Palo Alto Networks PA-3520
The entry model of Palo Alto Networks' PA-3500 Series, a quantum-optimized NGFW built on custom FE100X ASICs for enterprise perimeters and high-speed internet gateway deployments, with PQC-ready TLS and VPN decryption.
Performance
- Firewall throughput (appmix)
- 35 Gbps
- Threat Prevention throughput (appmix)
- 20 Gbps
- IPsec VPN throughput
- 15 Gbps
- Max concurrent sessions
- 4,000,000
- New sessions/sec
- 350,000
- Virtual systems (base/max)
- 5 / 15
Interfaces
- Data I/O
- 10G mGig Cu (8), 1G/10G SFP+ (8), 10G/25G SFP28 (6), 40G/100G QSFP28 (2)
- Out-of-band management
- 1G/10G SFP+ (1)
- Console
- RJ-45 (1); USB-C
- Bootstrap
- USB-C
- HSCI
- 40G/100G (2)
- Log
- 10G SFP+ (1)
Switching
- VLAN tags
- 802.1Q, 4,094 per device or per interface
- Aggregate interfaces
- 802.3ad LACP
Routing
- Interface modes
- L2 (not on MC-LAG aggregate interfaces), L3, tap, virtual wire (transparent)
- Routing engine
- Advanced routing engine only: OSPFv2/v3, MP-BGP with graceful restart, RIP, static routing, policy-based forwarding
- Dynamic addressing
- PPPoE and DHCP client (IPv4/IPv6); DHCPv4 server and relay
- Multicast
- PIM-SM, PIM-SSM, IGMPv2/v3
- BFD
- BFD and multihop BFD
- IPv6
- Inspection in L2/L3/tap/virtual wire; dual-stack and IPv6-only; OSPFv3, MP-BGP, NAT64, NPTv6; DHCPv6 client with PD, SLAAC server
- NAT
- Static IP, dynamic IP, and PAT (IPv4); NAT64, NPTv6; dynamic IP reservation, tunable dynamic IP, port oversubscription
VPN
- Key exchange
- Manual key, IKEv1 (not with NGFW clustering), IKEv2 (pre-shared key and certificate-based)
- Post-quantum
- Post-quantum PPK; PQC TLS decryption, PQC VPN site-to-site, PQC-classical TLS cipher translation proxy, PQC TLS service profile, PQC GlobalProtect
- Encryption
- 3DES, AES (128/192/256-bit)
- Authentication
- MD5, SHA-1, SHA-256, SHA-384, SHA-512
- Remote access
- GlobalProtect gateway/portal and Large Scale VPN (license required)
Power
- Power supply
- 1,200 W; 1,066 W max consumption
- Redundancy
- 1+1 redundant (220 V AC and DC); 1+1 redundant (110 V AC)
- Input voltage
- AC 100–240 VAC (50–60 Hz); DC -48 to -60 VDC
- Max current draw
- AC 9.33 A @ 120 V / 4.67 A @ 240 V; DC 30 A @ -48 to -60 VDC
- Max inrush current
- AC 50 A @ 230 VAC and 50 A @ 120 VAC; DC 25 A @ 54 VDC
- Max heat output
- 3,430 BTU/hr
Storage
- Onboard storage
- 960 GB SSD for system and log storage, cold-swap
- TPM
- TPM 2.0, secure boot and Hardware Root of Trust
Management
- High availability
- Active/passive HA; NGFW clustering active/active (dual-active data plane, single control plane, MC-LAG support) — future release
- Platform
- Strata Cloud Manager
- Mobile network
- 5G identifier-based visibility, traffic correlation and enforcement
Physical
- Dimensions
- 1U, 19" standard rack: 5.2" H × 29.8" D × 17.3" W with power supply inserted
- Weight
- 70 lb standalone; 116 lb as shipped (with accessory kit, rack kit, packaging, pallet)
Environmental
- Operating temperature
- 32°F to 104°F / 0°C to 40°C
- Nonoperating temperature
- -4°F to 158°F / -20°C to 70°C
- Humidity
- 10%–90%
- Max altitude
- 10,000 ft / 3,048 m
- Airflow
- Front to back (port side to power supply side)
- Safety / EMI
- cTUVus and CB; FCC Class A, CE Class A, VCCI Class A
- MTBF
- 8.1 years