PA-220

Palo Alto Networks PA-220 brings next-generation

Highlights firewall capabilities to distributed enterprise branch
• High availability with active/active offices, retail locations, and midsize businesses.
and active/passive modes
• Redundant power input for
increased reliability
• Fanless design
• Simplified deployments of large
numbers of firewalls through USB PA-220

The controlling element of the PA-220 is PAN-OS®, which

natively classifies all traffic, inclusive of applications,
threats, and content, and then ties that traffic to the user
regardless of location or device type. The application,
content, and user—in other words, the elements that run
your business—then serve as the basis of your security
policies, resulting in improved security posture and reduced
incident response time.

Strata by Palo Alto Networks | PA-220 | Datasheet 1

Key Security and Connectivity Prevents known and unknown threats
­Features • Blocks a range of known threats—including exploits,
­malware and spyware—across all ports, regardless of com-
Classifies all applications, on all ports, all the time mon evasion tactics employed.
• Identifies the application, regardless of port, SSL/SSH encryp- • Limits the unauthorized transfer of files and sensitive data,
tion, or evasive technique employed. and safely enables non-work-related web surfing.
• Uses the application, not the port, as the basis for all your safe • Identifies unknown malware, analyzes it based on hundreds
enablement policy decisions: allow, deny, schedule, inspect, of malicious behaviors, and then automatically creates and
and apply traffic-shaping. delivers protection.
• Categorizes unidentified applications for policy control,
Enables SD-WAN functionality
threat forensics, or App-ID™ technology development.
• Easily adopt SD-WAN by simply enabling it on your existing
Enforces security policies for any user, at any firewalls.
location • Enables you to safely implement SD-WAN, which is natively
• Deploys consistent policies to local and remote users run- integrated with our industry-leading security.
ning on the Windows®, ­macOS®, Linux, Android®, or Apple • Delivers an exceptional end user experience by minimizing
iOS ­platforms. latency, jitter, and packet loss.
• Enables agentless integration with ­Microsoft Active Directory®
and Terminal Services, LDAP, Novell e­ Directory™, and Citrix.
• Easily integrates your firewall policies with 802.1X wireless,
proxies, network access control, and any other source of user
identity information.

Table 1: PA-220 Performance and Capacities SD-WAN

500/580 Path quality measurement (jitter, packet loss, latency)

Firewall throughput (HTTP/appmix)1
Mbps Initial path selection (PBF)
Threat Prevention throughput (HTTP/ 240/280 Dynamic path change
appmix)2 Mbps
IPv6
IPsec VPN throughput3 500 Mbps L2, L3, tap, virtual wire (transparent mode)
Max sessions 64,000 Features: App-ID, User-ID, Content-ID, WildFire, and SSL
New sessions per second4 4,200 Decryption
SLAAC
1. Firewall throughput is measured with App-ID and logging enabled, using 64 KB
HTTP/appmix transactions. IPsec VPN
2. Threat Prevention throughput is measured with App-ID, IPS, antivirus, anti-
spyware, WildFire, file blocking, and logging enabled, utilizing 64 KB HTTP/
Key exchange: manual key, IKEv1, and IKEv2 (pre-shared
appmix transactions. key, c
­ ertificate-based authentication)
3. IPsec VPN throughput is measured with 64 KB HTTP transactions and logging
enabled.
Encryption: 3DES, AES (128-bit, 192-bit, 256-bit)
4. New sessions per second is measured with application-override utilizing 1 byte Authentication: MD5, SHA-1, SHA-256, SHA-384, SHA-512
HTTP transactions.
VLANs

The PA-220 supports a wide range of networking features 802.1Q VLAN tags per device/per interface: 4,094/4,094
that enable you to more easily integrate our security features Network Address Translation
into your existing network. NAT modes (IPv4): static IP, dynamic IP, dynamic IP and port
(port address translation)
Table 2: PA-220 Networking Features NAT64, NPTv6
Interface Modes Additional NAT features: dynamic IP reservation, tunable
L2, L3, tap, virtual wire (transparent mode) dynamic IP and port oversubscription
High Availability
Routing
Modes: active/active, active/passive
OSPFv2/v3 with graceful restart, BGP with graceful restart, RIP,
static routing
Failure detection: path monitoring, interface monitoring
Policy-based forwarding
Point-to-Point Protocol over Ethernet (PPPoE)
Multicast: PIM-SM, PIM-SSM, IGMP v1, v2, and v3

Strata by Palo Alto Networks | PA-220 | Datasheet 2

 Table 3: PA-220 Hardware Specifications Dimensions

I/O 1.62” H x 6.29” D x 8.07” W

10/100/1000 (8) Weight (Stand-Alone Device/As Shipped)

Management I/O 3.0 lbs / 5.4 lbs

10/100/1000 out-of-band management port (1) Safety

RJ-45 console port (1)
cCSAus, CB
USB port (1)
Micro USB console port (1) EMI
Storage Capacity FCC Class B, CE Class B, VCCI Class B
32 GB eMMC Certifications
Power Supply (Avg/Max Power Consumption) See https://www.paloaltonetworks.com/company/­
certifications.html
Optional: dual redundant 40 W (21 W / 25 W)
Environment
Max BTU/hr
Operating temperature: 32° to 104° F, 0° to 40° C
102
Non-operating temperature: -4° to 158° F, -20° to 70° C
Input Voltage (Input Frequency) Passive cooling

100–240 VAC (50–60Hz)

Max Current Consumption To learn more about the features and associated capacities of
Firewall: 1.75 A @ 12 VDC the PA-220, please visit www.paloaltonetworks.com/products.
Power supply (AC side): 0.5 A @ 100 VAC, 0.2 A @ 240 VAC

3000 Tannery Way © 2020 Palo Alto Networks, Inc. Palo Alto Networks is a registered
Santa Clara, CA 95054 ­trademark of Palo Alto Networks. A list of our trademarks can be found at
https://www.paloaltonetworks.com/company/trademarks.html. All other
Main: +1.408.753.4000 marks mentioned herein may be trademarks of their respective companies.
Sales: +1.866.320.4788 strata-pa-220-ds-020520
Support: +1.866.898.9087

www.paloaltonetworks.com