HPE J9995A 8-Port 1/2.5/5/10GBase-T PoE+ MACsec V3 zl2 Expansion Module

Overview

The HPE Aruba J9995A is an eight-port multi-rate PoE+ expansion module designed for the HPE Aruba 5400R switch chassis — a modular platform commonly deployed in enterprise distribution and access layers where port-density flexibility matters. Each port auto-negotiates across 1G, 2.5G, 5G, and 10G over standard copper, which means a single cable plant handles both your installed base of GbE IP cameras and newer multi-gig wireless access points or workstations without a forklift upgrade. Add hardware MACsec encryption to that and you have a module that belongs in environments where the wire itself is a threat surface: financial backrooms, government facilities, and high-security physical access networks.

The J9995A slots into the V3 zl2 module bay — the third-generation slot architecture used across the 5400R family — and can be installed or swapped without powering down the chassis. That hot-swap capability is the operational argument for choosing a modular chassis over fixed-configuration network switches in the first place: you add capacity when you need it, not when you planned for it three years ago.

Key Features

• Multi-rate 1/2.5/5/10GBase-T per port: Each of the eight RJ-45 interfaces negotiates to the highest speed the connected device supports — no manual speed-matching, no SFP swaps. A legacy GbE IP camera connects at 1G; a Wi-Fi 6E access point or NVR uplink runs at 2.5G or 5G; a server or storage head-end runs full 10G. One module, one cable type, no media converters.
• PoE+ on all 8 ports: PoE+ (802.3at) delivers up to 30W per port, which covers virtually every PTZ camera, multi-sensor dome, and enterprise-class wireless access point on the market. You eliminate the separate power run and the associated labor cost — particularly relevant in retrofit deployments where conduit is already full.
• Hardware MACsec (802.1AE): MACsec operates at Layer 2 — below the IP stack — encrypting every frame traversing the link before it leaves the port. Unlike IPsec, there is no per-packet CPU overhead; encryption happens in the ASIC. Deploy this in segments where physical access to network closets cannot be fully controlled, or where compliance mandates in-transit data protection at the link layer.
• 8-port density per module slot: Eight high-speed PoE+ ports in a single chassis slot keeps your 5400R expansion bays available for other module types — additional copper, fiber uplinks, or future-generation cards. For a PoE switch deployment anchored on the 5400R, this is the right increment when you need multi-gig without filling the chassis with single-use cards.
• V3 zl2 hot-swap architecture: The module inserts and removes from a live chassis without a maintenance window. In a 24/7 surveillance or access control environment, this matters: you provision additional port capacity during business hours, not at 2 a.m. The 5400R's backplane handles the card addition transparently to traffic on other installed modules.
• 10 Gbps maximum throughput per port: At 10G, each port can aggregate traffic from multiple downstream GbE devices without becoming a bottleneck. In a stacked surveillance deployment running 4K streams from a dozen cameras through a single uplink, headroom at 10G keeps the aggregation layer from being the constraint.
• Standard RJ-45 copper interfaces: All eight ports use RJ-45 connectors over Cat5e/Cat6/Cat6A — the cabling already in place in most enterprise buildings. No fiber pulls, no SFP transceivers, no additional optics budget. Multi-gig speeds over existing copper infrastructure is the core value proposition for brownfield deployments.

Integration and Compatibility

The J9995A is a V3 zl2 module, which means it is compatible exclusively with the HPE Aruba 5400R chassis family. It does not fit V2 zl or original zl chassis — verify your chassis generation before ordering. Within a correctly specified 5400R, the module integrates with the switch's ArubaOS-CX or ArubaOS software stack, inheriting the chassis-level management plane: SNMP, REST API, and console access all operate through the existing chassis management rather than requiring per-module configuration. If your environment uses network management and monitoring tools that support the 5400R via standard SNMP MIBs, the J9995A's ports appear natively without additional drivers or plug-ins.

MACsec configuration is handled at the port level through the chassis CLI — both ends of a MACsec-protected link must support and be configured for 802.1AE. Plan your key agreement (MKA) setup before deployment, particularly in environments where endpoints include third-party switches or network appliances; not all multi-gig copper devices from non-HPE vendors implement MACsec at 2.5G/5G speeds. Confirm endpoint MACsec capability before committing the J9995A to a MACsec-mandatory segment.

Frequently Asked Questions

Q: Is the J9995A compatible with the HPE Aruba 5400R zl2 chassis?

A: Yes. The J9995A is specifically a V3 zl2 module designed for the HPE Aruba 5400R switch chassis family. It is not compatible with older V1 zl or V2 zl2 chassis generations — verify your chassis model before purchasing.

Q: What is the maximum PoE wattage per port on the J9995A?

A: The J9995A supports PoE+ (802.3at) on all eight ports, which provides up to 30W per port. Total PoE budget for the module is governed by the power supply configuration in the host 5400R chassis.

Q: Does the J9995A support MACsec encryption, and what does that mean in practice?

A: Yes, the J9995A supports MACsec (IEEE 802.1AE) hardware encryption at Layer 2. This encrypts Ethernet frames on the wire between two MACsec-capable devices at the link layer — below IP — with no CPU overhead, since the encryption is handled in the ASIC. Both endpoints of a link must support and be configured for MACsec for the feature to function.

Q: What speeds does the J9995A support, and does it require specific cable grades?

A: Each port auto-negotiates across 1GBase-T, 2.5GBase-T, 5GBase-T, and 10GBase-T. For 10GBase-T operation, Cat6A cabling is recommended to maintain signal integrity at distance. Cat5e and Cat6 support 10G at reduced distances, and are generally adequate for 1G through 5G at standard runs.

Q: What is the warranty on the J9995A?

A: The J9995A carries a 3-year manufacturer warranty.

Q: Can the J9995A be hot-swapped in a live 5400R chassis?

A: Yes. The V3 zl2 slot architecture supports hot-swap — the module can be inserted or removed from a powered, operational chassis without bringing down the system or other installed modules.

Karl Wilson

The J9995A is the module I specify when a customer's 5400R chassis is already deployed and they need to add multi-gig PoE+ density without touching their copper plant. The combination of four auto-negotiating speed tiers — 1G through 10G — over standard RJ-45 on all eight ports means you're not making a bet on what speed the next wave of endpoints will land at. That flexibility is worth more than it sounds in a mixed-generation surveillance or enterprise access deployment.

Technical Highlights:

• MACsec at hardware speed: IEEE 802.1AE encryption runs in the ASIC — not in software — so you get link-layer confidentiality without adding latency or burning CPU cycles on the 5400R's management processor. That's the right architecture for segments where you're encrypting camera feeds or access control traffic that needs deterministic forwarding.
• Multi-rate auto-negotiation: 1/2.5/5/10GBase-T per port means the J9995A adapts to whatever the endpoint negotiates — existing GbE cameras at 1G, Wi-Fi 6E APs at 2.5G or 5G, server uplinks at 10G. No SFP swaps, no media converters, no speed-matching config.
• PoE+ at 30W per port: Covers PTZ cameras, dual-radio APs, and IP intercoms on all eight ports simultaneously — subject to the chassis power supply budget. Plan the chassis power load before deploying; a lightly provisioned 5400R PSU can be the constraint, not the module itself.

Deployment Considerations:

• Chassis generation matters: the J9995A requires a V3 zl2-compatible 5400R chassis. If you're looking at an older 5400 (non-R) or a V1/V2 chassis, this card will not seat correctly. Confirm the chassis model number before procurement.
• MACsec requires capability on both link endpoints — the J9995A initiates or responds to MKA (MACsec Key Agreement), but if the connected device (another switch, an AP, a camera with a MACsec-capable NIC) doesn't support 802.1AE, MACsec simply won't establish. Audit your endpoint inventory before committing to a MACsec-mandatory network segment design.

This module earns its place specifically in enterprise distribution-layer builds where the 5400R is the backbone switch and the access layer is a mix of GbE legacy gear and newer multi-gig endpoints — exactly the brownfield upgrade scenario where ripping and replacing cabling is off the table but 2.5G or 5G headroom is required today.