Security appliance optics: Fortinet, Palo Alto, F5 and Gigamon compatible modules

A firewall is the one device in a network that is deliberately in the middle of two things that do not trust each other. That has a consequence for optics that nobody mentions when the appliance is specified: the two sides of a security platform are frequently not the same kind of network, so the module in the inside interface and the module in the outside interface are often different parts, bought from different budgets, and coded for a platform that is stricter than either network’s switches about what it will accept.

This guide covers the optics that go in security appliances: what the Fortinet, Palo Alto Networks, F5 and Gigamon part numbers mean, which cage takes which speed, the four things that reliably go wrong, and the 80 security appliance optics Carritech holds, listed by speed from 155 Mbit/s to 400 Gigabit.

The split is worth knowing before you read on: 37 Fortinet codings, 32 Palo Alto, 8 F5 and 3 Gigamon. Between them they cover nine form factors and nine speeds, and almost every one of them maps onto an ordinary, standards-defined optical interface. What makes security appliance optics different is not the optics. It is the host.

The four naming schemes

Three of those four are a pleasure to work with. Fortinet and Palo Alto both name the optic after what it is, which means FN-TRAN-QSFPDD-LR4 e PAN-QSFP40GBASE-SR4 can be read across a warehouse without a data sheet. Gigamon’s QDD-503, QDD-511 e QDD-514 are the opposite: three consecutive-looking numbers that are in fact LR4 at 10 km, DR4 at 500 m and FR4 at 2 km — three different optical interfaces with nothing in the SKU to separate them.

The PAN- and PAN-T- split is the one to watch. Palo Alto carries both PAN-SFP-PLUS-LR e PAN-T-SPLUS-LR, both PAN-QSFP40GBASE-LR4 e PAN-T-Q40GBASE-LR4, both PAN-SFP28-25GBASE-SR e PAN-T-S28-25GBASE-SR. These are two ordering families covering the same optical interfaces. Our records map both to the same Carritech optical profile, because optically they are the same module. The identification strings are not the same, though, and a platform’s support list may name one and not the other, so record which family the original came from rather than normalising it away in a spreadsheet.

Why the host is the hard part

Three things are true of security appliances and not of switches, and together they explain most of the support calls this product class generates.

• The port count is small and every port matters. A mid-range firewall might have four SFP+ cages and two QSFP28. There is no spare port to move a suspect link to, and no second path to fail over to while you diagnose. That changes the economics of getting the coding right first time.
• Security platforms are unusually strict about what they will accept. The whole product category is built on refusing things it does not recognise, and the module inventory is part of a configuration that gets audited. A firewall is more likely than a campus switch to log an unrecognised module loudly and leave the port down.
• An appliance sits between two administrative domains. The inside interface faces your own switch; the outside interface faces a carrier handoff, a DMZ, a partner, or a tap. Those two sides frequently want different reaches, different fibre grades and sometimes different media entirely.

That last point is the one that costs money, and the catalogue shows it. Look at the copper group below: six of the eighty parts in this range are copper modules, which is a far higher proportion than you find in a switch vendor’s optics range. That is because an RJ45 in an SFP cage is very often how a security appliance meets an ISP handoff or a management network that was never going to be fibre. Transceiver coding explained covers the identification side, and the Carritech Opticode coding box is how you code a module for the platform in front of you at the point of deployment rather than ordering a new one.

Which cage takes which speed

Two ordering notes. A QSFP-DD cage accepts a QSFP28 module; the reverse is not true, which makes a staged move to 400G possible on a platform that has QSFP-DD cages — see QSFP-DD vs OSFP. And an SFP28 cage will usually run at 10G, but whether a given appliance offers the lower rate is a software question, which SFP+ vs SFP28 covers. On a device with four ports, the answer to that question decides whether you can re-use what you already have.

Four things that catch people out

1. The trailing I, and what our records do not currently tell you

Four Fortinet parts in the list below carry a trailing I: FN-TRAN-SFP+SRI, FN-TRAN-SFP+LRI, FN-TRAN-SFP+ERI e FN-TRAN-QSFP+LRI, alongside FN-TRAN-SXI at gigabit. Conventionally that suffix marks the extended-temperature variant of the same optical design — the version rated for a cabinet rather than a machine room.

We want to be straight about a limitation in our own data here. Our product records currently map the I and non-I codings onto the same Carritech optical profile with the same description, so the listing below will not tell you the temperature rating apart. Optically they are the same module; the rating is the thing that differs, and it is the thing that matters if the appliance is in a roadside cabinet, a plant room or an unconditioned comms cupboard. Tell us the ambient and we will confirm the rating in writing before anything ships. It is a far cheaper conversation than a module that drifts out of specification every August.

2. Copper in a firewall is a whole physical layer, and the 80-metre part needs a conversation

The copper group below contains no lasers at all. A copper SFP is a complete IEEE Std 802.3an-2006 10GBASE-T or 1000BASE-T physical layer squeezed into a cage designed for an optical module, and it behaves accordingly: it draws more power, it runs hotter, it adds latency the optical parts do not, and at 10 Gigabit it reaches around 30 metres on Category 6A rather than the 100 metres a native RJ45 port gives. On an appliance with a tight thermal budget and a small power envelope, that is a real design constraint rather than a footnote. The multi-rate behaviour comes from IEEE Std 802.3bz-2016, approved on 22 September 2016, which added 2.5GBASE-T and 5GBASE-T — but whether a given appliance will bring the port up at 2.5G is a software question, not a property of the module.

One part needs saying plainly. FN-TRAN-SFP+GC-T80 is the 80-metre copper design, and FN-TRAN-SFP+GC is the 30-metre one. The 30-metre record is specified correctly in our catalogue as a 10 Gigabit part. The 80-metre record currently carries a product title that describes a gigabit module, which contradicts the 10 Gigabit requirement it is listed against. We are fixing the record. Until we have, do not take the rate at 80 metres from this website — ask us and we will confirm it against the module’s own specification. Copper SFP and 10GBASE-T SFP+ modules covers the power, heat and auto-negotiation detail, and copper SFPs and adapters is the range.

3. "BiDi" here means two fibres, not one

Five parts in this range are described as BiDi: FG-TRAN-QSFP+SR-BIDI, FN-TRAN-QSFP-BIDI, PAN-QSFP40GBASE-BIDI, F5-UPG-QSFP+BD e F5-UPG-QSFP28-SRBD, plus PAN-QSFP28-100GBASE-BIDI at 100G. These are dual-wavelength multimode modules that run 40G or 100G over an existing duplex LC pair at 850 and 900 nm, instead of over an eight-fibre MPO trunk. They are bought for exactly one reason: the building already has duplex OM3 or OM4 in it and you do not want to re-cable to put a 40G or 100G appliance interface in.

That is a genuinely different product from the single-strand BiDi optics used in access networks, which put one wavelength in each direction down one fibre and are sold in matched upstream and downstream halves. The word covers two things and the difference is one fibre versus two. If someone hands you a "BiDi" module for a firewall uplink, establish which kind it is before you plan the patching: BiDi transceivers e BiDi SFP modules cover the single-fibre family, and MPO polarity explained covers the trunk you are trying to avoid buying.

4. At 400G, SR8 came from a different standard than the rest of 400G

Worth a paragraph because our own product copy gets it slightly wrong and the distinction is useful. IEEE Std 802.3bs-2017, approved on 6 December 2017, is the standard that brought 200 and 400 Gigabit Ethernet in, and it defined the 400G port types that use sixteen lanes or four. 400GBASE-SR8 is not one of them. The eight-lane multimode port type came later, from the IEEE Std 802.3cm-2020 400 Gb/s over multimode fibre work, approved on 30 January 2020.

Our record for FN-TRAN-QSFPDD-SR8 cites 802.3bs for SR8. The module is right; the citation is not, and we are correcting it. The practical point behind the pedantry is that 400G on multimode is a later and narrower proposition than 400G on single-mode: SR8 wants a sixteen-fibre MPO and gives you 100 metres, while the DR4, FR4 and LR4 parts in the same group use far less fibre and go further. On an appliance with two or four 400G cages, that usually decides it. Choosing 400G optics works through the trade, and the real TCO of 400G puts numbers on it.

What the appliance checks, and what it does not

What a firewall, load balancer or packet broker reads when a module seats is the identification data in the module’s EEPROM, laid out to the SFF management specifications held in the SNIA SFF specifications library, and compares it against what its software release expects for that port. If the strings line up, the port comes up and the optic appears in the inventory like any other. If they do not, the behaviour on a security platform tends to the strict end of the range.

What the appliance does not do is measure the optic. It cannot tell you whether the launch power is in specification, whether the receiver sensitivity matches the data sheet, or whether the part will still be in specification in three years. That is why every Carritech module is measured against its specification before despatch — see the 22 checks a module passes. On a platform with four ports and no spare, a module that was measured before it shipped is worth more than one that was not, because there is nowhere to move the link to while you find out. Spotting a failing fibre link before it drops covers reading the diagnostics once it is in, and fibre optic connector cleaning is the cheapest decibel you will ever recover.

On the procurement questions, compatible optical transceivers vs OEM, OEM vs compatible: cost, risk and performance compared e do third-party optical transceivers void your warranty? answer them straight, which is the question most often asked about a module going into a security device.

Five checks before you order

• Specify the two sides separately. Inside and outside interfaces on the same appliance often want different reaches, different fibre grades and sometimes copper on one side.
• Record which ordering family the original came from — PAN- or PAN-T-, FN-TRAN- or FG-TRAN- — along with the appliance model and its software release.
• State the ambient temperature if the appliance is anywhere other than a machine room, so the extended-temperature rating gets confirmed rather than assumed.
• For copper, confirm the rate and the reach together, and confirm the appliance will power the module: a 10GBASE-T module is a far heavier electrical load than an optical one.
• At 40G and 100G, establish whether "BiDi" means one fibre or two before you plan the patching.

The security appliance optics Carritech stocks

Eighty tested part numbers across Fortinet, Palo Alto Networks, F5 and Gigamon codings, every one coded for the platform it is going into and measured against its specification before despatch. Listed by speed and form factor below.

155M and gigabit SFP — 14 parts

Filed at 155M, 8 parts. FG-TRAN-SX, FN-TRAN-FX, FN-TRAN-SFX, FN-TRAN-SX, FN-TRAN-SXI, FR-TRAN-SX, PAN-SFP-SX, PAN-T-S-SX. A note in the interests of accuracy: FN-TRAN-FX e FN-TRAN-SFX are genuine 100BASE-FX Fast Ethernet optics at 1310 nm over 2 km. The SX parts are 1000BASE-SX gigabit modules currently filed in our 155M category — a classification error on our side rather than a claim about the module. They are gigabit parts. If you need a genuine Fast Ethernet optic for an old out-of-band link, ask for 100FX explicitly. See 155M and 1.25G SFP modules and browse the 155M duplex SFP range.

1.25G duplex SFP, 6 parts. FN-TRAN-EX, FN-TRAN-LX, FR-TRAN-ZX, PAN-SFP-LX, PAN-SFP-ZX, PAN-T-S-LX. LX at 10 km, EX at 40 km and ZX at 80 km on single-mode. These are the parts that most often face a carrier handoff, where the reach you need is the reach to the exchange rather than the reach across the car park, so get the figure from the circuit order rather than from the building plan. Browse the 1.25G duplex SFP range and the 1.25G transceivers page.

Copper SFP and SFP+ — 6 parts

FN-TRAN-GC, FN-TRAN-SFP+GC, FN-TRAN-SFP+GC-T80, PAN-SFP-CG, PAN-SFP-PLUS10GBASE-T, PAN-T-S-CG. FN-TRAN-GC, PAN-SFP-CG e PAN-T-S-CG are the gigabit 1000BASE-T designs; FN-TRAN-SFP+GC e PAN-SFP-PLUS10GBASE-T are the 30-metre 10 Gigabit designs; and FN-TRAN-SFP+GC-T80 is the 80-metre part discussed above that we would rather you asked us about than read off the page. See copper SFP modules and browse copper SFP and SFP+.

10G SFP+ and XFP — 15 parts

10G duplex SFP+, 13 parts. F5-UPG-SFP+-R, FN-TRAN-SFP+ER, FN-TRAN-SFP+ERI, FN-TRAN-SFP+LR, FN-TRAN-SFP+LRI, FN-TRAN-SFP+SR, FN-TRAN-SFP+SRI, FN-TRAN-SFP+ZR, PAN-SFP-PLUS-ER, PAN-SFP-PLUS-LR, PAN-SFP-PLUS-SR, PAN-T-SPLUS-LR, PAN-T-SPLUS-SR. The full reach ladder: SR on multimode, LR at 10 km, ER at 40 km and ZR at 80 km. This is the single most ordered group in the range, because SFP+ is still the workhorse cage on security hardware. The port types come from IEEE Std 802.3ae-2002, approved at the June 2002 Standards Board meeting, and there is no forward error correction at 10G over fibre, which means an error counter on a 10G firewall interface means exactly what it appears to mean — a genuinely useful property when you are trying to work out whether a problem is the link or the inspection engine. See SFP-10G-SR: the full specification and browse the 10G duplex SFP+ range.

10G duplex XFP, 2 parts. PAN-XFP-LR, PAN-XFP-SR. For older high-end chassis whose cages are XFP rather than SFP+. XFP and SFP+ are not interchangeable and no adapter exists — but the optical interfaces link to each other, so you can replace one end of a span at a time. XFP transceivers explains both halves of that, and the 10G duplex XFP range is here.

25G SFP28 — 6 parts

FN-TRAN-SFP28-LR, FN-TRAN-SFP28-SR, PAN-SFP28-25GBASE-LR, PAN-SFP28-25GBASE-SR, PAN-T-S28-25GBASE-LR, PAN-T-S28-25GBASE-SR — SR and LR under both Palo Alto ordering families and Fortinet’s. 25 Gigabit Ethernet comes from IEEE Std 802.3by-2016, approved on 30 June 2016. FEC configuration is the usual reason a 25G link stays down, it is a host setting rather than a module property, and both ends have to agree — which on an appliance facing somebody else’s switch means agreeing it with somebody else. Settle it before the install window, not during it. See 25G SFP28 transceivers e forward error correction explained, and browse the 25G SFP28 range.

40G QSFP+ — 14 parts

F5-UPG-QSFP+, F5-UPG-QSFP+BD, FG-TRAN-QSFP+SR-BIDI, FN-TRAN-QSFP+ER, FN-TRAN-QSFP+LR, FN-TRAN-QSFP+LRI, FN-TRAN-QSFP+SR, FN-TRAN-QSFP-BIDI, PAN-QSFP40GBASE-BIDI, PAN-QSFP40GBASE-ER4, PAN-QSFP40GBASE-LR4, PAN-QSFP40GBASE-SR4, PAN-T-Q40GBASE-LR4, PAN-T-Q40GBASE-SR4. The largest single group in the range, and a good illustration of how long 40G lasts on security hardware: 40G QSFP+ transceivers is subtitled "the generation nobody is upgrading from" and firewalls are a large part of why. 40 Gigabit Ethernet arrived with IEEE Std 802.3ba-2010, approved in June 2010. Three things to pick out: the SR4 parts need an eight-fibre MPO trunk, the BIDI parts run over an existing duplex LC pair instead, and the ER4 parts reach 40 km on single-mode, which makes a 40G appliance interface viable across a metro rather than a campus. Most of these ports also break out to four 10G links where the platform supports it — breakout explained covers the mechanics. Browse the 40G QSFP+ range and the 40G transceivers page.

100G QSFP28 and CFP2 — 15 parts

100G QSFP28, 13 parts. F5-UPG-QSFP28-SR4, F5-UPG-QSFP28-SRBD, FN-TRAN-QSFP28-CWDM4, FN-TRAN-QSFP28-ER, FN-TRAN-QSFP28-LR, FN-TRAN-QSFP28-SR, PAN-QSFP28-100GBASE-BIDI, PAN-QSFP28-100GBASE-CWDM4, PAN-QSFP28-100GBASE-ER4, PAN-QSFP28-100GBASE-LR4, PAN-QSFP28-100GBASE-SR4, PAN-T-Q28-100GBASE-LR4, PAN-T-Q28-100GBASE-SR4. Five reach classes: SR4 on multimode from IEEE Std 802.3bm-2015, approved on 16 February 2015; CWDM4 at 2 km; LR4 at 10 km; ER4 at 40 km; and the ER4 Lite design, FN-TRAN-QSFP28-ER, which reaches 30 km without FEC or 40 km with it — a cost-optimised part that is exactly right when the span is 25 kilometres and a full ER4 is overkill. At 100G and above forward error correction is part of the interface and permanently on, so a healthy port shows a steadily climbing corrected-codeword count rather than zero. The 2 km decision is in 100G QSFP28 transceivers and the long-reach options in 100G ZR4 vs LR4 vs ER4. Browse the 100G QSFP28 range and the 100G transceivers page.

100G CFP2, 2 parts. FG-TRAN-CFP2-LR4, FG-TRAN-CFP2-SR10. One LR4 and one SR10. A word of caution on the SR10: 100GBASE-SR10 carries 100 Gigabit as ten 10G lanes over a 24-fibre MPO, while 100GBASE-SR4 carries it as four 25G lanes over twelve fibres. They are different interfaces and they will not link to each other or share cabling. Our record for the SR10 coding is currently mapped onto an SR4 profile and we are correcting it, so if your far end or your trunk is SR10, say so when you order and we will confirm the lane count and MPO size before anything ships. If you own CFP2 line cards, CFP, CFP2 and CFP4 sets out the four honest options, one of which is adapting the cage to QSFP28. Browse 100G CFP, CFP2 and CFP4.

400G QSFP-DD — 10 parts

F5-UPG-VEL-QDD-FR4, F5-UPG-VEL-QDD-LR4, FN-TRAN-QSFPDD-DR4, FN-TRAN-QSFPDD-FR4, FN-TRAN-QSFPDD-LR4, FN-TRAN-QSFPDD-SR8, OPT-0058-xx, QDD-503, QDD-511, QDD-514. Four reach classes plus the three Gigamon packet-broker SKUs: DR4 at 500 m, FR4 at 2 km and LR4 at 10 km on single-mode, and SR8 at 100 m on multimode from IEEE Std 802.3cm-2020. Note that OPT-0058-xx is a range-style F5 record rather than a single SKU — tell us the variant and we will supply it. Remember that a QSFP-DD cage will also take your existing QSFP28 optics, which is how a 400G-capable appliance gets deployed into a 100G fabric and upgraded later. See choosing 400G optics, 400G optical transceivers e 400ZR vs OpenZR+ for the coherent options, and browse the 400G QSFP-DD range and the 400G transceivers page.

Inside the rack, buy cable instead

Security appliances are usually racked next to the switches they protect, which makes this the easiest saving on the list above. For a short link from an appliance to the switch in the same cabinet, two transceivers and a patch lead cost more than a cable, draw power at both ends, and add two connectors to keep clean. The 10G SFP+ e 25G SFP28 direct attach ranges cover exactly that case, with active optical cable where the run is longer or the copper too stiff for the cable management. See DAC and AOC cables e DAC vs AOC.

The coding point applies with particular force here, because a cable assembly has an EEPROM at each end and each end faces a different vendor’s expectations. A Fortinet or Palo Alto appliance at one end and a Cisco, Arista or Juniper switch at the other means the assembly needs correct identification twice. Plenty of suppliers can code one end. Coding both is what the Opticode coding box does at the point of deployment, and it is the difference between a cable that works and a cable that comes up on one side only.

Getting security appliance optics without the OEM price

Carritech Optics holds the Fortinet, Palo Alto, F5 and Gigamon coded range in UK and EU stock, from 155M e 1.25G through 10G, 25G, 40G e 100G to 400G, with copper SFPs and adapters, patch cords e media converters alongside for the jobs a pluggable cannot do.

Every module is coded for the target platform and measured against its specification before despatch, and carries a garantia vitalícia. Security estates are the clearest case for holding one optical design per reach and coding at the point of deployment rather than one line item per OEM string, because the appliance population in a typical estate is more vendor-diverse than the switch population — a firewall refresh changes brand far more often than a switching refresh does. The argument is set out in building a smarter transceiver stock strategy, e your optics will go end-of-sale before your switch does is worth reading before you standardise. Our accreditations, why choose us e support pages cover how we work, and the knowledge centre holds the rest of the technical library.

Not sure whether a PAN- and a PAN-T- number are the same optic, whether an appliance will bring a 25G port up at 10G, or what rate a copper module will actually hold at 80 metres? Tell us the appliance model, the software release and what is at the far end and we will say. Our compatibility checker returns the tested Carritech equivalent of an OEM part number in seconds, upload a whole part-number list and we will price it, or request a quote.