Skip to content

XGS 138

ARMADA · CN9131 · 8 front ports: 6 RJ45, 2 SFP+ · added, untested

Added, untested

Added from the vendor's board file and device tree - research and development, because there is no XGS 138 here to test on. It installs, its status page says so, and its first boot holds its ports against what its coprocessor reports: an owner's report confirms this page or corrects it. Appliances of these models will be bought to test on.

At a glance

model board state
XGS 138 AMDA0224-0001 added, untested

The ARMADA family, driven by npuep: 8 front ports (6 RJ45, 2 SFP+), the interfaces npup1 to npup8, and the internet on Port1 when the first boot sets the appliance up by itself.

Reported by appliances of this model

No appliance of this model has reported yet. If you have one: report it.

The back panel, where the ports are

COMUSBF1 · npup7 · tag 0x0000 · 10G · CP0 eth0F1F2 · npup8 · tag 0x0002 · 10G · CP1 eth0F2Port1 · npup1 · tag 0x8100 · 1G · switch port 11Port2 · npup2 · tag 0x8200 · 1G · switch port 22Port3 · npup3 · tag 0x8300 · 1G · switch port 33Port4 · npup4 · tag 0x8400 · 1G · switch port 44Port5 · npup5 · tag 0x0001 · 2.5G · CP0 eth2 - AQR412 · PoE5Port6 · npup6 · tag 0x0004 · 2.5G · CP1 eth2 - AQR412 · PoE6module bay
Point at a port for its interface, tag and path; a click goes to its row.

behind the 88E6193X switchon the coprocessor itselfPoE

Approximate. The ports, their sockets, labels and speeds are the vendor's board file's; where they sit is modelled on the panel of the XGS 136, not seen on this model.

Every port

In the order of the host's interfaces, npupN. The tag is the coprocessor's name for the port, which the driver uses; a port behind the switch reaches the coprocessor through the switch's one link to it.

label socket speed interface tag attached to
Port1 RJ45 1G npup1 0x8100 switch port 1
Port2 RJ45 1G npup2 0x8200 switch port 2
Port3 RJ45 1G npup3 0x8300 switch port 3
Port4 RJ45 1G npup4 0x8400 switch port 4
Port5 RJ45 2.5G npup5 0x0001 the coprocessor's CP0 eth2, through the AQR412 PoE
Port6 RJ45 2.5G npup6 0x0004 the coprocessor's CP1 eth2, through the AQR412 PoE
F1 SFP+ 10G npup7 0x0000 the coprocessor's CP0 eth0, straight to the cage
F2 SFP+ 10G npup8 0x0002 the coprocessor's CP1 eth0, straight to the cage

The board

88E6193X switchits link: CP1 eth1, 5GBASE-KRPort1 · npup1 · tag 0x8100 · 1G · switch port 11Port2 · npup2 · tag 0x8200 · 1G · switch port 22Port3 · npup3 · tag 0x8300 · 1G · switch port 33Port4 · npup4 · tag 0x8400 · 1G · switch port 44AQR412 PHYon the coprocessor's own MACsPort5 · npup5 · tag 0x0001 · 2.5G · CP0 eth2 - AQR412 · PoE5 · CP0 eth2Port6 · npup6 · tag 0x0004 · 2.5G · CP1 eth2 - AQR412 · PoE6 · CP1 eth2SFP+ cages, straight to the coprocessoron the coprocessor's own MACsF1 · npup7 · tag 0x0000 · 10G · CP0 eth0F1 · CP0 eth0F2 · npup8 · tag 0x0002 · 10G · CP1 eth0F2 · CP1 eth0Host · x86not read herePCIe 11ab:7080CoprocessorCN9131 · AP807 + two CP115platform xgsdt2-138

Two computers in one box: the host runs OPNsense and reaches a front port only through the coprocessor, which owns them all. The links and the MACs are the vendor's board file's and device tree's; the host is what has been read of it; nothing here has been seen on this model.

Technical details

part detail source
host not read here
host to coprocessor PCIe 11ab:7080 board file
coprocessor CN9131 (AP807 + two CP115) board file
switch 88E6193X · its link: CP1 eth1, 5GBASE-KR device tree
PHYs on the coprocessor's own ports AQR412 board file
the vendor's platform xgsdt2-138 board file
storage 64 GB M.2 datasheet
console and management COM (RJ45), Micro-USB datasheet
other ports USB 2.0, USB 3.0 datasheet
module slots 1 datasheet
PoE 2 x 2.5 GE, 30 W a port datasheet
form desktop · 320 x 44 x 212 mm · 2.4 kg datasheet
power supply external · 150 W datasheet
power drawn XGS 138: 33 W idle, 51 W at most datasheet

Expansion modules

Its bay is the host's, not the coprocessor's: the vendor sells 5G for it. None has been fitted here, and none goes through the coprocessor.

The vendor's figures

As the vendor's datasheet prints them; not measured here. Its stated method is Keysight-Ixia BreakingPoint under ideal conditions; the MTU, the ports and whether a figure counts both directions are not stated.

edition 2026-09
Firewall 19.1 Gbps
Firewall IMIX 10.5 Gbps
IPS 5.85 Gbps
Threat protection 4.75 Gbps
NGFW 5.1 Gbps
Concurrent connections 6,550,000
New connections a second 105,000
IPsec VPN 6.6 Gbps
IPsec VPN tunnels 2,500
SSL VPN tunnels 1,500
TLS inspection 1.7 Gbps
TLS inspection connections 18,432

If you have one

Install it and it runs as this page says. Ten minutes after its first boot, portcheck.py holds the ports above against what its coprocessor reports and, with problem reports on, files the answer - which is what confirms this page or corrects it. Or say what works yourself: report your appliance.

Where each fact was read

  • the vendor's board files: xgs-bsp/data/<assembly>.txt, the vendor's board file (GPL release, SDK 10.22.03)
  • the vendor's device tree: sdk-ext-sophos patches dt1, dt2 and dt2-138, the vendor's device trees
  • the vendor's board files: xgs-check-uboot-version.sh, the vendor's map of assembly to platform
  • the vendor's board files: xgs-host-startup.sh, where the vendor's host tells the families apart by PCI id
  • the vendor's datasheet: Sophos Firewall brochure, PDF of 2026-09-08

Discussion

The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.