24 x 25Gb SFP28, 2 x 100Gb QSFP28, Packet Broker

PB-APP: packet broker as a containerized application

PB-APP runs as a container on AsterNOS rather than as a separate operating system, so the switch retains its Enterprise SONiC L2/L3 stack while adding dedicated traffic-orchestration logic. Configuration, rule management, and visualization are handled through a Web UI with drag-and-drop policy workflows and real-time hit counters, alongside CLI, RESTful API, SNMP, Syslog, and Prometheus/Grafana integration for teams standardizing on existing O&M tooling.

Role-based port isolation

Each of the data ports is assigned one of four roles — Network, Service, Tool, or Hybrid — separating production traffic ingress, service-chained inline paths, and tool-facing egress on the same device. This isolation model prevents analysis traffic from being reinjected into the production path.

Deep multi-tunnel parsing

PB-APP decapsulates GRE, VXLAN, GTP-U, MPLS, ERSPAN, IPinIP, CFP, and PPPoE tunnels, then matches inner-layer 5-tuple fields for filtering and load-balancing decisions — supporting visibility into overlay and mobile-core traffic without an upstream decapsulation step.

Multi-dimensional precision ACL

Ingress and egress filtering spans L2, L3, L3V6, EX, EM, and EMV6 rule types, matched against 5-tuple, VLAN, MAC, port range, TCP flags, VNI, DSCP, and inner/outer IP fields, with any combination of fields supported per rule. Rules can be reprioritized, searched, and batch-managed from the Web UI, with hit counters tracked per rule and per policy.

Traffic replication, forwarding, and load balancing

Matched traffic can be mirrored (local SPAN, RSPAN, or ERSPAN to an L3 port), replicated to single ports, LAGs, or combined port+LAG groups, or forwarded/dropped by ACL match. Hardware truncation to 128 bytes reduces the volume sent downstream. Four LAG modes — Flexible, Static, Weight, and Standby — distribute output across tool ports, with custom hash keys, symmetric hashing, and configurable hash seeds to balance probe bandwidth.

Nanosecond timestamping

PB-APP appends packet-level nanosecond timestamps using IEEE 1588v2 PTP synchronization, giving downstream analysis tools a common time reference for performance profiling, security auditing, and fault demarcation.

Passive and inline deployment

The PX202P-24Y-M supports both passive mode, tapping SPAN/RSPAN/ERSPAN sources without sitting in the data path, and inline mode, where the packet broker sits directly between core and edge devices to chain traffic through IPS or firewall tools — reducing the optical transceiver count required for a comparable dedicated-appliance deployment.

Architecture & performance

• Multi-rate 1/2.5/5/10/25/40/50/100/200/400G Ethernet ports support across the family

• Integrated Arm®-based multi-core CPU cluster for embedded application and service offload

• Programmable ingress/egress pipelines with dedicated packet buffer and traffic manager

• Supports 400G-ZR pluggable coherent optical modules for edge DCI connectivity

Timing & synchronization

• PTP IEEE 1588v1/v2, ITU-T G.8273.2 Class C compliant for nanosecond-scale time accuracy

• SyncE per ITU-T G.8261/G.8264 frequency recommendations

• IEEE 802.1CM-2018 Profile B TSN and 802.1Qbu frame preemption for deterministic packet delay control

• Security — SecureIQ & MACsec

Security — SecureIQ & MACsec

• Line-rate IEEE 802.1AE MACsec GCM-AES-128/256 and GCM-AES-XPN-128/256 on all network-facing ports

• SecureIQ: secure boot, secured storage, programmable security sensors, and micro-segmentation to security groups

• SCT / NST control and management plane protection; DDoS mitigation and encrypted traffic analytics

Telemetry, intelligence & programmability

• TrackIQ: line-rate flow-aware telemetry, per-packet latency measurement, elephant/mice flow detection, anomaly detection

• NetIQ: programmable processing engines with eCPRI and GTP awareness for in-network compute and auto-healing

• Overlay support: VXLAN, VXLAN-GPE, Geneve, IP-GRE, EVPN, SRv6, MPLS-SR

• Hardware OAM: IEEE 802.1ag, ITU-T Y.1731, MPLS OAM, ITU-T G.8113.1

Ordering information