PaloAlto Networks ION 3000 Application guide

ION 3000 Hardware Reference
paloaltonetworks.com/documentation

2 ION 3000 HARDWARE REFERENCE |
Contact Information
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support
About the Documentation
• For the most recent version of this guide or for access to related documentation, visit the Technical
Documentation portal www.paloaltonetworks.com/documentation.
• To search for a specific topic, go to our search page www.paloaltonetworks.com/documentation/
document-search.html.
• Have feedback or questions for us? Leave a comment on any page in the portal, or write to us at
[email protected].
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2020-2021 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
Last Revised
March 31, 2021

TABLE OF CONTENTS iii
Table of Contents
Before You Begin................................................................................................5
Tamper Proof Statement...........................................................................................................................7
Third-Party Component Support.............................................................................................................8
Product Safety Warnings.......................................................................................................................... 9
ION 3000 Overview........................................................................................ 15
ION 3000.................................................................................................................................................... 17
ION 3000 Ports.........................................................................................................................................18
ION 3000 Front Panel with LEDs........................................................................................................ 19
ION 3000 Specifications......................................................................................................................... 20
ION Device Compliance Statement..................................................................................................... 22
ION 3000 Fail-to-Wire Cabling Matrix............................................................................................... 23
ION 3000 Installation Kit Components...............................................................................................24
ION 3000 Common Insertion Topologies.......................................................................................... 25
Power on the ION 3000.........................................................................................................................26
Shut Down the ION 3000......................................................................................................... 26
Reboot the ION 3000.................................................................................................................26
Install ION 3000............................................................................................... 27
Rack Mount the ION 3000.................................................................................................................... 29
Set Up the ION 3000 with an Existing Router................................................................................. 30
Set Up the ION 3000 by Replacing the Router................................................................................ 31

iv TABLE OF CONTENTS

5
Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-generation
firewall or appliance. The following topics apply to all Palo Alto Networks firewalls and
appliances except where noted.
> Tamper Proof Statement
> Third-Party Component Support
> Product Safety Warnings

6 ION 3000 HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.

ION 3000 HARDWARE REFERENCE | Before You Begin 7
© 2021 Palo Alto Networks, Inc.
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during shipping, verify
the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the tracking
number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.

8 ION 3000 HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party Component
Support statement.

ION 3000 HARDWARE REFERENCE | Before You Begin 9
© 2021 Palo Alto Networks, Inc.
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto Networks
hardware, be sure you understand and prepare for the following warnings before you install or service the
hardware. You will also see warning messages throughout the hardware reference where potential hazards
exist.
All Palo Alto Networks products with laser-based optical interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a specific
hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component that has
exposed circuits, ensure that you wear an electrostatic discharge (ESD) strap. Before handling the
component, make sure the metal contact on the wrist strap is touching your skin and that the other end
of the strap is connected to earth ground.
French Translation: Lorsque vous installez ou que vous intervenez sur un composant matériel de
pare-feu ou de dispositif Palo Alto Networks qui présente des circuits exposés, veillez à porter un
bracelet antistatique. Avant de manipuler le composant, vérifiez que le contact métallique du bracelet
antistatique est en contact avec votre peau et que l’autre extrémité du bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnetic
compliance (EMC) regulations.
French Translation: Des câbles Ethernet blindés reliés à la terre doivent être utilisés pour garantir la
conformité de l'organisme aux émissions électromagnétiques (CEM).
• (ION 7000 and ION 9000 only) At least two people are recommended for unpacking, handling, and
relocating the heavier firewalls.
• (All ION devices) The appliance meets the requirements of IEC 61000-4-5 surge immunity test. To
prevent damage from electrical surges on Ethernet ports, we recommend that you use an Ethernet surge
protection device with the following specifications:
• Rated for Gigabit Ethernet up to category 5E and minimum 1Gbps.
• Protection provided on all eight signal leads.
• Both line-to-line and line-to-ground/shield are provided.
• Protection device must be connected to earth ground and use shielded category 5E or higher
Ethernet cable.
Technical Specifications:
• Protective circuit complies with IEC test classifications B2, C1, C2, C3, and D1.
• Normal discharge current (core to earth ground) is 2kA per signal pair.
• Normal discharge current (core to core) is 100A.
• Total discharge current is 10kA.
•French Translation: (Tous les appareils ION) Les appareils sont conformes aux exigences du test
d’immunité aux surtensions IEC 61000-4-5. Pour éviter les dommages résultant de surtension électrique
sur les ports Ethernet, il est recommandé d’utiliser un dispositif de protection contre les surtensions aux
caractéristiques suivantes:
• Gigabit Ethernet jusqu’à la catégorie 5E, débit 1 Go/s minimum.
• Protection sur les huit câbles signal.
• Le blindage et la mise à la terre “ligne à ligne” et “ligne à la terre” sont fournis.
• Le dispositif de protection doit être raccordé à la terre et un câble Ethernet blindé de catégorie 5E ou
supérieure doit être utilisé.

10 ION 3000 HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
Caractéristiques techniques:
• Le circuit de protection est conforme aux classifications de test IEC B2, C1, C2, C3, et D1.
• Le courant de décharge normal (cœur vers terre) est de 2kA par paire de signal.
• Le courant de décharge normal (cœur vers cœur) est de 100 A.
• Le courant de décharge total est de 10kA.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For details
on the electrical range, refer to electrical specifications in the hardware reference for your firewall or
appliance.
French Translation: Veillez à ce que la tension d’alimentation ne dépasse pas la plage d’entrée du
pare-feu ou du dispositif. Pour plus d’informations sur la mesure électrique, consulter la rubrique des
caractéristiques électriques dans la documentation de votre matériel de pare-feu ou votre dispositif.
• Do not replace a battery with an incorrect battery type; doing so can cause the replacement battery to
explode. Dispose of used batteries according to local regulations.
French Translation: Ne remplacez pas la batterie par une batterie de type non adapté, cette dernière
risquerait d’exploser. Mettez au rebut les batteries usagées conformément aux instructions.
•(All Palo Alto Networks appliances with two or
more power supplies) Disconnect all power cords
(AC or DC) from the power inputs to fully de-
energize the hardware.
French Translation: (Tous les appareils Palo
Alto Networks avec au moins deux sources
d’alimentation) Débranchez tous les cordons
d’alimentation (c.a. ou c.c.) des entrées
d’alimentation et mettez le matériel hors tension.
• Declaration of the Presence Condition of the Restricted Substances Marking.
(Applicable to ION 1000)

ION 3000 HARDWARE REFERENCE | Before You Begin 11
© 2021 Palo Alto Networks, Inc.

12 ION 3000 HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
(Applicable to ION 9000)

ION 3000 HARDWARE REFERENCE | Before You Begin 13
© 2021 Palo Alto Networks, Inc.

14 ION 3000 HARDWARE REFERENCE | Before You Begin

15
ION 3000 Overview
Learn about the Instant-On Networks (ION) 3000 and then plan your deployment.
> ION 3000
> ION 3000 Ports
> ION 3000 Front Panel with LEDs
> ION 3000 Specifications
> ION Device Compliance Statement
> ION 3000 Fail-to-Wire Cabling Matrix
> ION 3000 Installation Kit Components
> ION 3000 Common Insertion Topologies
> Power on the ION 3000

16 ION 3000 HARDWARE REFERENCE | ION 3000 Overview
© 2021 Palo Alto Networks, Inc.

ION 3000 HARDWARE REFERENCE | ION 3000 Overview 17
© 2021 Palo Alto Networks, Inc.
ION 3000
The Prisma SD-WAN Instant-On Network (ION) 3000, designed for the enterprise branch, transforms
legacy wide area networks (WANs), enables you to combine heterogeneous underlying transports into
a unified hybrid WAN. It establishes service-level agreements (SLAs) for security, path selection, and
application performance. It helps gain direct insight into end-user application performance for traditional,
SaaS, modern, encrypted applications.
ION 3000 participates in bi-directional communications with the Prisma SD-WAN controller, enabling
configuration of devices, applications, and WANs, providing analytics on devices and applications.
You can deploy the Prisma SD-WAN ION 300 in a standalone fashion without a data center device,
enabling granular control and visibility for direct-to-internet deployment scenarios, or in conjunction with
ION 7000 or ION 9000 in the data center, creating a secure, full-mesh fabric across the WAN.
You can deploy the ION 3000 as follows:
• Standalone Prisma SD-WAN ION 3000 (No HA)
• Prisma SD-WAN ION 3000 + Existing Router HA
• Prisma SD-WAN ION 3000 + Prisma SD-WAN ION 3000 HA

18 ION 3000 HARDWARE REFERENCE | ION 3000 Overview
© 2021 Palo Alto Networks, Inc.
ION 3000 Ports
The ports on the ION 3000 are used as follows:
Ports Description
AUX This port is an auxiliary access port intended for offline access,
configuration, and troubleshooting of a system during installation.
USB This port is reserved for future use.
Controller This port is used by the ION device to communicate with the Prisma
SD-WAN controller.
Internet This port is used to connect to internet service. By default, this port
is protected by a firewall.
Internet Bypass This port is only used in ION 3000 HA scenarios. It should not be
used in single ION device scenarios.
LAN This port is intended for private LAN network connectivity. By
default, this port is bridged to the corresponding WAN port.
WAN This port is intended for private router/MPLS connectivity. By
default, this port is bridged to the corresponding LAN port.
Fail-to-Wire Port Pair Up to 6 pairs - all ports. These ports can be configured as discrete
ports or as fail-to wire pairs.

ION 3000 HARDWARE REFERENCE | ION 3000 Overview 19
© 2021 Palo Alto Networks, Inc.
ION 3000 Front Panel with LEDs
The ION 3000 LEDs indicate the status of the disk, power, and the controller connectivity:
Icons Description
Displays disk status. Orange light (Blinking)—Disk Activity.
Displays controller connectivity status. Blue light—Connected.
Red light—Not Connected
Displays power status. Green light—Powered on.
No light—Powered off.

20 ION 3000 HARDWARE REFERENCE | ION 3000 Overview
© 2021 Palo Alto Networks, Inc.
ION 3000 Specifications
The Prisma SD-WAN ION 3000 specifications are shown below:
I/O
Controller 2 x 10/100/1000 RJ-45
WAN/LAN/Internet 6 pairs of 10/100/1000 RJ-45 with programmable inline
fail-to-wire capability.
Throughput
Throughput Up to 500 Mbps
Encrypted throughput is measured with 1400 byte HTTP
packets with all features turned on.
Power and Mechanical
Type or Watts 1 PSU 150W
Power Input AC 100~240 V @50~60 Hz
Fan cooling 1 smart fan
Certifications
Certifications CE (EMC), FCC Class A, RoHS, BIS, CCC, KCC
Environmental
Operating temperature 32°F to 104°F (0°C to 40°C)
Storage temperature -4°F to 158°F (-20°C to 70°C)
Operating humidity 5% to 90% (non-condensing)
Storage humidity 5% to 95% (non-condensing)
Physical
Weight 8.8 lbs (4 kg)
Dimensions 16.81" x 1.72" x 11.89" (431 mm x 44 mm x 305 mm)
Local network Access Typically a downstream Layer 2 (L2) or Layer 3 (L3)
Ethernet switch and/or a Wireless Access Point (WAP).
Internet connectivity This connectivity is used to reach the Cloud Registration
Service and the Network Controller. It can be in the
form of a private connection via an MPLS network