808bits

Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200 and ION 9000

FIPS 140-3 certificate #4704 · Palo Alto Networks, Inc. · data as of 2026-08-28
Active. Sunset date 2029-06-06, 1012 days away.
Caveat: The tamper evident seals installed as indicated in the Security Policy

Certificate

Certificate number4704
StandardFIPS 140-3
Statusactive
Sunset date2029-06-06
Overall level2
Module typeHardware
EmbodimentMulti-Chip Stand Alone
VendorPalo Alto Networks, Inc. · website
Hardware versions[ION 1200, ION 1200-C-NA, ION 1200-C-ROW, and ION 1200-C-5G-WW] with FIPS Kit (P/N 920-000363), and ION 9000 with FIPS Kit (P/N 920-000311)
Firmware versions5.6.3

Module description

The Palo Alto Networks Prisma SD-WAN ION 1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW devices are multi-chip standalone modules that enable integration of heterogeneous WAN links, provide confident integration of the cloud, improve application performance/visibility, and reduce overall cost and complexity of customers WAN. Prisma SD-WAN ION 9000 is a multi-chip standalone module designed for the data center to create a secure SD-WAN fabric across branches and data centers. It is designed to install seamlessly in the data center by peering with adjacent data center devices using traditional, standards-based routing protocols.

Security level exceptions

  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms

AlgorithmCAVP certificate
AES-CBCA2385
AES-CBCA2386
AES-CBCA2387
AES-CBCA2388
AES-CTRA2385
AES-ECBA2385
AES-GCMA2385
AES-GCMA2386
Counter DRBGA2385
ECDSA KeyGen (FIPS186-4)A2385
ECDSA KeyGen (FIPS186-4)A2386
ECDSA KeyVer (FIPS186-4)A2385
ECDSA KeyVer (FIPS186-4)A2386
ECDSA SigGen (FIPS186-4)A2385
ECDSA SigVer (FIPS186-4)A2385
HMAC DRBGA2386
HMAC-SHA-1A2385
HMAC-SHA2-224A2385
HMAC-SHA2-256A2385
HMAC-SHA2-256A2386
HMAC-SHA2-256A2387
HMAC-SHA2-256A2388
HMAC-SHA2-384A2385
HMAC-SHA2-384A2386
HMAC-SHA2-384A2387
HMAC-SHA2-384A2388
HMAC-SHA2-512A2385
HMAC-SHA2-512A2386
HMAC-SHA2-512A2387
HMAC-SHA2-512A2388
KAS-ECC-SSC Sp800-56Ar3A2385
KAS-ECC-SSC Sp800-56Ar3A2386
KDF TLSA2386
RSA KeyGen (FIPS186-4)A2385
RSA SigGen (FIPS186-4)A2385
RSA SigVer (FIPS186-4)A2385
RSA SigVer (FIPS186-4)A2386
RSA SigVer (FIPS186-4)C170
RSA SigVer (FIPS186-4)RSA 1819
RSA SigVer (FIPS186-4)RSA 1820
SHA-1A2385
SHA-1A2386
SHA-1A2387
SHA-1C170
SHA-1SHS 2919
SHA-1SHS 2920
SHA2-224A2385
SHA2-224A2386
SHA2-256A2385
SHA2-256A2386
SHA2-256A2387
SHA2-256A2388
SHA2-256C170
SHA2-256SHS 2919
SHA2-256SHS 2920
SHA2-384A2385
SHA2-384A2386
SHA2-384A2387
SHA2-384A2388
SHA2-512A2385
SHA2-512A2386
SHA2-512A2387
SHA2-512A2388

Tested configurations

  • N/A

Validation history

DateTypeLab
2024-06-07InitialGossamer Security Solutions

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status active
  • Validation dates on record: 2024-06-07

Source documents