808bits

Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200, ION 1200-S, ION 3200, ION 5200, and ION 9200

FIPS 140-3 certificate #4719 · Palo Alto Networks, Inc. · data as of 2026-10-21

Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200, ION 1200-S, ION 3200, ION 5200, and ION 9200, from Palo Alto Networks, Inc., holds FIPS 140-3 certificate #4719 at overall level 2. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Historical. Replaced by certificate #5393. Federal agencies may reference historical validations for existing systems only, not for new procurement.
Caveat: Interim Validation. The tamper evident seals installed as indicated in the Security Policy

Certificate

Certificate number4719
StandardFIPS 140-3
Statushistorical
Overall level2
Module typeHardware
EmbodimentMulti-Chip Stand Alone
VendorPalo Alto Networks, Inc. · website
Hardware versions[ION 1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW, ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW, ION 3200] with FIPS Kit P/N 920-000363, and [ION 5200 and ION 9200] with FIPS Kit P/N 920-000333
Firmware versions6.1.2

Module description

Quoted from the NIST CMVP entry for this certificate.

The Palo Alto Networks SD-WAN Instant-On Network (ION) Devices (ION 1200, ION 1200-S, ION 3200, ION 5200 and ION 9200) enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of your WAN.

Security level exceptions

  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms (27)

AlgorithmCAVP certificates
AES-CBCA3563, A3564, A3565
AES-CTRA3563
AES-ECBA3563
AES-GCMA3563, A3564
Counter DRBGA3563
ECDSA KeyGen (FIPS186-4)A3563, A3564
ECDSA SigGen (FIPS186-4)A3563
ECDSA SigVer (FIPS186-4)A3563
HMAC DRBGA3564
HMAC-SHA-1A3563
HMAC-SHA2-224A3563
HMAC-SHA2-256A3563, A3564, A3565
HMAC-SHA2-384A3563, A3564, A3565
HMAC-SHA2-512A3563, A3565
KAS-ECC-SSC Sp800-56Ar3A3563, A3564
KDF IKEv2A3563
KDF SNMPA3563
KDF SSHA3563
KDF TLSA3563, A3564
RSA KeyGen (FIPS186-4)A3563
RSA SigGen (FIPS186-4)A3563
RSA SigVer (FIPS186-4)A3563, A3564, C170
SHA-1A3563, C170
SHA2-224A3563, A3564
SHA2-256A3563, A3564, A3565, C170
SHA2-384A3563, A3564, A3565
SHA2-512A3563, A3564, A3565

Tested configurations

  • N/A

Validation history

DateTypeLab
2024-07-11InitialGossamer Security Solutions

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical
  • Validation dates on record: 2024-07-11

Source documents