XGS 3300
OCTEON TX · CN8365 · 12 front ports: 8 RJ45, 2 SFP, 2 SFP+ · run here
Run here
This project's drivers and plugin have been run on the XGS 3300 in the lab: every front port, the flows and IPsec in the coprocessor. Every number taken on it is in the measurements, and the appliance itself, photographed part by part, on its hardware page.
At a glance
| model | board | state |
|---|---|---|
| XGS 3300 | AMDA0202-0004 |
run here |
The OCTEON TX family, driven by octep: 12 front ports (8 RJ45, 2 SFP, 2 SFP+), the interfaces oxp0 to oxp11, and the internet on Port2 when the first boot sets the appliance up by itself.
Reported by appliances of this model
11 problem reports have come from appliances of this model on their own, the first on 2026-10-17 and the last on 2026-10-21 - so the plugin runs on at least one. See them.
What they were about: driver-not-ready 1, kernel-panic 2, log-error 6, manual 1, unexpected-reset 1.
The front panel
behind the 88E6193X switchon the coprocessor itselfthe bypass pair, Port1 and Port2
Drawn from the appliance here: the places and the labels are its own.
Every port
In the order of the host's interfaces, oxpN. The tag is the coprocessor's name for the port, which the driver uses; a port behind the switch reaches the coprocessor through the switch's one link to it.
| label | socket | speed | interface | tag | attached to | |
|---|---|---|---|---|---|---|
| F1 | SFP+ | 10G | oxp0 |
0x0001 |
the coprocessor's QLM5, through the 88X5113 | |
| F2 | SFP+ | 10G | oxp1 |
0x0002 |
the coprocessor's QLM6, through the 88X5113 | |
| Port1 | RJ45 | 1G | oxp2 |
0x8100 |
switch port 1 | bypass |
| Port2 | RJ45 | 1G | oxp3 |
0x8200 |
switch port 2 | bypass |
| Port3 | RJ45 | 1G | oxp4 |
0x8300 |
switch port 3 | |
| Port4 | RJ45 | 1G | oxp5 |
0x8400 |
switch port 4 | |
| Port5 | RJ45 | 1G | oxp6 |
0x8500 |
switch port 5 | |
| Port6 | RJ45 | 1G | oxp7 |
0x8600 |
switch port 6 | |
| Port7 | RJ45 | 1G | oxp8 |
0x8700 |
switch port 7 | |
| Port8 | RJ45 | 1G | oxp9 |
0x8800 |
switch port 8 | |
| F3 | SFP | 1G | oxp10 |
0x8900 |
switch port 9 | |
| F4 | SFP | 1G | oxp11 |
0x8a00 |
switch port 10 |
The board
Two computers in one box: the host runs OPNsense and reaches a front port only through the coprocessor, which owns them all. The links and the MACs are the vendor's board file's and device tree's, and were read on this appliance.
Technical details
| part | detail | source |
|---|---|---|
| host | AMD Ryzen Embedded V1780B, 8 threads, 16 GB | read here |
| host to coprocessor | PCIe 177d:a300, an SDP endpoint | read here |
| coprocessor | CN8365 (OCTEON TX (CN83XX)) | board file |
| switch | 88E6193X · its link: QLM4, 10G | read here |
| PHYs on the coprocessor's own ports | 88X5113 | board file |
| the vendor's platform | xgs1us |
board file |
| storage | 240 GB SATA SSD or more | datasheet |
| console and management | MGMT (RJ45), COM (RJ45), Micro-USB | datasheet |
| other ports | 2 x USB 3.0, USB 2.0 | datasheet |
| module slots | 1 · module bay A | datasheet |
| display | LCD | datasheet |
| bypass | the bypass pair, Port1 and Port2 | datasheet |
| form | 1U rack · 438 x 44 x 405 mm · 4.7 kg | datasheet |
| power supply | internal | datasheet |
| power drawn | XGS 3300: 50 W idle, 201 W at most | datasheet |
Expansion modules
Bay A is the coprocessor's: a module's ports are its own, and the driver binds each as an interface named as on the metal. The modules the vendor's datasheet lists for it - every module:
| module | ports | in this model |
|---|---|---|
| 8 x 1000Base-T | 8: 8 RJ45 | added, untested |
| 8 x 1000Base-SX (SFP) | 8: 8 SFP | added, untested |
| 4 x 10GBase-SR (SFP+) | 4: 4 SFP+ | run here |
| 4 x 1000Base-T, fail-to-wire | 4: 4 RJ45 | added, untested |
| 4 x 1000Base-T, 4 x 1000Base-T PoE | 8: 8 RJ45 | added, untested |
| 2 x NBase-T (RJ45), 2 x 10GBase-SR (SFP+) | 4: 2 RJ45, 2 SFP+ | added, untested |
| 4 x 1000Base-SX (SFP), 2 x 1000Base-SX fail-to-wire | 6: 6 SFP | added, untested |
The vendor's figures
As the vendor's datasheet prints them; not measured here. Its stated method is Keysight-Ixia BreakingPoint under ideal conditions; the MTU, the ports and whether a figure counts both directions are not stated. What was measured on it, with how and what it does not show: the measurements.
| edition 2026-09 | |
|---|---|
| Firewall | 58 Gbps |
| Firewall IMIX | 27 Gbps |
| Firewall latency (64-byte UDP) | 4 µs |
| IPS | 14 Gbps |
| Threat protection | 10 Gbps |
| NGFW | 12.5 Gbps |
| Concurrent connections | 13,700,000 |
| New connections a second | 257,800 |
| IPsec VPN | 31.1 Gbps |
| IPsec VPN tunnels | 6,500 |
| SSL VPN tunnels | 5,000 |
| TLS inspection | 3.13 Gbps |
| TLS inspection connections | 102,400 |
Photographed
The board part by part, and how each part was read: the hardware page; the same, drawn: the drawing.
Where each fact was read
- the vendor's board files:
xgs-bsp/data/<assembly>.txt, the vendor's board file (GPL release, SDK 10.22.03) - the vendor's board files:
xgs-check-uboot-version.sh, the vendor's map of assembly to platform - read here: the two XGS 3300s run here
- the vendor's datasheet: Sophos Firewall brochure, PDF of 2026-09-08
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.