Palo Alto Networks Enterprise Firewall PA-220


  • 500 Mbps firewall throughput (App-ID enabled)
  • 150 Mbps threat prevention throughput
  • 100 Mbps IPSec VPN throughput
  • 64,000 max sessions
  • 4,200 new sessions per second

PA-220 Premium Support - 1 Year

Premium support year 1

PA-220 Premium Support - 3 Year

Premium support 3 years

PA-220 Premium Support - 5 Year

Premium support 5 years

Categories: , SKU: PAN-PA-220


Next-Generation Firewall in a Small Footprint

The PA-220 is a next-generation firewall appliance in a small form factor that secures networks by preventing a broad range of cyber threats while safely enabling applications.

Note: Support must be purchased with the firewall for either 1,3 or 5 years. We are unable to process new firewall orders without at least 1 year  premium support.

1. Firewall throughput measured with App-ID and logging enabled utilizing 64KB HTTP/appmix transactions
2. Threat Prevention throughput measured with App-ID, IPS, antivirus, anti-spyware, WildFire and logging enabled utilizing 64KB HTTP/appmix transactions
3. IPsec VPN throughput measured with 64KB HTTP transactions
4. New sessions per second measured with application-override utilizing 1-byte HTTP transactions
5. Adding virtual systems to the base quantity requires a separately purchased license

Technical Spec

Specifications are provided by the manufacturer.
  • Networking

    • IEEE 802.1Q
    • Wired
    • Ethernet, Fast Ethernet, Gigabit Ethernet
    • 500 (Mbps)
    • Firewall protection, High Availability, IPSec Virtual Private Network (VPN), IPv4 support, IPv6 support, LDAP support, NAT support, VLAN support
    • External
    • PPPoE
    • SSH
    • BGP, Bidirectional Forwarding Detection (BFD), IGMP, IGMPv2, IGMPv3, OSPFv2, OSPFv3, PIM-SM, PIM-SSM, RIP, Static IPv4 routing
    • Security appliance
  • Interface Provided

    • RJ-45
    • 8
    • 1000Base-T
    • 1
    • 1000Base-T (management)
    • Console
    • USB
  • Miscellaneous

    • CB, cCSAus, FCC Class A certified, VCCI Class B
    • 128-bit AES, 192-bit AES, 256-bit AES, 256-bit SHA, 384-bit SHA-2, 512-bit SHA-2, IKE, IKEv2, MD5, SHA-1, SSL, Triple DES
  • Environmental Parameters

    • 104 °F
    • 32 °F
  • Header

    • Palo
    • PC
    • Palo Alto
    • PA-220
    • 1
    • Palo
  • Power Device

    • 50/60 Hz
    • 2
    • 2
    • AC 120/230 V
    • 75 Watt
    • 40 Watt
    • Yes
    • Internal power supply
  • Service & Support

    • 1 year warranty
  • Storage Hard Drive

    • 32 GB
  • Capacity

    • IPSec VPN tunnels
    • 250
    • Maximum number of policies
    • Maximum number of sessions
    • 64000
    • New sessions per second
    • 4200
    • Security zones
    • 15
    • Virtual routers
    • 3
    • VLAN tags per device
    • 4094
    • VLAN tags per interface
  • Performance

    • Firewall throughput
    • 500 Mbps
    • Threat prevention throughput
    • 150 Mbps
    • VPN throughput (IPSec)
    • 100 Mbps
  • Dimensions & Weight

    • 6.3 in
    • 1.6 in
    • 3 lbs
    • 8.1 in
  • Hard Drive

    • 1
    • SSD

Physical Spec

Physical Specifications
Learn about the PA-220 firewall physical specifications.
The following table describes PA-220 firewall physical specifications.
Rack units and dimensions
1.62”H X 6.29”D X 8.07”W (4.1cm X 16cm X 20.5cm)

The depth measurement includes hardware that protrudes from the back of the firewall. If the rubber feet are installed on the bottom of the firewall, add .78” (2cm) to the height.Rack units and dimensions if the PA-220 firewall is installed in the PA-220 19” rack kit.
  • Rack units—1U
  • Rack kit dimensions—1.75”H X 14”D X 17.5”W (4.44cm X 35.56cm X 44.45cm)
  • Firewall weight—3lbs (1.36Kg)
  • Shipping weight—5.4lbs (2.45Kg)

Electrical Spec

The following table describes PA-220 firewall electrical specifications.
Power adapter
The PA-220 firewall operates on DC power that is provided by the external power adapter (provided).
The firewall can operate on one power adapter or you can install a second power adapter for power redundancy.
Input voltage
Power adapter (AC side)—100-240VAC (50-60Hz)
The power adapter converts the AC power to 12VDC to provide power to the firewall.
Power consumption
Maximum current consumption
Power adapter (AC side)—0.5A@100VAC, 0.2A@240VAC
Maximum inrush current
AC power adapter input—0.47A@100VAC

Environmental Spec

The following table describes PA-220 firewall environmental specifications.
Operating temperature range
32°F to 104°F (0° to 40°C)
Non-operating temperature
-4°F to 158°F (-20° to 70°C)
Humidity tolerance
5% to 90% non-condensing
The PA-220 firewall uses passive cooling and does not contain fans.
Maximum BTUs/hour
102 BTUs/hour
Acoustic noise
Emits no sound.
Maximum operating altitude
10,000ft (3,048m)

Miscellaneous Spec

The following table describes PA-220 firewall miscellaneous specifications.
Storage capacity
One 32GB SSD for system files and log storage.
Mean time between failures (MTBF)
29 years

Front Panel

The following image shows the front panel of the PA-220 firewall and the table describes each front panel component.
Ethernet ports
Eight RJ-45 10/100/1000Mbps ports for network traffic.
You can set the link speed and duplex or choose auto-negotiate.
MGT port
Use this Ethernet 10/100/1000Mbps port to access the management web interface and perform administrative tasks. The firewall also uses this port for management services, such as retrieving licenses and updating threat and application signatures.
Use this port to connect a management computer to the firewall using a 9-pin serial to RJ-45 cable and terminal emulation software.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
If your management computer does not have a serial port, use a USB-to-serial converter.
Use the following settings to configure your terminal emulation software to connect to the console port:
  • Data rate: 9600
  • Data bits: 8
  • Parity: none
  • Stop bits: 1
  • Flow control: None
(Micro USB)
Use this port to connect a management computer to the firewall using a standard Type-A USB-to-micro USB cable.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
Refer to Micro USB Console Port for more information and to download the Windows driver or to learn how to connect from a Mac or Linux computer.
USB port
Use this port to bootstrap the firewall.
Bootstrapping enables you to provision the firewall with a specific PAN-OS configuration and then license it and make it operational on your network.
LED status indicators
Five LEDs that indicate the status of the firewall hardware components (see Interpret the LEDs on a PA-220 Firewall).

Rear Panel

The following image shows the back panel of the PA-220 firewall and the table describes each back panel component.
Power adapter inputs
(PWR 1 and PWR 2)
Use the power inputs to connect power to the firewall.
Use only the PA-220 external power adapters provided by Palo Alto Networks.
Ground stud
Use the single post ground stud to connect the firewall to earth ground (ground cable not included).