Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200, ION 1200-S, ION 3200, ION 5200, and ION 9200
Caveat: Interim Validation. The tamper evident seals installed as indicated in the Security Policy
Certificate
| Certificate number | 4719 |
|---|---|
| Standard | FIPS 140-3 |
| Status | historical |
| Overall level | 2 |
| Module type | Hardware |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | Palo Alto Networks, Inc. · website |
| Hardware versions | [ION 1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW, ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW, ION 3200] with FIPS Kit P/N 920-000363, and [ION 5200 and ION 9200] with FIPS Kit P/N 920-000333 |
| Firmware versions | 6.1.2 |
Module description
The Palo Alto Networks SD-WAN Instant-On Network (ION) Devices (ION 1200, ION 1200-S, ION 3200, ION 5200 and ION 9200) enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of your WAN.
Security level exceptions
- Operational environment: N/A
- Non-invasive security: N/A
- Mitigation of other attacks: N/A
Approved algorithms
| Algorithm | CAVP certificate |
|---|---|
| AES-CBC | A3563 |
| AES-CBC | A3564 |
| AES-CBC | A3565 |
| AES-CTR | A3563 |
| AES-ECB | A3563 |
| AES-GCM | A3563 |
| AES-GCM | A3564 |
| Counter DRBG | A3563 |
| ECDSA KeyGen (FIPS186-4) | A3563 |
| ECDSA KeyGen (FIPS186-4) | A3564 |
| ECDSA SigGen (FIPS186-4) | A3563 |
| ECDSA SigVer (FIPS186-4) | A3563 |
| HMAC DRBG | A3564 |
| HMAC-SHA-1 | A3563 |
| HMAC-SHA2-224 | A3563 |
| HMAC-SHA2-256 | A3563 |
| HMAC-SHA2-256 | A3564 |
| HMAC-SHA2-256 | A3565 |
| HMAC-SHA2-384 | A3563 |
| HMAC-SHA2-384 | A3564 |
| HMAC-SHA2-384 | A3565 |
| HMAC-SHA2-512 | A3563 |
| HMAC-SHA2-512 | A3565 |
| KAS-ECC-SSC Sp800-56Ar3 | A3563 |
| KAS-ECC-SSC Sp800-56Ar3 | A3564 |
| KDF IKEv2 | A3563 |
| KDF SNMP | A3563 |
| KDF SSH | A3563 |
| KDF TLS | A3563 |
| KDF TLS | A3564 |
| RSA KeyGen (FIPS186-4) | A3563 |
| RSA SigGen (FIPS186-4) | A3563 |
| RSA SigVer (FIPS186-4) | A3563 |
| RSA SigVer (FIPS186-4) | A3564 |
| RSA SigVer (FIPS186-4) | C170 |
| SHA-1 | A3563 |
| SHA-1 | C170 |
| SHA2-224 | A3563 |
| SHA2-224 | A3564 |
| SHA2-256 | A3563 |
| SHA2-256 | A3564 |
| SHA2-256 | A3565 |
| SHA2-256 | C170 |
| SHA2-384 | A3563 |
| SHA2-384 | A3564 |
| SHA2-384 | A3565 |
| SHA2-512 | A3563 |
| SHA2-512 | A3564 |
| SHA2-512 | A3564 |
| SHA2-512 | A3565 |
Tested configurations
- N/A
Validation history
| Date | Type | Lab |
|---|---|---|
| 2024-07-11 | Initial | Gossamer Security Solutions |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status historical
- Validation dates on record: 2024-07-11