Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200 and ION 9000
Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200 and ION 9000, from Palo Alto Networks, Inc., holds FIPS 140-3 certificate #4704 at overall level 2. The validation is active, with a sunset date of 2029-06-06. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.
Caveat: The tamper evident seals installed as indicated in the Security Policy
Certificate
| Certificate number | 4704 |
|---|---|
| Standard | FIPS 140-3 |
| Status | active |
| Sunset date | 2029-06-06 |
| Overall level | 2 |
| Module type | Hardware |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | Palo Alto Networks, Inc. · website |
| Hardware versions | [ION 1200, ION 1200-C-NA, ION 1200-C-ROW, and ION 1200-C-5G-WW] with FIPS Kit (P/N 920-000363), and ION 9000 with FIPS Kit (P/N 920-000311) |
| Firmware versions | 5.6.3 |
Module description
Quoted from the NIST CMVP entry for this certificate.
The Palo Alto Networks Prisma SD-WAN ION 1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW devices are multi-chip standalone modules that enable integration of heterogeneous WAN links, provide confident integration of the cloud, improve application performance/visibility, and reduce overall cost and complexity of customers WAN. Prisma SD-WAN ION 9000 is a multi-chip standalone module designed for the data center to create a secure SD-WAN fabric across branches and data centers. It is designed to install seamlessly in the data center by peering with adjacent data center devices using traditional, standards-based routing protocols.
Security level exceptions
- Operational environment: N/A
- Non-invasive security: N/A
- Mitigation of other attacks: N/A
Approved algorithms (25)
| Algorithm | CAVP certificates |
|---|---|
| AES-CBC | A2385, A2386, A2387, A2388 |
| AES-CTR | A2385 |
| AES-ECB | A2385 |
| AES-GCM | A2385, A2386 |
| Counter DRBG | A2385 |
| ECDSA KeyGen (FIPS186-4) | A2385, A2386 |
| ECDSA KeyVer (FIPS186-4) | A2385, A2386 |
| ECDSA SigGen (FIPS186-4) | A2385 |
| ECDSA SigVer (FIPS186-4) | A2385 |
| HMAC DRBG | A2386 |
| HMAC-SHA-1 | A2385 |
| HMAC-SHA2-224 | A2385 |
| HMAC-SHA2-256 | A2385, A2386, A2387, A2388 |
| HMAC-SHA2-384 | A2385, A2386, A2387, A2388 |
| HMAC-SHA2-512 | A2385, A2386, A2387, A2388 |
| KAS-ECC-SSC Sp800-56Ar3 | A2385, A2386 |
| KDF TLS | A2386 |
| RSA KeyGen (FIPS186-4) | A2385 |
| RSA SigGen (FIPS186-4) | A2385 |
| RSA SigVer (FIPS186-4) | A2385, A2386, C170, RSA 1819, RSA 1820 |
| SHA-1 | A2385, A2386, A2387, C170, SHS 2919, SHS 2920 |
| SHA2-224 | A2385, A2386 |
| SHA2-256 | A2385, A2386, A2387, A2388, C170, SHS 2919, SHS 2920 |
| SHA2-384 | A2385, A2386, A2387, A2388 |
| SHA2-512 | A2385, A2386, A2387, A2388 |
Tested configurations
- N/A
Validation history
| Date | Type | Lab |
|---|---|---|
| 2024-06-07 | Initial | Gossamer Security Solutions |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status active
- Validation dates on record: 2024-06-07