Trellix IPS products have supported third-party AFO Bypass Kit solutions from Q3 2022 onward. Initially, Keysight and Niagara Networks solutions were supported.
IMPORTANT: Limited visibility of the AFO Kit status in the Manager will be supported in future software releases.
Third-party solutions will require configuration through the AFO Kit's management GUI. Configuration details will be available as part of the vendor device user guides.
Basic Feature Comparison
Feature |
Trellix |
Keysight 10G |
Keysight 40G |
Niagara |
Architecture |
Chassis with three module bays |
Fixed Config chassis |
Chassis with two module bays |
Chassis with two module bays |
Form Factor |
1U |
1U |
1U |
1U |
Max 10G segments (SR or LR) per module |
2 |
2 |
- |
4 |
Max 10G segments (SR or LR) per 1 RU |
6 |
4* |
- |
8 |
Max 40G SR segments per module |
1 |
- |
1 |
2 |
Max 40G SR segments per 1RU |
3 |
- |
2 |
2 |
Max 40G LR segments per module |
1 |
- |
1 |
4 |
Max 40G LR segments per 1RU |
3 |
- |
2 |
8 |
Max 40G BiDi Segments per module |
1 |
0 |
0 |
0 |
Max 40G BiDi Segment per 1RU |
3 |
0 |
0 |
0 |
* Two chassis mounted side by side in 1RU.
Trellix AFO SKUs
SKU |
AFO kits per chassis |
Description |
IAC-AFOCH40-KT2 |
3 |
Chassis for 40G and 10G AFO kits |
IAC-4P10FOSR-KIT |
- |
Dual segment 10G SR AFO kit |
IAC-4P10FOLR-KIT |
|
Dual segment 10G LR AFO Kit |
IAC-2P40FOSR4-KIT |
- |
Single segment 40G SR4 AFO kit |
IAC-2P40FOLR4-KIT |
|
Single segment 40G LR4 AFO Kit |
IAC-2P40FOBD-KIT |
|
Single segment 40G BiDi AFO Kit |
- 1U chassis supports three AFO modules.
- 10G and 40G modules can be used in the same chassis.
- Can support a maximum of 6x10G or 3x40G segments in a 1U form factor.
- Monitor port transceivers are supplied with the kit.
Keysight AFO SKUs
SKU |
AFO modules per chassis |
Description |
IBPDUO-1X10-SR |
|
Single segment 10G/1G SR AFO kit |
IBPDUO-2X10-SR |
- |
Dual segment 10G/1G SR AFO kit |
IBPDUO-1X10-LR |
|
Single segment 10G/1G LR AFO kit |
IBPDUO-2X10-LR |
- |
Dual segment 10G/1G LR AFO kit |
IBP100G-CH-AC-T |
2 |
AFO chassis supporting 40G or 100G modules |
MIBP-40100-SR4-T |
- |
Single segment 40G/100G SR4 module |
MIBP40G-LR4-T |
- |
Single segment 40G LR4 module |
LIC-MIBP-40 |
- |
Node locked perpetual license for 1x40G module |
- 10G AFO kits are 1U, half-rack width boxes. Two can be deployed side by side in 1RU.
- A 1U 40G chassis has two module bays; each module supports one segment.
- Monitor port transceivers need to be ordered separately.
Niagara Networks SKU
SKU |
AFO modules per chassis |
Description |
3808E-MN-AC |
2 |
Chassis for 40G and 10G AFO modules |
3808E-SG-10G-SR-2B |
- |
Dual segment 10G/1G SR AFO module |
3808E-SG-10G-LR-2B |
|
Dual segment 10G/1G LR AFO module |
3808E-SG-10G-SR-4B+8 |
- |
Quad segment 10G/1G SR AFO module |
3808E-SG-10G-LR-4B+8 |
|
Quad segment 10G/1G LR AFO module |
3808E-SG-40G-SR4-2B+4 |
|
Dual segment 40G SR4 AFO module |
3808E-SG-40G-LR4-2B+4 |
|
Dual segment 40G LR4 AFO module |
3808E-SG-40G-LR4-4B |
|
Quad segment 40G LR4 AFO module |
- A 1U chassis supports two AFO modules.
- 10G and 40G modules can be used in the same chassis.
- Can support a maximum of eight segments (40G or 10G) in a 1U form factor.
- Monitor port transceivers need to be ordered separately.
Solution Guide for Deployment Scenarios
Deployment |
Trellix solution |
Keysight solution |
Niagara solution |
1–2 10G segments (SR or LR) |
1x IAC-AFOCH40-KT2 +
1x IAC-4P10FOxx-KIT |
1x IBPDUO-2X10-xx |
1x 3808E-MN-AC +
1x 3808E-SG-10G-xx-2B |
3–4 10G segments (SR or LR) |
1x IAC-AFOCH40-KT2 +
2x IAC-4P10FOxx-KIT |
2x IBPDUO-2X10-xx |
1x 3808E-MN-AC +
1x 3808E-SG-10G-xx-4B+8 |
5–6 10G segments (SR or LR) |
1x IAC-AFOCH40-KT2 +
3x IAC-4P10FOxx-KIT |
3x IBPDUO-2X10-xx |
1x 3808E-MN-AC +
1x 3808E-SG-10G-xx-4B+8 +
1x 3808E-SG-10G-xx-2B |
1 segment 40G (SR or LR) |
1x IAC-AFOCH40-KT2 +
1x IAC-2P40FOxx4-KIT |
1x IBP100G-CH-AC-T +
1x MIBP-40100-SR4-T for SR or
1x MIBP40G-LR4-T for LR |
1x 3808E-MN-AC +
1x 3808E-SG-40G-xx4-2B+4 |
2 segments 40G (SR or LR) |
1x IAC-AFOCH40-KT2 +
2x IAC-2P40FOxx4-KIT |
1x IBP100G-CH-AC-T +
2x MIBP-40100-SR4-T for SR or
2x MIBP40G-LR4-T for LR |
1x 3808E-MN-AC +
1x 3808E-SG-40G-xx4-2B+4 |
3 segments 40G (SR) |
1x IAC-AFOCH40-KT2 +
3x IAC-2P40FOSR4-KIT |
2x IBP100G-CH-AC-T +
3x MIBP-40100-SR4-T |
1x 3808E-MN-AC +
2x 3808E-SG-40G-SR4-2B+4 |
3 segments 40G (LR) |
1x IAC-AFOCH40-KT2 +
3x IAC-2P40FOLR4-KIT |
2x IBP100G-CH-AC-T +
3x MIBP40G-LR4-T |
1x 3808E-MN-AC +
1x 3808E-SG-40G-LR4-4B |
NOTES:
- Only Deployment scenarios supported by a Trellix AFO Chassis are shown.
- Replace xx with SR or LR as appropriate.
FAQS:
Which Trellix IPS products are compatible with new AFO kits?
10G kits are compatible with NS9500 and NS7500. 40G kits are compatible with NS9500.
Will the new AFO kits be detected by the Manager like the Trellix AFO kits?
No. Limited visibility into Mfr. Type and Inline status will be included in future SW releases. Full visibility of the AFO kit is available through the Vendor's management GUI.
Do the new AFO kits require additional setup?
Yes. Unlike Trellix AFO solutions, the new AFO kits require configuration to associate network ports and monitor ports. Configuration needs to be done through the AFO kit's management GUI. Details are available in the vendor product user guide.
How will Trellix provide support?
Support for third-party AFO Bypass Kits is provided by the product vendor. You must purchase a relevant support SKU from the vendor.
Are there any Trellix AFO kit SKUs for which there's no equivalent from Keysight or Niagara Networks?
Yes. 40G BiDi kits are currently not available from either vendor. Discussions are ongoing between Trellix and third-party vendors about adding BiDi SKUs to their portfolio.