Campus Firewall: Sophos XGS 2100 for a Degree College

• Client: A degree college campus, Kandivali, Mumbai (name withheld)
• Scope: Sophos XGS 2100 next-generation firewall with Xstream Protection — web and application control, TLS inspection, zero-day sandboxing, SD-WAN/VPN and centralised reporting

Overview of the Customer

The customer is a degree college in Kandivali, Mumbai, running a single campus used by a large student population alongside teaching and administrative staff. Its network carries everything from classroom and laboratory systems to the administrative back office, with students and staff bringing their own devices onto it every day.

The college approached SNA Infotech for one gateway that could protect that whole population, control what the campus network is used for, and stand up to threats that signature-based filtering alone does not catch.

At a Glance

The Challenge

A campus network is harder to defend than a corporate one of the same size. The people on it are not employees under a device policy, the population turns over every academic year, and the network has to stay open enough to be useful for teaching while staying closed enough to be safe.

• Scale without a seat count: a user-licensed firewall would have meant re-counting and re-purchasing every time enrolment moved.
• Unmanaged devices: student and staff laptops and phones join the network without a corporate build or agent.
• Acceptable use: the college needed control over what categories of site and which applications the campus connection is used for, by group rather than by machine.
• Encrypted traffic: most web traffic is encrypted, so filtering that cannot inspect TLS sees very little of what is actually crossing the gateway.
• Threats with no signature: a file nobody has classified yet still has to be stopped before it reaches a campus PC.

The Solution

SNA Infotech proposed a single Sophos XGS 2100 appliance on an unlimited-user base licence, with the Xstream Protection bundle on top:

• One gateway for the campus: the XGS 2100 handles the whole population on one policy set, so there is one place to see traffic and one place to change a rule.
• Unlimited-user licensing: cost does not move with enrolment, and nobody has to audit seat counts at renewal.
• TLS and deep packet inspection: encrypted traffic is inspected rather than waved through, which is what makes the web and application controls mean anything.
• Web and application control: site categories and applications are allowed or blocked by group, so teaching, laboratory and administrative use can differ.
• Zero-day sandboxing: suspicious files are detonated and analysed before delivery, catching what signatures have not seen yet.
• SD-WAN and VPN: resilient connectivity and secure remote access to campus systems from off site.
• Centralised reporting: one view of what the gateway blocked and why — the evidence a management committee asks for.

The Results

• One managed gateway: the campus runs on a single security appliance instead of filtering scattered across devices and departments.
• Policy that follows groups, not machines: acceptable-use rules apply consistently to students and staff on whatever device they bring.
• Visibility into encrypted traffic: inspection at the gateway means the reporting reflects what is really happening on the network.
• Headroom: an unlimited-user base licence means the next intake does not trigger a licensing exercise.

Why It Matters

Education runs on personal data — student records, parent contact details, fee and examination data, staff files. Under India’s DPDP Act the obligations around that data commence on 13 May 2027, and Rule 6 asks for controlled access, visibility over who reached personal data, and logs kept for a year. A campus gateway that inspects, controls and reports is where most of that work starts. We wrote about the IT side of it in our DPDP readiness checklist.

What Was Delivered

Conclusion

For a campus, the licensing model matters as much as the hardware. An unlimited-user base licence takes enrolment out of the security budget conversation, and the Xstream bundle turns the appliance from a filter into a gateway that inspects encrypted traffic, sandboxes the unknown and reports on both.

Planning something similar? See our cybersecurity practice or ask us for a security assessment.