"Aruba CX 10000 with AMD Pensando DPUs: Distributed Stateful Firewalling in the Fabric"

For most of the last two decades, securing east-west traffic in the data center has meant hairpinning flows out of the rack, through a centralized firewall, and back again. That model adds latency, burns rack space, and forces you to buy firewall capacity for traffic that never leaves the building. The HPE Aruba Networking CX 10000 takes a different approach: it pushes a stateful firewall into the top-of-rack switch itself using AMD Pensando DPUs, so segmentation happens inline, at the leaf, at wire rate. This post explains how the CX 10000 works, where it saves money, and how to evaluate it for a real deployment.

The east-west problem the CX 10000 solves

In a modern leaf-spine fabric, the majority of traffic is east-west, server-to-server inside the data center. Traditional security architectures were built for north-south traffic, so enforcing zero-trust segmentation between workloads usually means one of two compromises. You either trombone east-west flows up to a centralized firewall cluster (adding latency and creating a chokepoint you have to scale and license aggressively), or you deploy software agents and host-based firewalls on every workload (adding operational overhead and consuming server CPU).

Neither scales cleanly. Centralized firewalls become expensive single points of contention as VM and container density grows. Agent-based microsegmentation is powerful but fragile across mixed estates of bare metal, VMs, containers, and appliances. What buyers actually want is segmentation that lives in the network, applies uniformly, and does not steal cycles from the workloads it protects. That is the gap the Aruba CX 10000 is built to close.

How DPU networking changes the switch

The CX 10000 is a top-of-rack switch running Aruba's AOS-CX operating system, but with a critical addition: it embeds AMD Pensando DPUs (data processing units) directly into the switch. The DPU is a fully programmable processor purpose-built for inline network and security services. Instead of a fixed-function ASIC that can only switch and route, the CX 10000 can run L4 stateful firewalling, telemetry, ERSPAN, DDoS protection, and roadmap services like stateful NAT and encryption, all inside the same 1U box that already connects your servers.

In practical terms, this is what a Pensando DPU switch delivers:

• Stateful firewalling at the leaf. Each flow is inspected and tracked on the DPU as it enters or leaves the rack, with no hairpin to a separate appliance.
• Wire-rate enforcement. Because the DPU sits in the data path, policy is applied inline rather than by detouring traffic.
• Pervasive telemetry. The same silicon that enforces policy also generates rich, per-flow visibility, which is exactly what you need for zero-trust and audit.
• No workload CPU tax. Security services run on the DPU, not on host CPUs, so you are not trading server capacity for segmentation.

This is the heart of DPU networking: the switch stops being a dumb pipe and becomes a distributed services platform.

Specs that matter for sizing

When you evaluate the CX 10000, focus on the numbers that drive a rack design rather than marketing throughput. The series pairs standard leaf connectivity with substantial distributed services capacity.

Attribute	Aruba CX 10000 (e.g., 10000-48Y6C)	Why it matters
Server-facing ports	48 x 10/25GbE (SFP/SFP+/SFP28)	Standard ToR density for modern racks
Uplinks	6 x 40/100GbE (QSFP+/QSFP28)	Leaf-spine uplinks to the fabric
Switching capacity	~3.6 Tbps	Line-rate L2/L3 forwarding
Distributed stateful firewall	Up to 800G total (dual DPUs, ~400G each)	East-west enforcement without a separate appliance
Services on DPU	L4 stateful firewall, telemetry, ERSPAN, DDoS (NAT/encryption on roadmap)	Consolidates security functions into the switch
Form factor	1U top-of-rack	Replaces switch + firewall footprint in the rack

The takeaway for capacity planning: you get up to 800G of stateful firewall throughput distributed across the rack's own ToR, rather than back-pressuring a shared central firewall. As you add racks, you add enforcement capacity linearly. That is a fundamentally different scaling curve than a centralized appliance model.

Where the cost actually comes out

The economic case for distributed firewall data center designs is not just "fewer appliances." It is several effects stacking together:

1. You stop buying firewall capacity for east-west traffic. Enforcement moves to the leaf, so the central firewall (if you keep one) only handles north-south and specialized inspection.
2. You reclaim rack space and power. A dedicated 1U switch with built-in firewalling replaces the switch-plus-appliance footprint.
3. You cut latency. No hairpin means server-to-server flows stay local, which matters for storage, database, and AI/ML east-west patterns.
4. You simplify scaling. Capacity grows with racks instead of requiring forklift upgrades of a central security tier.

For a CX 10000 solution, the comparison to model out is your current centralized firewall licensing and refresh cost (including the traffic-engineering complexity of steering east-west flows through it) versus distributing that enforcement into the fabric you are already buying.

Designing for east-west segmentation

A few practical notes for teams planning east-west segmentation with the CX 10000:

• Policy is centrally managed. You author segmentation policy through a central controller and push it to the distributed DPUs, so enforcement is distributed but management stays single-pane. This avoids the per-host sprawl of agent-based microsegmentation.
• It complements, not always replaces, your perimeter. Many designs keep a next-gen firewall for north-south and deep inspection, and use the CX 10000 for high-throughput stateful east-west segmentation where L4 enforcement and telemetry are the priority.
• Telemetry is a first-class output. The per-flow visibility from the DPUs feeds zero-trust verification and compliance reporting, which is often the part that unlocks budget in regulated environments.
• Mind the model and TAA. For federal and SLED buyers, confirm the specific SKU (for example, the 10000-48Y6C in a TAA-compliant configuration) and the airflow direction (front-to-back vs back-to-front) before you order.

How Uniqcli helps

Uniqcli is an authorized HPE and HPE Aruba Networking reseller, and we help federal, SLED, healthcare, and enterprise buyers scope, procure, and deploy the CX 10000 the right way.

• Scope and design. We help you model the rack design, size DPU firewall capacity against your real east-west traffic, and confirm where the CX 10000 replaces versus augments existing security tiers.
• Procurement vehicles. We support compliant purchasing through the channels you already use, including GSA, SEWP, and E-Rate where applicable, and we confirm TAA-compliant configurations for federal requirements. Tell us your vehicle and we will quote against it.
• Accurate quoting. We validate the exact SKU, optics, airflow, power, and support level so the bill of materials matches the design. Request pricing through our quote page.
• Deploy and support. We coordinate delivery, staging, and HPE support attach so the switches arrive ready to rack.

Browse current switching in our products and catalog, or use compare to weigh the CX 10000 against other Aruba data center options.

FAQ

What is the Aruba CX 10000 and how is it different from a normal switch? It is a 1U top-of-rack switch running AOS-CX that embeds AMD Pensando DPUs, giving it an inline stateful firewall, telemetry, and other security services in addition to standard L2/L3 switching. A normal switch cannot enforce stateful segmentation in the data path; the CX 10000 can.

How much firewall throughput does the CX 10000 provide? The series provides up to 800G of distributed stateful firewall capacity, delivered by dual DPUs at roughly 400G each, alongside about 3.6 Tbps of switching. Confirm exact figures for your specific model on the current HPE datasheet.

Does the CX 10000 replace my centralized firewall? For east-west segmentation, it can eliminate the need to hairpin server-to-server traffic through a central appliance. Many designs keep a next-gen firewall for north-south traffic and deep inspection, and use the CX 10000 for high-throughput L4 stateful east-west enforcement and telemetry.

Is the CX 10000 available in TAA-compliant configurations for government buyers? Yes, specific SKUs are offered in TAA-compliant configurations. Confirm the exact model and airflow option for your requirement, and ask Uniqcli to quote it against your GSA, SEWP, or E-Rate vehicle.