The story¶
How a firewall with no ports became one with every port: eight months of looking, the open sources read for what they say, two coprocessors that share nothing, and the last hop - told in eleven chapters, with the photographs.
Before the repository¶
-
For a long time before any of this began, a Sophos XG 330 sat in my network running OPNsense.
-
In December 2024 I bought a Sophos XGS 136, with a two-year Sophos licence on it.
-
From that spring, for eight months and a few weeks, nothing was built.
-
At the start of 2026 - nine months before these pages were written - the first Sophos XGS 3300 arrived, and with it a new chapter: a generation whose support was still running, different hardware, and a story of its own.
-
5. Reverse engineering, from the open sources
The adapters failed because they started at the wrong end.
-
6. A firmware of its own, and a board of many chips
With the sources read, the attempts came in stages - and most of the stages failed.
-
7. The host and the coprocessor
The way through was to stop fighting the coprocessor, and to learn instead how the host and the coprocessor deal with each other.
In the repository¶
-
8. Fourteen ports on the XGS 136
The XGS 136 - assembly AMDA0201, a Marvell CN9131 coprocessor of the ARMADA family behind PCIe id
11ab:7080- was the first of the two to carry traffic. -
9. The XGS 3300 and the last hop
On the XGS 3300 the control plane came up early: the handshake completed, the network agent answered, RPC worked.
-
Front ports as interfaces made the appliances firewalls again - with every packet crossing the host.
-
A driver that works on a bench is not yet an appliance.
Alongside¶
-
Close to two years, in one table.
-
It is not a technique, and it does not fit in a table.