SFP

This page details Palo Alto Networks SFP/SFP+ information.

Palo Alto Networks have an official PDF that maps the PAN SKU to the Finisar equivalent here.

This page gives a good overview of multi mode fibre vs single mode fibre.

This page gives Palo Alto Networks official policy on third party components.

This page gives a good overview of how to get installed SFP module information.

On PAN-OS, use this command to see information on installed transceivers.

show system state filter sys.s1.p2.phy

• Multimode fiber cable has a relatively large light carrying core, usually 62.5 microns or larger in diameter. It is usually used for short distance transmissions with LED based fiber optic equipment. Single-mode fiber has a small light carrying core of 8 to 10 microns in diameter. It is normally used for long distance transmissions with laser diode based fiber optic transmission equipment.
• Multimode cable is made of of glass fibers, with a common diameters in the 50-to-100 micron range for the light carry component (the most common size is 62.5). POF is a newer plastic-based cable which promises performance similar to glass cable on very short runs, but at a lower cost.
• Multimode fiber gives you high bandwidth at high speeds over medium distances. Light waves are dispersed into numerous paths, or modes, as they travel through the cable’s core typically 850 or 1300nm. Typical multimode fiber core diameters are 50, 62.5, and 100 micrometers. However, in long cable runs (greater than 3000 feet [914.4 ml), multiple paths of light can cause signal distortion at the receiving end, resulting in an unclear and incomplete data transmission.
• Single Mode fibre cable is a single stand of glass fiber with a diameter of 8.3 to 10 microns that has one mode of transmission. Single Mode Fiber with a relatively narrow diameter, through which only one mode will propagate typically 1310nm or 1550nm. Carries higher bandwidth than multimode fiber, but requires a light source with a narrow spectral width. Synonyms mono-mode optical fiber, single-mode fiber, single-mode optical waveguide, uni-mode fiber.
• Single-mode fiber gives you a higher transmission rate and up to 50 times more distance than multimode, but it also costs more. Single-mode fiber has a much smaller core than multimode. The small core and single light-wave virtually eliminate any distortion that could result from overlapping light pulses, providing the least signal attenuation and the highest transmission speeds of any fiber cable type.
• Single-mode optical fiber is an optical fiber in which only the lowest order bound mode can propagate at the wavelength of interest typically 1300 to 1320nm.

SFP Overview

• SFP - Small Form Pluggable
• SFP+ - Enhanced Small Form Pluggable
• SR - Short Reach
• LR - Long Reach
• XR - Extended Reach
• CU - Copper Twinax (Also called Direct-Attach)
• XFP is a slightly larger form factor than the popular small form-factor pluggable transceiver, SFP and SFP+.

Also known as Direct Attach (DA), Direct Attach Copper (DAC) or 10GbE Cu SFP cables. Short Direct Attach cables use a passive twin-ax cable assembly while longer ones, sometimes called active optical cable (AOC) use short wavelength optics. Both types connect directly into an SFP+ housing. SFP+ Direct Attach has a fixed-length cable, typically 1 to 7 m (passive cables), up to 15 m (active cables), or up to 100 m in length (active optical cables). Like 10GBASE-CX4, DA is low-power, low-cost and low-latency with the added advantages of using less bulky cables and of having the small form factor of SFP+.

I have tested Amphenol SFP+ DAC cables on PA-5220 firewalls running PANOS 8.1 and found they work fine. Vendor part number is 588680003.

Palo Alto Networks offer three cables where the transceivers are bonded to the cable.

• PAN-QSFP28-AOC-10M is a 10m active optical cable with two 100Gb QSFP28 transceivers bonded to it. It is for the HSCI ports of the PA-5250 and PA-5260 firewalls as these firewalls' HSCI ports are 40/100Gb QSFP28.
• PAN-QSFP-AOC-10M is a 10m active optical cable with two 40Gb QSFP+ transceivers bonded to it. It is for the HSCI ports of the PA-5220 firewalls as this firewall's HSCI port is a 40Gb QSFP port
• PAN-SFP-PLUS-CU-5M is a 5m twin-ax passive cable with two 10Gb SFP+ transceivers bonded to it. It is for the HSCI ports of the PA-3200 series as these firewalls' HSCI ports are SFP+.

You can also buy the transceivers without the cables and attached a cable of the correct length. However, this is more expensive than buying the bonded cable when considering QSFP/QSFP28.

For HA2 connections, a “Cat 6” or “Cat 6a” Ethernet cable may suffice for the HA2 link requirement. Remember, “Cat 6a” can support 10Gbs. The PA-5200 series of Palo Alto Networks firewalls support 10Gbps on their Ethernet ports.

• 1 Gbit/s multi-mode fiber, LC connector, with black or beige extraction lever
• * SX – 850 nm, for a maximum of 550 m at 1.25 Gbit/s (gigabit Ethernet). Other multi-mode SFP applications support even higher rates at shorter distances.
• 1.25 Gbit/s multi-mode fiber, LC connector, extraction lever colors not standardised
• * SX+/MX/LSX (name dependent on manufacturer) – 1310 nm, for a distance up to 2 km. Not compatible with SX or 100BASE-FX. Based on LX but engineered to work with a multi-mode fiber using a standard multi-mode patch cable rather than a mode-conditioning cable commonly used to adapt LX to multi-mode.
• 1 to 2.5 Gbit/s single-mode fiber, LC connector, with blue extraction lever
• * LX – 1310 nm, for distances up to 10 km (originally, LX just covered 5 km and LX10 for 10 km followed later)
• * EX – 1310 nm, for distances up to 40 km
• * ZX – 1550 nm, for distances up to 80 km (depending on fiber path loss), with green extraction lever (see GLC-ZX-SM1)
• * EZX – 1550 nm, for distances up to 160 km (depending on fiber path loss)

Note: PAN-SFP-PLUS-10GBASE-T is not supported on the PA-3200 series. Its ommision from the list supported firewalls is not a typo.

QSFP+ is 4 x 10 Gbit/s

QSFP+ (QSFP28) = 4 x 28 Gbit/s