HPE J9993A 8-Port 10GbE SFP+ MACsec v3 zl2 Expansion Module
The J9993A drops eight 1G/10GbE SFP+ ports — each with hardware-enforced MACsec v3 line-rate encryption — into any open slot on the HPE Aruba 5400R zl2 switch chassis. If your deployment requires encrypted inter-switch links or secure campus core uplinks without sacrificing throughput, this is the module to reach for. MACsec operates at wire speed, so you get 10 Gbps per port with AES-GCM encryption engaged — no throughput penalty at the line card.
Key Features
- 8 x 1G/10GbE SFP+ Ports: Each port auto-negotiates between 1G and 10G, giving you flexibility to connect legacy 1GbE uplinks or full 10GbE infrastructure on the same module without re-cabling. If your core is migrating from 1G to 10G in phases, this single module handles both generations simultaneously.
- MACsec v3 Hardware Encryption: 802.1AE MACsec v3 is enforced at the ASIC level — not in software — which means encryption and decryption happen at full 10 Gbps per port with no CPU overhead and no measurable latency penalty. This matters in data-center interconnects and campus cores where a software-based encryption tax would degrade application performance.
- 10GBase-X Interface Technology: SFP+ transceiver slots support the full range of 10GBase-X optical fiber modules, letting you match reach to your plant — short-reach SR optics for rack-to-rack, longer-reach LR or ER optics for building-to-building fiber runs — without changing the line card. Optics are field-swappable.
- zl2 Modular Architecture: The zl2 form factor means this module hot-swaps into the 5400R zl2 chassis alongside other zl2 line cards, sharing the chassis backplane and management plane. You don't need a dedicated appliance or separate encryption device — MACsec capability lives directly in your switching fabric.
- Optical Fiber Media Support: All eight ports are SFP+, designed exclusively for fiber — copper SFP+ DAC cables are also supported where distances allow, which makes rack-local 10G connections inexpensive while longer inter-building links use single-mode or multi-mode fiber appropriate to the run length.
- Up to 10 Gbps Per Port: With eight ports at 10 Gbps, the module delivers up to 80 Gbps of aggregate switching capacity into the 5400R backplane. For a campus distribution or core layer running encrypted inter-VLAN routing and aggregating access-layer uplinks, that headroom is significant.
- 5400R zl2 Chassis Compatibility: The module is engineered for the HPE Aruba 5400R zl2 switch family, which means it inherits the chassis's centralized management, redundant management modules, and unified ArubaOS-Switch firmware — no separate licensing or out-of-band management infrastructure needed for the module itself.
Integration and Compatibility
The J9993A is purpose-built for the HPE Aruba 5400R zl2 switch series — it will not seat in older 5400 zl (non-zl2) chassis or any other HPE switch family. Before ordering, confirm your chassis is a 5406R zl2 or 5412R zl2 and that you have an available slot. The module occupies a single zl2 slot; chassis slot count determines how many J9993A modules you can install in parallel.
SFP+ transceivers are sold separately. HPE qualifies its own SFP+ optics for guaranteed interoperability; third-party optics may work but could trigger firmware warnings on ArubaOS-Switch. For MACsec to function between two endpoints, both ends of the link must support MACsec — a J9993A-to-J9993A inter-switch link is the straightforward path. Connecting to non-MACsec endpoints falls back gracefully to unencrypted 10G operation.
ArubaOS-Switch firmware manages MACsec key agreement (MKA) and connectivity association key (CAK) provisioning through the CLI or through Aruba Network Manager. Integrators familiar with 802.1AE key hierarchies will find the configuration model standard; plan for CA key rotation policies in your security design before go-live.
Frequently Asked Questions
Q: Which HPE chassis is the J9993A compatible with?
A: The J9993A is designed for the HPE Aruba 5400R zl2 switch series, including the 5406R zl2 and 5412R zl2 chassis. It is not compatible with the older 5400 zl (non-zl2) chassis or other HPE switch families.
Q: Does MACsec encryption reduce throughput on the J9993A?
A: No. MACsec v3 is implemented in hardware on the module's ASIC, operating at full line rate — up to 10 Gbps per port — with no measurable throughput penalty or additional CPU load on the chassis management module.
Q: What fiber types does the J9993A support?
A: The eight SFP+ ports support optical fiber via standard 10GBase-X SFP+ transceivers. Both multi-mode (e.g., SR) and single-mode (e.g., LR, ER) optics are supported depending on the transceiver installed. Copper DAC cables are also an option for short rack-local connections.
Q: Do both ends of a link need MACsec support for encryption to work?
A: Yes. MACsec (802.1AE) requires MACsec-capable hardware on both ends of the link. If the far end does not support MACsec, the link operates as a standard 10GbE connection without encryption. MACsec does not degrade connectivity to non-MACsec endpoints.
Q: Are SFP+ transceivers included with the J9993A?
A: No. The J9993A includes the line card module only. SFP+ transceivers are ordered separately and must match your fiber plant and distance requirements.
Q: Can multiple J9993A modules be installed in the same 5400R zl2 chassis?
A: Yes, subject to available slot count. The 5406R zl2 has four slots and the 5412R zl2 has ten slots. Each J9993A occupies one slot, so a fully loaded 5412R zl2 can support up to ten J9993A modules for up to 80 encrypted 10GbE ports per chassis.
The J9993A is the module I reach for when a customer needs to encrypt inter-switch links inside the campus core without bolting on a separate encryption appliance — MACsec v3 running at hardware line rate means all eight SFP+ ports push 10 Gbps with AES-GCM encryption active and the CPU on the management module barely notices.
Technical Highlights:
- Line-Rate MACsec v3: Hardware ASIC enforcement at 10 Gbps per port means you get full 80 Gbps aggregate encrypted throughput from a single module slot — no throughput tax, no software bottleneck to engineer around.
- Dual-Speed SFP+ (1G/10GbE): Auto-negotiation between 1G and 10G on each of the eight ports lets a phased infrastructure migration coexist on the same line card — you're not forced to commit all links to 10G on day one.
- 10GBase-X Fiber Flexibility: SFP+ slots accept the full range of 10GBase-X optics, from short-reach SR to long-haul ER, so the same J9993A module serves both intra-building and inter-building encrypted links without a hardware change.
Deployment Considerations:
- MACsec key agreement (MKA) must be configured via ArubaOS-Switch CLI or Aruba Network Manager on both ends of every encrypted link — plan your CAK provisioning and rotation policy before go-live, especially across multiple chassis in a stacked or distributed core.
- The J9993A is strictly a zl2 module — it will not physically seat in the older 5400 zl chassis. Verify the chassis label includes 'zl2' before procurement; the visual difference between zl and zl2 chassis is subtle and a mismatched module is non-returnable after installation.
This module earns its place in a campus distribution or data-center access layer where PCI-DSS, HIPAA, or internal policy mandates encrypted east-west traffic between switches — providing wire-speed MACsec without a dedicated encryption appliance or a separate forwarding penalty.
