{"id":101787,"date":"2026-11-11T11:16:38","date_gmt":"2026-11-11T11:16:38","guid":{"rendered":"https:\/\/optics.carritech.com\/?p=101787"},"modified":"2026-11-11T12:44:05","modified_gmt":"2026-11-11T12:44:05","slug":"security-appliance-optics","status":"publish","type":"post","link":"https:\/\/optics.carritech.com\/it\/security-appliance-optics\/","title":{"rendered":"Security appliance optics: Fortinet, Palo Alto, F5 and Gigamon compatible modules"},"content":{"rendered":"

A firewall is the one device in a network that is deliberately in the middle of two things that do not trust each other. That has a consequence for optics that nobody mentions when the appliance is specified: the two sides of a security platform are frequently not the same kind of network<\/strong>, so the module in the inside interface and the module in the outside interface are often different parts, bought from different budgets, and coded for a platform that is stricter than either network’s switches about what it will accept.<\/p>\n\n\n

This guide covers the optics that go in security appliances: what the Fortinet, Palo Alto Networks, F5 and Gigamon part numbers mean, which cage takes which speed, the four things that reliably go wrong, and the 80 security appliance optics Carritech holds<\/strong>, listed by speed from 155 Mbit\/s to 400 Gigabit.<\/p>\n\n\n

The split is worth knowing before you read on: 37 Fortinet codings, 32 Palo Alto, 8 F5 and 3 Gigamon<\/strong>. Between them they cover nine form factors and nine speeds, and almost every one of them maps onto an ordinary, standards-defined optical interface. What makes security appliance optics different is not the optics. It is the host.<\/strong><\/p>\n\n\n

The four naming schemes<\/h2>\n\n\n
\n\n
Family<\/th>Example<\/th>Vendor<\/th>How to read it<\/th><\/tr><\/thead>\n
FN-TRAN-<\/strong><\/td>FN-TRAN-SFP+LR<\/a><\/td>Fortinet<\/td>Descriptive and readable: form factor then port type. The main family.<\/td><\/tr>\n
FG-TRAN-, FR-TRAN-<\/strong><\/td>FG-TRAN-CFP2-LR4<\/a><\/td>Fortinet<\/td>Two smaller sibling prefixes using the same descriptive scheme.<\/td><\/tr>\n
PAN-<\/strong><\/td>PAN-QSFP28-100GBASE-LR4<\/a><\/td>Palo Alto Networks<\/td>Verbose but unambiguous: it spells out the IEEE port type.<\/td><\/tr>\n
PAN-T-<\/strong><\/td>PAN-T-Q28-100GBASE-LR4<\/a><\/td>Palo Alto Networks<\/td>A second, abbreviated ordering family for the same optical interfaces.<\/td><\/tr>\n
F5-UPG-<\/strong><\/td>F5-UPG-QSFP28-SR4<\/a><\/td>F5<\/td>UPG marks an upgrade or option kit ordered against a platform, not a standalone optic.<\/td><\/tr>\n
QDD-5nn<\/strong><\/td>QDD-503<\/a><\/td>Gigamon<\/td>Opaque three-digit SKUs on the visibility side. Nothing readable in the string.<\/td><\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n

Three of those four are a pleasure to work with. Fortinet and Palo Alto both name the optic after what it is, which means FN-TRAN-QSFPDD-LR4<\/a> e PAN-QSFP40GBASE-SR4<\/a> can be read across a warehouse without a data sheet. Gigamon’s QDD-503<\/a>, QDD-511<\/a> e QDD-514<\/a> are the opposite: three consecutive-looking numbers that are in fact LR4 at 10 km, DR4 at 500 m and FR4 at 2 km — three different optical interfaces with nothing in the SKU to separate them.<\/p>\n\n\n

The PAN- and PAN-T- split is the one to watch.<\/strong> Palo Alto carries both PAN-SFP-PLUS-LR<\/a> e PAN-T-SPLUS-LR<\/a>, both PAN-QSFP40GBASE-LR4<\/a> e PAN-T-Q40GBASE-LR4<\/a>, both PAN-SFP28-25GBASE-SR<\/a> e PAN-T-S28-25GBASE-SR<\/a>. These are two ordering families covering the same optical interfaces. Our records map both to the same Carritech optical profile, because optically they are the same module. The identification strings are not the same, though<\/strong>, and a platform’s support list may name one and not the other, so record which family the original came from rather than normalising it away in a spreadsheet.<\/p>\n\n\n

Why the host is the hard part<\/h2>\n\n\n

Three things are true of security appliances and not of switches, and together they explain most of the support calls this product class generates.<\/p>\n\n\n