A knowledgeable, US-based, Network Hardware Specialist, with 15+ years experience, will review your request.
Based on the exact SKU, we will verify airflow and other details to calculate a quote.
A BrightStar Systems' specialist will personally reach out within 24 hours.
Guaranteed safe & secure checkout​
Payment Methods
Free ground shipping to all 50 states
DESCRIPTION
SPECIFICATIONS
INCLUDED
WARRANTY
SHIPPING
FAQS
DESCRIPTION
Arista DCS-7280R4K-64QC-10PE-F — 64×100GbE QSFP28 + 10×800GbE OSFP Switch Router with TunnelSec Encryption and Front-to-Rear Airflow
The Arista DCS-7280R4K-64QC-10PE-F is a 2RU switch router in the 7280R4 Series, delivering 14.4 Tbps of non-blocking switching capacity with 64 × 100GbE QSFP28 ports and 10 × 800GbE OSFP ports. Built on Arista’s 7th-generation deep buffer VOQ ASIC platform with 16 GB of packet buffer memory and 3.8 µs store-and-forward latency, the R4K-64QC-10PE provides full Layer 2/3 switch router capabilities including BGP, OSPF, IS-IS, MPLS (LDP, RSVP-TE, BGP LU), SR-TE, EVPN, VXLAN, and 512-way ECMP. The “K” variant adds TunnelSec wire-speed encryption (MACsec, IPsec, VXLANsec) on all QSFP28 and OSFP ports, large-scale routing with over 5M IPv4 routes via FlexRoute, and Algorithmic ACLs (400K+ rules). The platform features an Eight-Core x86 CPU with 64 GB DRAM, 480 GB SSD storage, and a field-serviceable 7001-SUP-L supervisor module.The “-F” suffix denotes front-to-rear airflow, where cool air enters through the fan side and exhausts from the port side.
Key Features at a Glance
64 × 100GbE QSFP28 ports for high-radix leaf-spine and aggregation connectivity
10 × 800GbE OSFP ports supporting 800G, 400G, and 100G breakout modes for high-bandwidth uplinks
TunnelSec wire-speed encryption on all QSFP28 and OSFP ports — MACsec (IEEE 802.1AE), IPsec (RFC 4303), and VXLANsec using AES-256-GCM, with zero performance penalty
2 × 10GbE SFP+ ports supporting 10G and 1G line rates
1 × QSFP-LS port for dedicated ZR/ZR+ line system optics
Encrypted Data Center Interconnect and Aggregation
Mixed 100G/800G encrypted port density consolidates aggregation and DCI gateway functions with end-to-end encryption
VXLANsec extends encryption to overlay tunnels traversing multiple unencrypted hops between VTEP endpoints across sites
Over 5M IPv4 routes via FlexRoute supports encrypted full Internet routing at DCI border positions
1 × QSFP-LS port supports high-power ZR/ZR+ coherent optics for encrypted long-haul DCI transport
Secure Service Provider Metro and Peering
K-variant FlexRoute engine with over 5M IPv4 and IPv6 routes supports encrypted full Internet routing tables at peering positions
Line-rate MPLS with TunnelSec encryption provides secure carrier-grade transport and VPN services
PTP IEEE 1588v2 precision timing supports encrypted 5G backhaul and timing-sensitive metro applications
64 × 100GbE QSFP28 ports provide dense encrypted subscriber/site aggregation with 10 × 800GbE encrypted core uplinks
TunnelSec Wire-Speed Encryption
The 7280R4K-64QC-10PE-F supports Arista’s TunnelSec technology, enabling line-rate, industry-standard encryption using the AES-256-GCM block cipher on all QSFP28 and OSFP ports without a performance penalty. TunnelSec provides MACsec (IEEE 802.1AE) for point-to-point link-layer encryption, IPsec (RFC 4303) for encrypted IP tunnels, and VXLANsec for encrypted overlay tunnels between VTEP endpoints. Encryption is an EOS licensed feature.
14.4 Tbps Non-Blocking VOQ Architecture
The DCS-7280R4K-64QC-10PE-F delivers 14.4 Tbps of full-duplex, non-blocking throughput — (64 × 100 Gbps) + (10 × 800 Gbps) in both directions simultaneously. The Virtual Output Queue (VOQ) ASIC architecture eliminates head-of-line blocking. With a 5.4 Bpps forwarding rate, the switch operates at full line rate across all port combinations.The 16 GB deep packet buffer is distributed across the VOQ structure, providing substantial burst absorption capacity for transient congestion and bursty traffic patterns.
3.8 µs Store-and-Forward Latency
The 7280R4K-64QC-10PE-F operates in store-and-forward mode with a measured latency starting from 3.8 microseconds.
64 × 100GbE QSFP28: Supporting 100G native operation. TunnelSec encryption on all QSFP28 ports.
10 × 800GbE OSFP: Supporting 800G native, 2×400G, and breakout modes. TunnelSec encryption on all OSFP ports.
2 × 10GbE SFP+: Supporting 10G and 1G line rates.
1 × QSFP-LS: Dedicated line system port for 400G/800G ZR and ZR+ coherent DWDM optics.
Management: 1 × 100/1000 Mbps out-of-band management port + 1 × RS-232 RJ-45 console port + 1 × USB.
Maximum port configurations: Up to 10 × 800G, 20 × 400G, 144 × 100G, 80 × 50G, or 80 × 25G interfaces. Maximum 144+2 total interfaces.
Layer 2/3 Switch Router Capabilities
The 7280R4K-64QC-10PE-F operates as a unified switch router with full Layer 2 and Layer 3 feature sets:
BGP Full-Table Routing: Over 5M IPv4 unicast routes, over 5M IPv6 routes, 384K MAC addresses in the hardware FIB via FlexRoute K-variant. Supports MP-BGP, BGP graceful restart, and 512-way ECMP.
MPLS: Line-rate MPLS label switching with LDP, RSVP-TE, and BGP Labeled Unicast (BGP LU).
Segment Routing: SR-TE, TI-LFA, OSPF-SR, ISIS-SR, and BGP-SR.
EVPN and VXLAN: VXLAN Tunnel Endpoint (VTEP) and EVPN control plane for multi-tenant overlay networks. EVPN IRB.
Inband Network Telemetry (INT): Per-flow monitoring of traffic drops, latency, congestion, and network path in real-time.
Streaming Telemetry: Real-time counter and state export via gNMI (gRPC) and Arista eAPI (REST).
Advanced Event Management (AEM): Programmable event-driven automation within EOS.
DANZ: Arista’s telemetry fabric for advanced mirroring, SPAN/TAP aggregation, and L2/3/4 filtering.
EOS Automation and Provisioning
The 7280R4K-64QC-10PE-F runs Arista EOS, a modular operating system built on a standard Linux kernel where each process runs in its own protected memory space and communicates through an in-memory state-sharing database (Sysdb).
CloudVision: Centralized configuration management, network-wide change control, and compliance monitoring.
Zero-Touch Provisioning (ZTP): Automatic configuration download on first power-up via DHCP.
Python and Bash: Native on-box scripting with full Linux shell access.
eAPI (JSON-RPC): RESTful programmatic interface to all commands.
OpenConfig and gNMI: Vendor-neutral data models and streaming RPC.
NETCONF and RESTCONF: Standards-based configuration management.
Security
TunnelSec Encryption: Wire-speed MACsec (IEEE 802.1AE), IPsec (RFC 4303), and VXLANsec on all QSFP28 and OSFP ports using AES-256-GCM — zero performance penalty
Algorithmic ACLs: Over 400K rules combining hardware and software for scalable policy-based access control
Control Plane Policing (CoPP): Rate-limiting of CPU-destined traffic to protect routing stability
Standard ACLs: Ingress/egress access control lists at L2, L3, and L4 enforced at line rate
TACACS+ and RADIUS: Centralized authentication and accounting
Secure Boot: Cryptographic verification of bootloader and EOS image integrity
MAC Security, DHCP Relay/Snooping, ARP trapping for Layer 2 security enforcement
Quality of Service (QoS)
Up to 8 queues per port with strict priority, WRR, and WFQ
Power: 630W typical / 1317W maximum; PWR-2411 AC or DC power supplies
Redundancy: Dual hot-swappable PSU (1+1) and 4 hot-swappable FAN-7022HQ fan trays (N+1)
Supervisor: Field-serviceable 7001-SUP-L module with Eight-Core x86 CPU, 64 GB DRAM, 480 GB SSD
Storage: 480 GB SSD, 1 × USB port
System Memory: 64 GB DRAM, 16 GB packet buffer
Lifecycle and Reliability
Self-Healing Software: EOS includes Stateful Fault Repair (SFR) and Stateful Fault Containment (SFC).
In-Service Software Updates: Dual-partition boot with Smart System Upgrade (SSU) and Accelerated Software Update (ASU).
Field-Serviceable Supervisor: The 7001-SUP-L supervisor module can be replaced in minutes without disconnecting cabling.
BrightStar Systems 1-Year Warranty: Supplied fully tested, reset to factory defaults, and backed by a 1-year in-house warranty.
Scalability and Table Sizes
MAC Addresses: 384K
IPv4 Unicast Routes: Over 5M (FlexRoute K-variant)
IPv6 Unicast Routes: Over 5M (FlexRoute K-variant)
Algorithmic ACLs: Over 400K rules
ECMP: 512-way
Minimum EOS: 4.35.0
EOS Feature License: Group 5
Similar Arista Models to Consider
DCS-7280R4-64QC-10PE-F: Standard R4 variant without TunnelSec encryption; same 14.4 Tbps throughput for deployments that do not require encryption
DCS-7280R4K-32PE-F: Full 800G density K-variant with 32 × 800GbE OSFP ports and TunnelSec encryption; 25.6 Tbps throughput; 32 GB buffer
DCS-7280R4K-32DE-F: Full 800G density K-variant with 32 × 800GbE QSFP-DD ports and TunnelSec encryption; 25.6 Tbps throughput; 32 GB buffer
DCS-7280CR3K-96-F: R3 Series with 96 × 100GbE QSFP28 ports; 9.6 Tbps throughput; 16 GB packet buffer
Related 7280R4 Series Resources
For comprehensive technical documentation and comparative model information across the Arista 7280 family, visit Arista 7280 Series Overview.
Summary
The Arista DCS-7280R4K-64QC-10PE-F is a 2RU switch router combining 64 × 100GbE QSFP28 ports with 10 × 800GbE OSFP ports, TunnelSec wire-speed encryption (MACsec, IPsec, VXLANsec) on all QSFP28 and OSFP ports, 14.4 Tbps non-blocking throughput, 16 GB VOQ deep packet buffer, and full Layer 2/3 capabilities including BGP, MPLS, SR-TE, EVPN, and VXLAN. The K-variant provides over 5M IPv4/IPv6 routes via FlexRoute and Algorithmic ACLs with 400K+ rules. Featuring a field-serviceable 7001-SUP-L supervisor, PTP precision timing, and comprehensive telemetry, the 7280R4K-64QC-10PE-F is available from BrightStar Systems fully tested, reset to factory defaults, and backed by a 1-year in-house warranty.
QoS: Up to 8 queues per port; 802.1p and DSCP classification; ECN; strict priority, WRR, and WFQ scheduling; policing/shaping; ACL-based marking
Table Sizes and FlexRoute
MAC Addresses: 384K
IPv4 Unicast Routes: Over 5M (FlexRoute K-variant)
IPv6 Unicast Routes: Over 5M (FlexRoute K-variant)
Algorithmic ACLs: Over 400K rules
ECMP: 512-way
Precision Timing
PTP IEEE 1588v2: Hardware-assisted Boundary Clock and Transparent Clock modes
Security Features
TunnelSec Encryption: Wire-speed MACsec (IEEE 802.1AE), IPsec (RFC 4303), and VXLANsec on all QSFP28 and OSFP ports using AES-256-GCM; zero performance penalty; EOS licensed feature
Algorithmic ACLs: Over 400K rules combining hardware and software for scalable policy-based access control
Access Control: IPv4/IPv6 ingress and egress ACLs (L2/L3/L4 fields), MAC ACLs, ACL drop logging and counters, Service ACLs
Secure Boot: Digitally signed EOS images ensure trusted software boot process
Authentication: TACACS+, RADIUS, SSHv2; Role-Based Access Control (RBAC); AAA
Control Plane Protection: Control Plane Policing (CoPP), DHCP relay/snooping, MAC Security, ARP trapping, uRPF
