and sharing it across IPS, anti-malware, web filtering and app control — then FastPath offloading trusted flows to the Xstream Flow Processor. That one sentence shows you understand why XGS is fast with inspection on.
Which is NOT one of the three Xstream pillars?
③ How a packet actually flows — single pass, then offload
Follow one packet. It arrives and is matched against the unified policy (firewall, web, app and inspection rules in one place). If the flow is HTTPS, Xstream TLS inspection decrypts it so there is plaintext to read. The plaintext then streams through the single DPI engine, where IPS, anti-malware, web filtering and app control all read the same single pass — packets are not re-buffered and re-scanned per engine.
The engine returns a verdict. If it is allowed and trusted, SFOS hands the rest of that flow to FastPath on the Xstream Flow Processor, so the CPU stops touching it and moves on. The interview line: the speed comes from not doing the same work twice. A legacy proxy re-buffers content for every engine; Xstream streams it past all of them at once, then offloads what it already trusts.
The legacy model re-buffers the same content for every engine, which is why it chokes at high throughput. Xstream's whole point is the single streaming pass plus hardware FastPath. Calling it 'a faster proxy' misses the architecture and the throughput story entirely.
▶ Watch an HTTPS download get inspected end-to-end
How one flow is processed by SFOS. Press Play for the healthy path, then Break it to see the classic failure.
A trusted flow has just passed inspection on an XGS appliance. What happens to the rest of it?
④ Managing it — Control Center, Central and sane sizing
You run SFOS from the Control Center, the dashboard the web admin opens on: live traffic, system health, ATP and Security Heartbeat status at a glance, on top of the unified policy model. Beyond the box, the firewall is part of the Sophos Adaptive Cybersecurity Ecosystem, managed alongside endpoints from Sophos Central. Synchronized Security (Security Heartbeat) is the link that lets firewall and endpoints share health and react together — for example, isolating a host the moment it is compromised.
Deploy without surprises
Size by throughput with inspection on (TLS + DPI), never by raw firewall forwarding — that headline number disappears the moment you decrypt and scan. Pick an XGS Desktop for a small site, a rack XGS for larger, virtual or cloud where there is no rack. The classic mistake is leaving TLS inspection off: the streaming DPI engine then only sees encrypted bytes and threats walk straight in over HTTPS.
Priya at Meridian Logistics (Kochi) faces this
A new malware strain reaches a few laptops over an HTTPS download even though IPS and anti-malware are licensed and on, and the Control Center shows all green.
Xstream TLS inspection is not enabled for that traffic (or the destination is on a decryption exclusion list), so the streaming DPI engine only sees encrypted bytes and never gets plaintext to scan.
Confirm the box is healthy in the Control Center, then check whether a TLS inspection rule actually matches that outbound web traffic; the log viewer shows the download flowed with no DPI verdict.
Control Center ▸ Rules and policies ▸ SSL/TLS inspection rules + Diagnostics ▸ Log viewerCreate/enable a TLS 1.3 inspection rule covering the outbound web category, push the Sophos decryption certificate to endpoints, and keep a sane exclusion list (banking, health) instead of excluding everything.
Re-test the download: the streaming DPI engine now scans the decrypted stream, IPS/AV catch the malware, trusted flows still FastPath-offload so throughput holds, and Synchronized Security can isolate any host that was hit.
Never assume HTTPS is being scanned. Check the SSL/TLS inspection rules and the log viewer: they show whether a decrypt rule matched and whether the DPI engine returned a verdict. That single read answers most 'why did this get through' tickets without guessing.
Why is it a mistake to size a Sophos Firewall by its raw firewall throughput number?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is the Sophos Xstream architecture described as 'scan once, use many, then offload' rather than a chain of separate scanners? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Sophos Firewall
- Sophos's next-gen firewall, formerly XG Firewall, running SFOS on hardware, virtual, software and cloud.
- SFOS (Sophos Firewall OS)
- The operating system on every Sophos Firewall form factor; splits into a control plane and a data plane.
- XGS series
- The current Sophos hardware appliance line, including an XGS Desktop range, fitted with Xstream Flow Processors.
- Xstream architecture
- Sophos's inspection design built on three pillars: TLS inspection, single streaming DPI and FastPath acceleration.
- Xstream TLS inspection
- Native TLS 1.3 decryption at high performance so HTTPS traffic can actually be inspected.
- Single streaming DPI
- A scan-once engine that shares one pass across IPS, anti-malware, web filtering and app control.
- FastPath / Xstream Flow Processor
- Hardware offload of trusted, already-inspected flows on XGS, freeing the main CPU for new traffic.
- Control Center
- The SFOS web-admin dashboard showing traffic, system health, ATP and Security Heartbeat at a glance.
- Sophos Central
- The cloud console that manages the firewall alongside endpoints in the Adaptive Cybersecurity Ecosystem.
- Synchronized Security (Security Heartbeat)
- The link that lets firewall and endpoints share health and react together, e.g. isolating a compromised host.
📚 Sources
- Sophos — Sophos Firewall product page: Xstream architecture and XGS appliances. sophos.com/products/next-gen-firewall
- Sophos — Xstream architecture: single-pass streaming DPI, TLS 1.3 inspection and FastPath. sophos.com
- Sophos — XGS Series appliances data sheet (Xstream Flow Processors, FastPath acceleration). sophos.com
- Sophos Docs — SFOS administration: Control Center and SSL/TLS inspection rules. docs.sophos.com
- Sophos — Sophos Central & Synchronized Security (Security Heartbeat). sophos.com
- Sophos — Adaptive Cybersecurity Ecosystem overview. sophos.com
What's next?
Got the architecture? Next, wire it up: zones and interfaces, VLANs and LAGs, and routing — static, OSPF and BGP — finished off with SD-WAN so the right traffic takes the right link.