XGS 3100
OCTEON TX · CN8365 · 12 front ports: 8 RJ45, 2 SFP, 2 SFP+ · added, untested
Added, untested
Added from the vendor's board file and device tree - research and development, because there is no XGS 3100 here to test on. It installs, its status page says so, and its first boot holds its ports against what its coprocessor reports: an owner's report confirms this page or corrects it. Appliances of these models will be bought to test on.
At a glance
| model | board | state |
|---|---|---|
| XGS 3100 | AMDA0202-0003 |
added, untested |
The OCTEON TX family, driven by octep: 12 front ports (8 RJ45, 2 SFP, 2 SFP+), the interfaces oxp0 to oxp11, and the internet on Port2 when the first boot sets the appliance up by itself.
Reported by appliances of this model
No appliance of this model has reported yet. If you have one: report it.
The front panel
behind the 88E6193X switchon the coprocessor itselfthe bypass pair, Port1 and Port2
Approximate. The ports, their sockets, labels and speeds are the vendor's board file's; where they sit is modelled on the panel of the XGS 3300, not seen on this model.
Every port
In the order of the host's interfaces, oxpN. The tag is the coprocessor's name for the port, which the driver uses; a port behind the switch reaches the coprocessor through the switch's one link to it.
| label | socket | speed | interface | tag | attached to | |
|---|---|---|---|---|---|---|
| F1 | SFP+ | 10G | oxp0 |
0x0001 |
the coprocessor's QLM5, through the 88X5113 | |
| F2 | SFP+ | 10G | oxp1 |
0x0002 |
the coprocessor's QLM6, through the 88X5113 | |
| Port1 | RJ45 | 1G | oxp2 |
0x8100 |
switch port 1 | bypass |
| Port2 | RJ45 | 1G | oxp3 |
0x8200 |
switch port 2 | bypass |
| Port3 | RJ45 | 1G | oxp4 |
0x8300 |
switch port 3 | |
| Port4 | RJ45 | 1G | oxp5 |
0x8400 |
switch port 4 | |
| Port5 | RJ45 | 1G | oxp6 |
0x8500 |
switch port 5 | |
| Port6 | RJ45 | 1G | oxp7 |
0x8600 |
switch port 6 | |
| Port7 | RJ45 | 1G | oxp8 |
0x8700 |
switch port 7 | |
| Port8 | RJ45 | 1G | oxp9 |
0x8800 |
switch port 8 | |
| F3 | SFP | 1G | oxp10 |
0x8900 |
switch port 9 | |
| F4 | SFP | 1G | oxp11 |
0x8a00 |
switch port 10 |
The board
Two computers in one box: the host runs OPNsense and reaches a front port only through the coprocessor, which owns them all. The links and the MACs are the vendor's board file's and device tree's; the host is what has been read of it; nothing here has been seen on this model.
Technical details
| part | detail | source |
|---|---|---|
| host | not read here | |
| host to coprocessor | PCIe 177d:a300 | board file |
| coprocessor | CN8365 (OCTEON TX (CN83XX)) | board file |
| switch | 88E6193X · its link: QLM4, 10G | read here |
| PHYs on the coprocessor's own ports | 88X5113 | board file |
| the vendor's platform | xgs1us |
board file |
| storage | 240 GB SATA SSD or more | datasheet |
| console and management | MGMT (RJ45), COM (RJ45), Micro-USB | datasheet |
| other ports | 2 x USB 3.0, USB 2.0 | datasheet |
| module slots | 1 · module bay A | datasheet |
| display | LCD | datasheet |
| bypass | the bypass pair, Port1 and Port2 | datasheet |
| form | 1U rack · 438 x 44 x 405 mm · 4.7 kg | datasheet |
| power supply | internal | datasheet |
| power drawn | XGS 3100: 50 W idle, 182 W at most | datasheet |
Expansion modules
Bay A is the coprocessor's: a module's ports are its own, and the driver binds each as an interface named as on the metal. The modules the vendor's datasheet lists for it - every module:
| module | ports | in this model |
|---|---|---|
| 8 x 1000Base-T | 8: 8 RJ45 | added, untested |
| 8 x 1000Base-SX (SFP) | 8: 8 SFP | added, untested |
| 4 x 10GBase-SR (SFP+) | 4: 4 SFP+ | added, untested |
| 4 x 1000Base-T, fail-to-wire | 4: 4 RJ45 | added, untested |
| 4 x 1000Base-T, 4 x 1000Base-T PoE | 8: 8 RJ45 | added, untested |
| 2 x NBase-T (RJ45), 2 x 10GBase-SR (SFP+) | 4: 2 RJ45, 2 SFP+ | added, untested |
| 4 x 1000Base-SX (SFP), 2 x 1000Base-SX fail-to-wire | 6: 6 SFP | added, untested |
The vendor's figures
As the vendor's datasheet prints them; not measured here. Its stated method is Keysight-Ixia BreakingPoint under ideal conditions; the MTU, the ports and whether a figure counts both directions are not stated.
| edition 2026-09 | |
|---|---|
| Firewall | 47 Gbps |
| Firewall IMIX | 23.5 Gbps |
| Firewall latency (64-byte UDP) | 4 µs |
| IPS | 10.5 Gbps |
| Threat protection | 7.4 Gbps |
| NGFW | 9 Gbps |
| Concurrent connections | 12,260,000 |
| New connections a second | 186,500 |
| IPsec VPN | 25 Gbps |
| IPsec VPN tunnels | 6,500 |
| SSL VPN tunnels | 5,000 |
| TLS inspection | 2.47 Gbps |
| TLS inspection connections | 55,296 |
If you have one
Install it and it runs as this page says. Ten minutes after its first boot, portcheck.py holds the ports above against what its coprocessor reports and, with problem reports on, files the answer - which is what confirms this page or corrects it. Or say what works yourself: report your appliance.
Where each fact was read
- the vendor's board files:
xgs-bsp/data/<assembly>.txt, the vendor's board file (GPL release, SDK 10.22.03) - the vendor's board files:
xgs-check-uboot-version.sh, the vendor's map of assembly to platform - the vendor's board files:
xgs-host-startup.sh, where the vendor's host tells the families apart by PCI id - read here: the two XGS 3300s run here
- the vendor's datasheet: Sophos Firewall brochure, PDF of 2026-09-08
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.