CX202P-24Y-M-H, 24x 25G SFP28, 2x 100G QSFP28, Aggregation Switch

Enterprise SONiC, full L2/L3 and open management

The switch ships preloaded with AsterNOS, Enterprise SONiC distribution, with a single software image across the CX-M family. On top of it sits a complete Layer 2/Layer 3 feature set — VXLAN Centralized/Distributed Gateway, BGP-EVPN Type 2/3/5, GRE, static routing, VRF, OSPFv2/v3, BGP, MP-BGP, policy-based routing and MC-LAG — for multi-tenant overlays and dynamic route management at the aggregation layer. Automation interfaces include ZTP, industry-standard CLI, SNMP v1/v2/v3 and containerized custom tools, so the switch plugs into existing operations workflows without a separate management path.

High availability with MC-LAG

MC-LAG support gives the CX202P-24Y-M-H active-active redundancy across dual-homed links, maintaining connectivity through a link or device failure without added protocol complexity. Combined with BFD-based link fault detection, the switch re-routes traffic across OSPF, BGP and IS-IS in under 50ms, keeping downtime minimal during unplanned outages. An optional MPLS module adds label-switched path management for topologies requiring MPLS-based redundancy.

MACsec for secure connectivity

The CX202P-24Y-M-H supports MACsec (Media Access Control Security), providing line-rate Layer 2 encryption across aggregation links. This protects traffic between switches from eavesdropping and tampering, with minimal impact on throughput — relevant for campus and enterprise networks where aggregation links traverse shared or less-controlled physical infrastructure.

Optional precision timing

The CX202P-24Y-M-H supports IEEE 1588v2 PTP and SMPTE 2059-2 through hardware and software, with the hardware port operating as a Boundary Clock (BC) or Transparent Clock (TC). An optional PTP module adds Class C accuracy (≤10ns maximum time error) for deployments where the aggregation layer also needs to carry a synchronized time reference.

Operations and traffic visibility

The switch integrates sFlow, port mirroring and Syslog for traffic visibility and troubleshooting, with ZTP cutting deployment time and manual intervention. An optional Network Packet Broker container, built on SONiC's containerized architecture, adds traffic mirroring, filtering, aggregation, preprocessing, load balancing and output replication without a separate appliance.

Centralized management with Asteria Network Controller

The Asteria Network Controller can manage the CX202P-24Y-M-H alongside other CX-M switches, APs, routers and PON sticks in the same deployment. Zero-Touch Provisioning brings new switches online without manual CLI configuration. The controller provides topology discovery, device status monitoring and scripted configuration or firmware updates across multiple switches from a single interface. On-premises deployment is available with no licensing fee.

Enterprise-grade reliability

The CX202P-24Y-M-H uses hot-swappable 1+1 redundant power supplies and 2+1 redundant, hot-swappable fans to eliminate single points of failure. Front-to-rear airflow and 100–240V AC / 36-72V DC input suit rack-mount campus and enterprise deployments — making the CX202P-24Y-M-H a dependable foundation for distribution and aggregation-layer networks.

Architecture & performance

• Multi-rate 1/2.5/5/10/25/40/50/100/200/400G Ethernet ports support across the family
• Integrated Arm®-based multi-core CPU cluster for embedded application and service offload
• Programmable ingress/egress pipelines with dedicated packet buffer and traffic manager
• Supports 400G-ZR pluggable coherent optical modules for edge DCI connectivity

Timing & synchronization

• PTP IEEE 1588v1/v2, ITU-T G.8273.2 Class C compliant for nanosecond-scale time accuracy
• SyncE per ITU-T G.8261/G.8264 frequency recommendations
• IEEE 802.1CM-2018 Profile B TSN and 802.1Qbu frame preemption for deterministic packet delay control
• Security — SecureIQ & MACsec

Security — SecureIQ & MACsec

• Line-rate IEEE 802.1AE MACsec GCM-AES-128/256 and GCM-AES-XPN-128/256 on all network-facing ports
• SecureIQ: secure boot, secured storage, programmable security sensors, and micro-segmentation to security groups
• SCT / NST control and management plane protection; DDoS mitigation and encrypted traffic analytics

Telemetry, intelligence & programmability

• TrackIQ: line-rate flow-aware telemetry, per-packet latency measurement, elephant/mice flow detection, anomaly detection
• NetIQ: programmable processing engines with eCPRI and GTP awareness for in-network compute and auto-healing
• Overlay support: VXLAN, VXLAN-GPE, Geneve, IP-GRE, EVPN, SRv6, MPLS-SR
• Hardware OAM: IEEE 802.1ag, ITU-T Y.1731, MPLS OAM, ITU-T G.8113.1

Ordering information