Sold by: Sophos
Deployed on AWS
Sophos Firewall for AWS delivers advanced threat protection for AWS environments and assets. Protect networks, applications, ensure security of ingress and egress traffic, and maintain high web-application availability.
4.7
Overview
Sophos Firewall integrates leading technologies into a single next-generation solution without compromising security. Highlights include deep packet inspection with IPS, ATP, URL filtering, and in-depth reporting; Bidirectional AV for WAF with authentication offloading, path-based routing, country-level blocking; and self-service SSL and HTML5 VPRN technologies to make connecting from anywhere and on any device a reality - without administrative overhead.
Preconfigured templates and centralized policy management save time managing user, application and network policies, and provide pre-packaged web filtering, IPS, traffic shaping and app control policies for Active/Active and Active/Passive deployments spanning multiple availability zones.
Sophos synchronized security allows organizations to link endpoints, cloud workloads, and firewall to relay health status and immediately to respond to threats on your network.
Part of a complete SaaS security platform. A selection of Sophos AWS solutions are included below with more at https://www.sophos.com/en-us/public-cloud .
- Deploy auto scaling firewalls in dynamic environments: https://soph.so/utm-autoscaling-payg
- Monitor resource configurations and analyze AWS security groups with Cloud Optix: https://soph.so/cloud-optix
- Neutralize active cyber-attacks with a dedicated team https://soph.so/Rapid-Response
If you have questions about Sophos solutions or need assistance with deployment and configuration, contact us at aws.marketplace@sophos.com .
The cloud formation template to deploy Sophos Firewall will optionally collect Sophos Central account credentials (email and password used to login to https://central.sophos.com ). These credentials are used only once by the firewall to connect to Sophos Central and enable management services. This step is optional, and can be performed at any time after deployment, following the instructions available here.
Highlights
- Sophos XG Firewall combines advanced networking controls, protections such as Intrusion Prevention Systems (IPS) and Web Application Firewall (WAF), plus user and application controls. Saving time taken to deploy and integrate multiple products.
- Web App Firewall (WAF) protects your web apps against common threats like SQL injection and Cross-Site Scripting. Next-Gen Firewall protection and reporting with stateful traffic inspection, Layer-7 application control, secure proxies, and IPS.
- Sophos Firewall includes extensive reporting. Sophos Firewall provides full insights into user and network activity, surfaced using easy-to-understand indicators so you can take preventive measures before problems occur.
Details
Sold by
Categories
Delivery method
Delivery option
Sophos Standalone Firewall for AWS
Sophos Firewall GWLB (Deprecated - use PAYG)
Latest version
Operating system
OtherLinux 22.0 MR1
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing and entitlements for this product are managed through an external billing relationship between you and the vendor. You activate the product by supplying a license purchased outside of AWS Marketplace, while AWS provides the infrastructure required to launch the product. AWS Subscriptions have no end date and may be canceled any time. However, the cancellation won't affect the status of the external license.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
Terminate the EC2 instance(s) at any time to stop incurring charges. You may email aws.marketplace@sophos.com for questions regarding Sophos XG Firewall charges and refund requests.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Sophos Standalone Firewall for AWS
This CloudFormation template allows you to deploy a Sophos XG Firewall Standalone. The template will bring up a single XG Firewall instance with two ENI network interfaces attached to the instance, each interface is in a distinct subnet. The first interface is dedicated to the private subnet to be protected by the XG Firewall, the second interface is dedicated to the public/external subnet. The IGW is automatically attache to the public subnet.
CloudFormation Template (CFT)
AWS CloudFormation templates are JSON or YAML-formatted text files that simplify provisioning and management on AWS. The templates describe the service or application architecture you want to deploy, and AWS CloudFormation uses those templates to provision and configure the required services (such as Amazon EC2 instances or Amazon RDS DB instances). The deployed application and associated resources are called a "stack."
Version release notes
Additional details
Usage instructions
You can manage your Sophos XG Firewall on AWS from the Web Interface using HTTPS (TCP port 4444), the command shell using SSH (TCP port 22), and via the API.
Sophos XG Firewall requires a valid email address for administration purposes. This email address is not used for any other purpose and remains local to the Sophos XG Firewall AMI.
Resources
Support
Vendor support
Sophos provides technical support via phone and web portal as part of your BYOL subscription. Phone: +1-844-591-2756 Web portal:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Sophos Firewall for AWS delivers advanced threat protection for AWS environments and assets. Protect networks, applications, ensure security of ingress and egress traffic, and maintain high web-application availability.
Protection against ransomware, advanced threats, and more across endpoints, cloud workloads, servers, mobile devices, networks, and email. Extend on premise security and build secure and scalable cloud transformations with a complete cybersecurity platform for all Sophos next-gen technologies.
The Sophos Integration Appliance can be used to host Sophos NDR and third-party log collector integrations. Sophos NDR for AWS identifies rogue assets, unprotected devices, insider threats, and novel attacks to accelerate threat detection and response for AWS Environments and assets
Install bucketAV powered by Sophos in just 15 minutes and detect malware like viruses, worms, and trojans in your S3 buckets. Choose when to scan and keep full data control within your AWS account.
Customer reviews
Imran B.
Sophos Firewall
Reviewed on Jul 08, 2026
Review provided by G2
What do you like best about the product?
I love how its Security Heartbeat automatically isolates infected devices the moment a threat is detected, stopping malware from spreading across the network instantly.
What do you dislike about the product?
The web interface is notoriously slow and requires way too many nested menus and clicks just to configure basic NAT policies or port forwarding.
What problems is the product solving and how is that benefiting you?
Sophos Firewall solves the issue of isolated security silos by automatically communicating with endpoints to instantly isolate compromised devices, benefiting you with immediate lateral movement containment without requiring manual IT intervention.
David Bashar E.
Effortless Multi-Client Firewall Management for MSPs
Reviewed on Jul 08, 2026
Review provided by G2
What do you like best about the product?
As an MSP, they make is so easy to manage, access, upgrade the firewalls for multiple clients. I don't need to login to each client.
What do you dislike about the product?
Sometimes diagnosing an issue can take some time. However, their support is great and does not give up on helping you solve the issue.
What problems is the product solving and how is that benefiting you?
I standardized all of our clients on Sophos Firewall, and it’s made support much smoother. Now our techs can resolve common, known issues quickly and efficiently. Another big plus is that we don’t need to log in to the client’s computer or server; we can handle it directly through Sophos Central instead. When we call support, they are quick to answer, and dedicated to solving the problem and helping us onboard new client.
Medical Practice
Easy Setup and Feature-Rich Value in a Single License
Reviewed on Jul 07, 2026
Review provided by G2
What do you like best about the product?
The ease of setup and the features that are built in in with a single license
What do you dislike about the product?
It's abit annoying how you register the firewalls
What problems is the product solving and how is that benefiting you?
Giving peace of mind to clients about firewalls
Timo H.
Overall a magnificent product
Reviewed on Jul 07, 2026
Review provided by G2
What do you like best about the product?
The basic configuration is already very simple! Many other configurations for integrating the existing system are easy. Adjustments can be made in real-time without a restart to prevent downtime. The price for the hardware is reasonable, but the license is somewhat more expensive. The Sophos support works quickly and is also very easy to reach.
What do you dislike about the product?
I am quite satisfied with the XGS series.
What problems is the product solving and how is that benefiting you?
Protection from any threat from outside.
Anup A.
Synchronized Security on Sophos XGS: Instant Threat Isolation and Simple RED VPN Setup
Reviewed on Jul 07, 2026
Review provided by G2
What do you like best about the product?
The best part of running Sophos firewall is the Synchronized Security ecosystem via Sophos central if you use their endpoint protection alongside the firewall the security heartbeat feature a massive time-saver If a user download something nasty and their mac gets infected the firewall catches the red status heartbeat and instantly cuts them off from the rest of the local subnets and VLANs before it can spread laterally. you don't have to manually scramble to trace the MAC address and shut down the switch port while an outbreak is happening.
the web interface is visually clean and having the control center dashboard
map out active threats, live traffic spikes and unclassified applications right when you log in gives a great high-level health snapshot also setting up site to site VPN tunnels using their RED (Remote Ethernet device) protocol for our smaller branch offices was surprisingly simple- pretty much zero-touch provisioning compared to the usual tedious IPsec configurations on older appliances.
the web interface is visually clean and having the control center dashboard
map out active threats, live traffic spikes and unclassified applications right when you log in gives a great high-level health snapshot also setting up site to site VPN tunnels using their RED (Remote Ethernet device) protocol for our smaller branch offices was surprisingly simple- pretty much zero-touch provisioning compared to the usual tedious IPsec configurations on older appliances.
What do you dislike about the product?
The local web admin console can get a bit sluggish when you're parching through deep packet inspection logs or modifying heavy firewall rules during peak traffic hours the UI spins for a second or two too long through to be fair, they've optimized the backend speed quite a bit in the recent v20 firmware updates so its's getting better.
Also troubleshooting complex policy inheritance can turn into a minor headache forcing you to dig through the log viewer in a separate pop-upwindow. it feels a bit clunky at first but once you get used to the search syntax and filters within the log viewer you can usually track down the conflicting rule pretty fast we also viewer you can usually track down the conflicting rule pretty fast.
Also troubleshooting complex policy inheritance can turn into a minor headache forcing you to dig through the log viewer in a separate pop-upwindow. it feels a bit clunky at first but once you get used to the search syntax and filters within the log viewer you can usually track down the conflicting rule pretty fast we also viewer you can usually track down the conflicting rule pretty fast.
What problems is the product solving and how is that benefiting you?
We replaced a fragmented mess of standalone firewalls and unmanaged edge device across our locations. Sophos completely solved our visibility problem.
the biggest benefit is having a single, unified plane of glass is the cloud to push network policies manage we interface filtering, and handle SD-WAN routing without needing a massive team to oversee it. It has given us way tighter control overshadow IT and unauthorized VPNs or torrenting on the corporate network because the Xstream DPI engine actually categorizes evasive apps by their behavior rather than just guessing by the port number it makes life easier IT team because we aren't chasing ghosts the logs tell us exactly who what and where a threat is origination.
the biggest benefit is having a single, unified plane of glass is the cloud to push network policies manage we interface filtering, and handle SD-WAN routing without needing a massive team to oversee it. It has given us way tighter control overshadow IT and unauthorized VPNs or torrenting on the corporate network because the Xstream DPI engine actually categorizes evasive apps by their behavior rather than just guessing by the port number it makes life easier IT team because we aren't chasing ghosts the logs tell us exactly who what and where a threat is origination.