Palo Alto T-Q28-100G-S4 and PA-5450 with PAN-PA-5400-NC-A

[asad.hasan1]

Hey everyone,

I am working on a project to integrate Cisco Catalyst 9500/Nexus 9300 switches with Palo Alto PA-5450 with PA-5400-NC-A cards using 100G QSFP transceivers. Specifically, I was testing with below transceivers.

• Cisco QSFP-100G-SR4-S

• Palo Alto T-Q28-100G-S4

Firewalls are running 11.1.4-h18.

Non-Working combination.

1. Cisco Catalyst 9500 w/QSFP-100G-SR4-S connected to PA 5450 w/T-Q28-100G-S4
2. Cisco Nexus 9300 w/QSFP-100G-SR4-S connected to PA 5450 w/T-Q28-100G-S4
3. Cisco Catalyst 9500 w/T-Q28-100G-S4 connected to PA 5450 w/T-Q28-100G-S4
4. Cisco Nexus 9300 w/T-Q28-100G-S4 connected to PA 5450 w/T-Q28-100G-S4

Working combination:

1. Cisco Catalyst 9500 w/QSFP-100G-SR4-S connected to Cisco Nexus 9300 w/T-Q28-100G-S4
2. Cisco Nexus 9300 w/T-Q28-100G-S4 connected to Cisco Nexus 9300 w/T-Q28-100G-S4
3. Cisco Catalyst 9500 w/T-Q28-100G-S4 connected to PA 5450 w/QSFP-100G-SR4-S
4. Cisco Nexus 9300 w/T-Q28-100G-S4 connected to PA 5450 w/QSFP-100G-SR4-S

Test 3 and 4 of the working and non-working combination is essentially swapping the QSFPs between devices. It seems like the Palo Alto 5450 are having issues with T-Q28-100G-S4 but they work with Cisco QSFPs.

Have others seen similar behavior? Are there any known compatibility notes or optical tuning nuances between these platforms that I might’ve missed? Our team has opened a case with Palo Alto TAC as well.

Thanks in advance!

Thanks

Asad