Sophos Expansion Module for HP 530SFP+ NIC

I have a rather niche situation where I want to use my recently-purchased Sophos XG 230 Rev 2 1U rack-mount firewall (with OPNSense installed) with my Comcast XB7 gateway in bridge mode, which has a 2.5 Gbps RJ45 network port on it. The XG230R2 only has gigabit ports, and all the available 10Gbps expansion modules use Intel chipsets and essentially only support 1Gbps or 10Gbps speeds, so NBase-T SFPs aren't really any option in them.

However, 10Gbps SFP+ NICs that use the Broadcom 57810S chipset have the option of configuring the ports to operate at 2.5Gbps signalling, if you're willing to dive into a somewhat obscure manufacturer diagnostic tool in a UEFI shell and issue arcane commands and then run a customized version of the NIC driver. (This method is commonly used by people with GPON fiber connections to bypass their provider's ONT, I'm just doing it with a 2.5Gbps NBase-T SFP+ module instead of a 1.2Gbps GPON SFP.)

So, I designed this module to allow me to fit a standard low-profile PCI-e NIC in the Sophos' expansion bay, so I could then utilize an HP 530SFP+ NIC in the Sophos. The expansion bay is pretty much a PCI-e x8 connection, but requires some adapters and covering some PCI-e pins to get everything to work.

Parts list:

• The STL files from this model
• Qty 1: PCI-e 8X to 8X Male to Female Riser/Extension cable, 20cm (example: https://www.amazon.com/dp/B00S6AJD7C)
• Qty 2: PCI-e 8X 90 Degree Reverse Male to Female Riser Card (example: https://www.amazon.com/dp/B0D2K53HH8)
• Assorted M3 screws and washers
  • 6x M3-??? for the handle and front panel/side connections
  • 4x M3-??? for the PCI-e extension cable
  • 2x M3-??? for fastening the NIC to the front panel
• Broadcom 57810S-based NIC of your choice (I started with the Dell variant, which is what is shown in the pictures, but ended up using an HP 530SFP+ in the final build)
• Kapton tape or other thin, insulating tape

Please note: this ends up being a really tight fit into the expansion bay, with not much wiggle room in any direction. Part of this is due to the double 90° adapters used and the height they add, as well as the tabs inside the expansion bay that the OEM modules screw into. (In fact, I was testing with an Intel-based SuperMicro NIC at one point, and it had some Dupont headers that just barely did NOT clear the mounting ears unless I bent them slightly towards the heatsink.) You may notice that the bottom part of the carrier is fairly thin (1mm), and has a couple of openings in it - those are to allow the pins on the actual PCI-e edge slot on the 90° riser (that extend through the PCB) to be recessed a little bit, and to allow the ribbon extension cable connector a bit more clearance when it plugs into the first 90° riser. And even with all that, it's still a tight squeeze…

Steps:

1. Screw the handle into the front panel
2. Tape off pins A2-A9 and B2-B9 on the ribbon cable's male connector (all but the first pin and the last two pins on each side of the first tab of the PCI-e connector - see the red tape in the photos). I recommend Kapton tape, not electrical tape as shown in the prototype photos here.
3. Screw the male end of the ribbon cable to the carrier
4. Connect the first 90° connector to the female end of the ribbon cable and screw into place.
5. Connect the second 90° connector to the PCI-e card
6. Carefully fold the ribbon cable back on itself a little bit
7. Insert the PCI-e card with connector into the first 90° connector, making sure that the folded ribbon cable tucks underneath the card as neatly as possible. Be careful not to stress the solder connections too much!
8. Slide the front panel over the SFP+ cages and into position, then screw it in from the side
9. Screw the PCI-e card to the supports on the front panel

Once assembly is complete, you can insert the module into the firewall (I don't know if it's hot-swapable, so I've always powered it down before inserting or removing). You may need to wiggle it side to side a tiny bit to get the male connector on the back of the module to mate with the connector in the expansion bay. It will likely require a little bit of force to insert - it seems to be a tighter connection than most motherboard slots I've come across. It may help to remove the top cover of the firewall at this point - there is a power cable in the back left part of the bay that can sometimes get caught on the corner of the NIC, and then you may also be able to see if you've got the connectors lined up during insertion.

If desired, you can buy or make some M3 thumb screws to screw the bracket in to make it nice and secure.

I've included a blank version of the front panel, in case you need to customize the ports/openings for a different NIC (or other PCI-e card).