2. The XGS 136 arrives¶
In December 2024 I bought a Sophos XGS 136, with a two-year Sophos licence on it. It was shipped from Japan and was at my door ten days later. It worked, it was licensed, and it was new to me
- and the first thing I did was take it apart.
That is not a sensible thing to do with a working, licensed firewall. But I wanted to know what was inside before I knew anything else about it, and a board tells you a great deal before any software does: which chips are there, which of them talk to which, and where the two computers meet.
The XGS 136 with its case off. This photograph is a later one, taken on 2026-10-11 when the board was documented for the repository - but the board is the one I opened on the first day.
What the board shows¶
The layout carries the shape of the machine. An AMD Ryzen Embedded on one side: the host. On the other, under its own lid and with its own memory around it, a Marvell part - the coprocessor - and near it an 88E6193X switch with the copper ports fanned out from it. Two computers, and a switch that belongs to the second one. Putting a name to every part took far longer than looking at them did.
 The coprocessor: a Marvell CN9130, with a second CP beside it that makes it a CN9131 |
 The 88E6193X switch, behind eight of the copper ports and both SFP cages |
Then I put it back together and ran it the way it was sold: on Sophos's own operating system, under its licence - and for some months, that is how it ran. Some things about it did not suit me, and I will leave it at that.
The decision¶
The XGS 136 belongs to the first generation of the XGS desktops, and that generation's support was heading for its end. It is a strong desktop appliance - a host with two cores and four threads, a four-core coprocessor, fourteen ports, a crypto engine - and when its support ends, the usual verdict on hardware like that is e-waste.
So in the spring of 2025, about eighteen months before the repository went public, I decided to keep working on it instead.
Part of that was the machine. The rest was something older: I love open source, and I love using it freely. I follow the projects I depend on closely - I read their changelogs line by line, and I want to know not only what changed but why, and what kind of change it was. An open firewall on hardware this good was worth the work.
From then on, honestly, it would not leave my head.
Previous: 1. Two computers in one box · Next: 3. Eight months of looking
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.