Palo Alto Networks SD-WAN ION Core Crypto Module
Caveat: Interim Validation. When installed, initialized and configured as specified in section "Secure Operation" of the Security Policy and operated in approved mode
Certificate
| Certificate number | 4715 |
|---|---|
| Standard | FIPS 140-3 |
| Status | historical |
| Overall level | 1 |
| Module type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | Palo Alto Networks, Inc. · website |
| Software versions | 1.0 |
Module description
The Palo Alto Networks SD-WAN ION Core Crypto Module is utilized in hardware and software ION form factors. These enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of your WAN.
Security level exceptions
- Physical security: N/A
- Non-invasive security: N/A
- Mitigation of other attacks: N/A
Approved algorithms
| Algorithm | CAVP certificate |
|---|---|
| AES-CBC | A3564 |
| AES-CBC | A3566 |
| AES-CTR | A3563 |
| AES-ECB | A3563 |
| AES-GCM | A3563 |
| AES-GCM | A3564 |
| Counter DRBG | A3563 |
| ECDSA KeyGen (FIPS186-4) | A3563 |
| ECDSA KeyGen (FIPS186-4) | A3564 |
| ECDSA SigGen (FIPS186-4) | A3563 |
| ECDSA SigVer (FIPS186-4) | A3563 |
| HMAC DRBG | A3564 |
| HMAC-SHA-1 | A3563 |
| HMAC-SHA2-224 | A3563 |
| HMAC-SHA2-256 | A3564 |
| HMAC-SHA2-256 | A3566 |
| HMAC-SHA2-384 | A3563 |
| HMAC-SHA2-384 | A3564 |
| HMAC-SHA2-512 | A3563 |
| HMAC-SHA2-512 | A3564 |
| KAS-ECC-SSC Sp800-56Ar3 | A3563 |
| KAS-ECC-SSC Sp800-56Ar3 | A3564 |
| KDF IKEv2 | A3563 |
| KDF SNMP | A3563 |
| KDF SSH | A3563 |
| KDF TLS | A3563 |
| KDF TLS | A3564 |
| RSA KeyGen (FIPS186-4) | A3563 |
| RSA SigGen (FIPS186-4) | A3563 |
| RSA SigVer (FIPS186-4) | A3563 |
| RSA SigVer (FIPS186-4) | A3572 |
| SHA-1 | A3566 |
| SHA2-224 | A3563 |
| SHA2-256 | A3563 |
| SHA2-256 | A3564 |
| SHA2-384 | A3563 |
| SHA2-384 | A3564 |
| SHA2-512 | A3563 |
| SHA2-512 | A3564 |
Tested configurations
- ION 6.1 running on ION 1200 with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200 with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-C-5G-WW with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-C-5G-WW with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-C-NA with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-C-NA with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-C-ROW with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-C-ROW with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-S with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-S with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-S-C-5G-WW with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-S-C-5G-WW with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-S-C-NA with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-S-C-NA with Intel Atom C3436L without PAA
- ION 6.1 running on ION 1200-S-C-ROW with Intel Atom C3436L with PAA
- ION 6.1 running on ION 1200-S-C-ROW with Intel Atom C3436L without PAA
- ION 6.1 running on ION 3200 with Intel Atom C3558R with PAA
- ION 6.1 running on ION 3200 with Intel Atom C3558R without PAA
- ION 6.1 running on ION 5200 with Intel Atom C5325 with PAA
- ION 6.1 running on ION 5200 with Intel Atom C5325 without PAA
- ION 6.1 running on ION 9200 with Intel Atom P5362 with PAA
- ION 6.1 running on ION 9200 with Intel Atom P5362 without PAA
Validation history
| Date | Type | Lab |
|---|---|---|
| 2024-07-08 | Initial | Gossamer Security Solutions |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status historical
- Validation dates on record: 2024-07-08