Palo Alto Networks Enterprise Firewall PA-220R


  • 500 Mbps firewall throughput (App-ID enabled)
  • 150 Mbps threat prevention throughput
  • 100 Mbps IPSec VPN throughput
  • 64,000 max sessions
  • 4,200 new sessions per second

PA-220R Premium Support - 1 Year

Premium support year 1

PA-220R Premium Support - 3 Year

Premium support 3 years

PA-220R Premium Support - 5 Year

Premium support 5 years

Categories: , SKU: PAN-PA-220R


Ruggedized for industrial applications

The PA-220R is a next-generation firewall appliance in a ruggedized form factor, providing rock-solid network security for severe environments, such as utility substations, power plants, manufacturing plants, oil and gas facilities, building management systems, and healthcare networks.

Note: Support must be purchased with the firewall for either 1,3 or 5 years. We are unable to process new firewall orders without at least 1 year  premium support.

1. Firewall throughput measured with App-ID and logging enabled utilizing 64KB HTTP/appmix transactions
2. Threat Prevention throughput measured with App-ID, IPS, antivirus, anti-spyware, WildFire and logging enabled utilizing 64KB HTTP/appmix transactions
3. IPsec VPN throughput measured with 64KB HTTP transactions
4. New sessions per second measured with application-override utilizing 1-byte HTTP transactions
5. Adding virtual systems to the base quantity requires a separately purchased license

Technical Spec

Specifications are provided by the manufacturer.
  • Dimensions & Weight (Shipping)

    • 6 lbs
  • Networking

    • IEEE 802.1Q
    • Wired
    • Ethernet, Fast Ethernet, Gigabit Ethernet
    • Firewall protection, High Availability, IPSec Virtual Private Network (VPN), IPv4 support, IPv6 support, LDAP support, NAT support, VLAN support
    • External
    • PPPoE
    • BGP, IGMP, IGMPv2, IGMPv3, OSPFv2, OSPFv3, PIM-SM, PIM-SSM, Policy-based routing (PBR), RIP, Static IP routing
    • Security appliance
  • Interface Provided

    • RJ-45
    • 6
    • 1000Base-T
    • SFP (mini-GBIC)
    • 2
    • 1
    • 1000Base-T (management)
    • Console
    • USB
  • Miscellaneous

    • Black, Blue
    • FCC Class A certified, IEC 61850-3, IEEE 1613, TUV, VCCI Class A
    • 128-bit AES, 192-bit AES, 256-bit AES, 256-bit SHA, 384-bit SHA, 512-bit SHA, IKE, IKEv2, MD5, SHA-1, SSL, Triple DES
    • 2
  • Environmental Parameters

    • 5 – 90% (non-condensing)
    • 158 °F
    • -40 °F
  • Header

    • Palo
    • Palo Alto
    • PA-220R
    • 1
    • Palo
  • Power Device

    • DC 12 – 24 V
    • 13 Watt
    • Internal power supply
  • Storage Hard Drive

    • 64 GB
  • Capacity

    • Maximum number of sessions
    • 64000
    • New sessions per second
    • 4200
    • VLAN tags per device
    • 4094
    • VLAN tags per interface
  • Performance

    • Firewall throughput
    • 500 Mbps
    • Threat prevention throughput
    • 150 Mbps
    • VPN throughput (IPSec)
    • 100 Mbps
  • Dimensions & Weight

    • 8.7 in
    • 2 in
    • 4.5 lbs
    • 9.3 in
  • Hard Drive

    • 1
    • SSD

Physical Spec

The following table describes PA-220R firewall physical specifications.
Dimensions and Rack units (U)
Firewall Dimensions
2.0” H x 8.66” D x 9.25” W (5.08cm H x 22cm D x 23.5cm W)
The depth measurement includes hardware that protrudes from the front of the firewall. If the rubber feet are installed on the bottom of the firewall, add .78” (2cm) to the height.
Rack Units
The following dimensions apply when the firewall is installed in the PA-220R 19-inch rack kit:
  • Rack units


  • Rack kit dimensions

    —3.5” H x 8” D x 19” W (8.89cm H x 20.32cm D x 48.26cm W)

  • Firewall weight

    —4.5 lbs. (2.04kg)

  • Shipping weight

    —6 lbs. (2.72kg)

Electrical Spec

The following table describes PA-220R firewall electrical specifications.
Input voltage must comply with Safety Extra Low Voltage (SELV) requirements and the available input power must be limited to less than 100W as defined in IEC 60950-1.
Input voltage and current
12-48VDC 1.4A
Power consumption
Maximum current consumption
Maximum inrush current
If you want to power the PA-220R with AC power, you must order the PAN-PWR-60W-AC adapter.

Environmental Spec

The following table describes PA-220R firewall environmental specifications.
Operating temperature range
-40°F to 158°F (-40° to 70°C)
Non-operating temperature
-40°F to 167°F (-40° to 75°C)
Humidity tolerance
5% to 90% non-condensing
The PA-220R firewall uses passive cooling and does not contain fans.
Maximum BTU/hr
Acoustic noise
Emits no sound
Maximum operating altitude
10,000ft (3,048m)

Miscellaneous Spec

The following table describes PA-220R firewall miscellaneous specifications.
Storage capacity
One 32GB solid-state drive (SSD) for the PAN-OS system files, system logs, and network traffic logs.
Mean time between failures (MTBF)
29 years

Front Panel

The following image shows the front panel of the PA-220R firewall and the table describes each front-panel component.
Screw-on ground point
Use this ground point to connect the firewall to earth ground (ground cable not included).
DC power and ground inputs
Use the DC input terminal block to connect DC power to the firewall. The terminal block is included in the accessories kit and is labeled A+, A-, B+, and B-.
The two inputs to the right of the four DC power inputs are ground inputs (use only one) that you can use in place of the screw-on ground point on the firewall (see Connect Power to a PA-220R Firewall).
Ethernet ports 1 through 6
Six RJ-45 10Mbps/100Mbps/1000Mbps ports for network traffic. You can set the link speed and duplex or choose auto-negotiate for each port. These ports also have built-in surge protection.
SFP ports 7 and 8
Two SFP (1Gbps) ports for network traffic.
These ports also support 100Base-FX.
MGT port
Use this Ethernet 10Mbps/100Mbps/1000Mbps port to access the management web interface and perform administrative tasks. The firewall also uses this port for management services, such as retrieving licenses and updating the threat and application signatures.
CONSOLE port (RJ-45)
Use this port to connect a management computer to the firewall using a 9-pin serial-to-RJ-45 cable and terminal emulation software.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
If your management computer does not have a serial port, use a USB-to-serial converter.

Use the following settings to configure your terminal emulation software to connect to the console port:

  • Data rate: 9600
  • Data bits: 8
  • Parity: None
  • Stop bits: 1
  • Flow control: None
A USB port that accepts a USB flash drive with a bootstrap bundle (PAN-OS configuration).
Bootstrapping speeds up the process of configuring and licensing the firewall to make it operational on the network with or without internet access.
CONSOLE port (Micro USB)
Use this port to connect a management computer to the firewall using a standard Type-A USB-to-micro USB cable.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
Refer to the Micro USB Console Port page for more information and to download the Windows driver or to learn how to connect from a Mac computer.
LED status indicators
Five LEDs that indicate the status of the firewall hardware components (see PA-220R Status LEDs).

Rear Panel

The following image shows the back panel of the PA-220R firewall. The only usable components on the back panel are the two screw holes used to Install the PA-220R Firewall on a DIN Rail. There are also two DIN-bracket screw holes (not shown) on the bottom of the firewall.


You may also like…