Palo Alto Networks PAN-PA-3440 1U Rackmount Firewall with 12x 10G RJ45, 10x 10G SFP+, 4x SFP28, 2x 100G QSFP28
Overview
The Palo Alto Networks PA-3400 Series is the campus-edge tier: 1U appliances with multigigabit copper, 10 gigabit SFP+ and 25 gigabit SFP28 interfaces, redundant 450 W power supplies as standard, and dedicated high-availability ports including a 10 gigabit SFP+ HA link. It runs PAN-OS with the single-pass architecture, supports a maximum of eleven virtual systems (one in the base, the rest separately licensed), and allows NGFW clustering for horizontal scaling across appliances. The PAN-PA-3440 is the copper, SFP28 and 40/100G QSFP configuration in that line-up, rated at 35 Gbps of firewall throughput. This SKU is supplied as Appliance Only: PAN-OS and its base platform capabilities are included. The Cloud-Delivered Security Services, such as Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security, are licensed for a term and sold separately, as is the support contract.
Technical Details
The Palo Alto Networks PAN-PA-3440 is a 1U rackmount next-generation firewall with 12×1/2.5/5/10GbE RJ45, 10×1/10GbE SFP/SFP+, 4×25GbE SFP28, 2×40/100GbE QSFP/QSFP28, running PAN-OS. Firewall throughput (appmix) is 35 Gbps, measured with App-ID and logging enabled. Threat Prevention throughput (appmix) is 20 Gbps, measured with App-ID, IPS, antivirus, antispyware, WildFire, file blocking, and logging enabled. IPsec VPN throughput is 14.5 Gbps on 64 KB HTTP transactions with logging enabled. It holds 3,000,000 concurrent sessions and opens 268,000 new sessions per second. Palo Alto Networks support and security subscriptions are sold separately. It operates 32°F to 104°F (0°C to 40°C) and is used at a campus or main-office internet edge, in the DMZ, and for internal segmentation between user and server segments.
Best For
The PAN-PA-3440 suits a campus or main-office internet edge that needs 20 Gbps of Threat Prevention throughput with 3,000,000 concurrent sessions behind it. Its interfaces are 12×1/2.5/5/10GbE RJ45, 10×1/10GbE SFP/SFP+, 4×25GbE SFP28, 2×40/100GbE QSFP/QSFP28. Firewall throughput (appmix) is 35 Gbps, measured with App-ID and logging enabled. Compare it with the PAN-PA-3430, its nearest model in the same family, on those two figures rather than on port count.
Not suitable if:
- your inspected traffic exceeds 20 Gbps, since that is the published Threat Prevention throughput
- you need the Cloud-Delivered Security Services included in the part number, since an Appliance Only SKU carries PAN-OS only and the subscriptions are sold separately
- you need Power over Ethernet, since this model provides none
- you need a hardened appliance for a plant floor or outdoor cabinet, since this unit is rated only for 32°F to 104°F (0°C to 40°C)
PAN-PA-3440 Specifications
| Ports & Uplinks | |
|---|---|
| Fixed Interfaces | 12×1/2.5/5/10GbE RJ45, 10×1/10GbE SFP/SFP+, 4×25GbE SFP28, 2×40/100GbE QSFP/QSFP28 |
| Max Port Speed | 100 GbE |
| Management & Console Ports | 1×1GbE RJ45 out-of-band management, 2×1GbE high availability, 1×10GbE SFP+ high availability, 1×RJ45 console, 1×micro-USB |
| Performance & Scale | |
| Firewall Throughput | 35 Gbps (appmix) |
| Threat Prevention Throughput | 20 Gbps (appmix) |
| TLS/SSL Inspection Throughput | Not published |
| IPsec VPN Throughput | 14.5 Gbps (64 KB HTTP) |
| Maximum Concurrent Sessions | 3,000,000 |
| New Sessions per Second | 268,000 |
| Hardware & Memory | |
| Onboard Storage | 480 GB SSD |
| Power & Thermal | |
| Power Supply | Redundant 450 W AC; 100-240 VAC input (50-60 Hz); maximum current consumption 1.9 A @ 100 VAC, 0.8 A @ 240 VAC |
| Redundant Power Supply | Yes |
| Maximum Power Consumption | 190 W (133 W average) |
| Cooling | Front-to-back airflow |
| Physical & Environmental | |
| Form Factor | 1U Rackmount |
| Dimensions (H x W x D) | 1.70 × 17.15 × 14.15 in (4.32 × 43.56 × 35.94 cm) |
| Weight | 15.5 lb (7.03 kg) |
| Operating Temperature | 32°F to 104°F (0°C to 40°C) |
| Software | |
| Operating System | PAN-OS |
| High Availability | Active/Active, Active/Passive, HA Clustering |
| Central Management Platform | Panorama, Strata Cloud Manager |
| Routing Protocols & IPv6 | OSPFv2/v3 with graceful restart, BGP with graceful restart, RIP, static routing, policy-based forwarding, PPPoE, multicast (PIM-SM, PIM-SSM, IGMP v1/v2/v3), Bidirectional Forwarding Detection (BFD), NAT64 and NPTv6 |
FAQ
Does the Palo Alto Networks PAN-PA-3440 support PoE?
No. The PAN-PA-3440 provides no Power over Ethernet, so cameras, access points and IP phones need their own power source or a PoE switch between them and the firewall. Its interfaces are 12×1/2.5/5/10GbE RJ45, 10×1/10GbE SFP/SFP+, 4×25GbE SFP28, 2×40/100GbE QSFP/QSFP28, all data-only. Other models in the Palo Alto range do carry PoE ports on separate part numbers.
What interfaces does the PAN-PA-3440 have?
The PAN-PA-3440 provides 12×1/2.5/5/10GbE RJ45, 10×1/10GbE SFP/SFP+, 4×25GbE SFP28, 2×40/100GbE QSFP/QSFP28. Management and console connectivity is separate: 1×1GbE RJ45 out-of-band management, 2×1GbE high availability, 1×10GbE SFP+ high availability, 1×RJ45 console, 1×micro-USB. Pluggable transceivers are sold separately.
How does high availability work on the Palo Alto Networks PAN-PA-3440?
The PAN-PA-3440 supports active/active and active/passive high availability. This model has dedicated high-availability ports, listed among its management interfaces. NGFW clustering is also supported, which scales capacity horizontally across several appliances.
How much traffic can the PAN-PA-3440 handle?
Palo Alto publishes no user count, so compare the PAN-PA-3440 on its published capacity figures. Firewall throughput (appmix) is 35 Gbps, measured with App-ID and logging enabled. Threat Prevention throughput (appmix) is 20 Gbps, measured with App-ID, IPS, antivirus, antispyware, WildFire, file blocking, and logging enabled. It holds 3,000,000 concurrent sessions, measured with HTTP transactions, and opens 268,000 new sessions per second, measured with application override on 1-byte HTTP transactions. All figures were measured on PAN-OS 12.1.
What is the difference between the PAN-PA-3440 and the PAN-PA-3430?
Both run the same PAN-OS and share the family's platform capabilities. The PAN-PA-3440 is rated at 35 Gbps firewall throughput, 20 Gbps Threat Prevention throughput and 3,000,000 concurrent sessions; the PAN-PA-3430 is rated at 29 Gbps, 15 Gbps and 2,500,000. The two models have the same fixed interface set.
Does the PAN-PA-3440 require a subscription to operate?
No. The PAN-PA-3440 runs PAN-OS without any subscription, and its base platform capabilities include stateful firewalling and NAT, App-ID, User-ID, Content-ID, SSL/TLS decryption, IPsec VPN, dynamic routing, IPv6 and high availability. The Cloud-Delivered Security Services, including Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security, are licensed for a term and sold separately.
Does the PAN-PA-3440 need a support contract?
Yes, unless your organisation holds an active Enterprise Support Agreement. A support service contract is required with the PAN-PA-3440, and one-, three- and five-year options are available. Network Devices Inc. confirms the correct support option and any additional Palo Alto Networks licenses the deployment needs before the order is placed.
What is the SSL/TLS decryption throughput of the PAN-PA-3440?
Palo Alto Networks does not publish a separate SSL/TLS decryption throughput figure for the PAN-PA-3440. The datasheet lists SSL/TLS decryption as a platform capability but provides no bandwidth figure; do not infer decryption throughput from the Threat Prevention throughput.
What condition is the PAN-PA-3440 sold in, and what warranty applies?
Network Devices Inc. supplies the PAN-PA-3440 new and factory sealed. It is covered by a one-year Network Devices Inc. warranty. Orders ship from our New Jersey and Texas warehouses.
