PaloAlto Networks ION 3000 Application guide

ION 3000 Hardware Reference
docs.paloaltonetworks.com

Contact Informaon
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support.html
About the Documentaon
• For the most recent version of this guide or for access to related documentaon, visit the
Technical Documentaon portal docs.paloaltonetworks.com.
• To search for a specific topic, go to our search page docs.paloaltonetworks.com/search.html.
• Have feedback or quesons for us? Leave a comment on any page in the portal, or write to us
at documenta[email protected]om.
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
©2020–2021 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks menoned herein may be trademarks of their respecve
companies.
Last Revised
March 31, 2021
ION 3000 Hardware Reference 2©2021 Palo Alto Networks, Inc.

Table of Contents
Before You Begin................................................................................................5
Tamper Proof Statement............................................................................................................ 6
Third-Party Component Support............................................................................................. 7
Product Safety Warnings........................................................................................................... 8
ION 3000 Overview........................................................................................11
ION 3000.................................................................................................................................... 12
ION 3000 Ports......................................................................................................................... 13
ION 3000 Front Panel with LEDs......................................................................................... 14
ION 3000 Specificaons......................................................................................................... 15
ION Device Compliance Statement......................................................................................17
ION 3000 Fail-to-Wire Cabling Matrix................................................................................ 19
ION 3000 Installaon Kit Components...............................................................................20
ION 3000 Common Inseron Topologies........................................................................... 21
Power on the ION 3000......................................................................................................... 22
Shut Down the ION 3000...........................................................................................22
Reboot the ION 3000...................................................................................................22
Install ION 3000...............................................................................................23
Rack Mount the ION 3000.....................................................................................................24
Set Up the ION 3000 with an Exisng Router.................................................................. 25
Set Up the ION 3000 by Replacing the Router.................................................................26
ION 3000 Hardware Reference 3©2021 Palo Alto Networks, Inc.

Table of Contents
ION 3000 Hardware Reference 4©2021 Palo Alto Networks, Inc.

Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-
generaon firewall or appliance. The following topics apply to all Palo Alto Networks
firewalls and appliances except where noted.
>Tamper Proof Statement
>Third-Party Component Support
>Product Safety Warnings
5

Before You Begin
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during
shipping, verify the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the
tracking number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.
ION 3000 Hardware Reference 6©2021 Palo Alto Networks, Inc.

Before You Begin
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party
Component Support statement.
ION 3000 Hardware Reference 7©2021 Palo Alto Networks, Inc.

Before You Begin
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto
Networks hardware, be sure you understand and prepare for the following warnings before you
install or service the hardware. You will also see warning messages throughout the hardware
reference where potenal hazards exist.
All Palo Alto Networks products with laser-based opcal interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a
specific hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component
that has exposed circuits, ensure that you wear an electrostac discharge (ESD) strap. Before
handling the component, make sure the metal contact on the wrist strap is touching your skin
and that the other end of the strap is connected to earth ground.
French Translaon: Lorsque vous installez ou que vous intervenez sur un composant matériel
de pare-feu ou de disposif Palo Alto Networks qui présente des circuits exposés, veillez
à porter un bracelet anstaque. Avant de manipuler le composant, vérifiez que le contact
métallique du bracelet anstaque est en contact avec votre peau et que l’autre extrémité du
bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnec
compliance (EMC) regulaons.
French Translaon: Des câbles Ethernet blindés reliés à la terre doivent être ulisés pour
garanr la conformité de l'organisme aux émissions électromagnéques (CEM).
• (ION 7000 and ION 9000 only) At least two people are recommended for unpacking, handling,
and relocang the heavier firewalls.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For
details on the electrical range, refer to electrical specificaons in the hardware reference for
your firewall or appliance.
French Translaon: Veillez à ce que la tension d’alimentaon ne dépasse pas la plage d’entrée
du pare-feu ou du disposif. Pour plus d’informaons sur la mesure électrique, consulter la
rubrique des caractérisques électriques dans la documentaon de votre matériel de pare-feu
ou votre disposif.
• Do not replace a baery with an incorrect baery type; doing so can cause the replacement
baery to explode. Dispose of used baeries according to local regulaons.
French Translaon: Ne remplacez pas la baerie par une baerie de type non adapté, cee
dernière risquerait d’exploser. Meez au rebut les baeries usagées conformément aux
instrucons.
• I/O ports are intended for intra-building connecons only and not intended for OSP (Outside
Plant) connecons or any network connecons subject to external voltage surge events.
ION 3000 Hardware Reference 8©2021 Palo Alto Networks, Inc.

Before You Begin
•(All Palo Alto Networks appliances with two or more
power supplies)
Cauon: Shock hazard
Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.
French Translaon: (Tous les appareils Palo Alto
Networks avec au moins deux sources d’alimentaon)
Débranchez tous les cordons d’alimentaon (c.a. ou
c.c.) des entrées d’alimentaon et meez le matériel
hors tension.
ION 3000 Hardware Reference 9©2021 Palo Alto Networks, Inc.

Before You Begin
ION 3000 Hardware Reference 10 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
Learn about the Instant-On Networks (ION) 3000 and then plan your deployment.
>ION 3000
>ION 3000 Ports
>ION 3000 Front Panel with LEDs
>ION 3000 Specificaons
>ION Device Compliance Statement
>ION 3000 Fail-to-Wire Cabling Matrix
>ION 3000 Installaon Kit Components
>ION 3000 Common Inseron Topologies
>Power on the ION 3000
11

ION 3000 Overview
ION 3000
The Prisma SD-WAN Instant-On Network (ION) 3000, designed for the enterprise branch,
transforms legacy wide area networks (WANs), enables you to combine heterogeneous underlying
transports into a unified hybrid WAN. It establishes service-level agreements (SLAs) for security,
path selecon, and applicaon performance. It helps gain direct insight into end-user applicaon
performance for tradional, SaaS, modern, encrypted applicaons.
ION 3000 parcipates in bi-direconal communicaons with the Prisma SD-WAN controller,
enabling configuraon of devices, applicaons, and WANs, providing analycs on devices and
applicaons.
You can deploy the Prisma SD-WAN ION 300 in a standalone fashion without a data center
device, enabling granular control and visibility for direct-to-internet deployment scenarios, or in
conjuncon with ION 7000 or ION 9000 in the data center, creang a secure, full-mesh fabric
across the WAN.
You can deploy the ION 3000 as follows:
• Standalone Prisma SD-WAN ION 3000 (No HA)
• Prisma SD-WAN ION 3000 + Exisng Router HA
• Prisma SD-WAN ION 3000 + Prisma SD-WAN ION 3000 HA
ION 3000 Hardware Reference 12 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION 3000 Ports
The ports on the ION 3000 are used as follows:
Ports Descripon
AUX This port is an auxiliary access port intended for offline
access, configuraon, and troubleshoong of a system during
installaon.
USB This port is reserved for future use.
Controller This port is used by the ION device to communicate with the
Prisma SD-WAN controller.
Internet This port is used to connect to internet service. By default, this
port is protected by a firewall.
Internet Bypass This port is only used in ION 3000 HA scenarios. It should not
be used in single ION device scenarios.
LAN This port is intended for private LAN network connecvity. By
default, this port is bridged to the corresponding WAN port.
WAN This port is intended for private router/MPLS connecvity. By
default, this port is bridged to the corresponding LAN port.
Fail-to-Wire Port Pair Up to 6 pairs - all ports. These ports can be configured as
discrete ports or as fail-to wire pairs.
ION 3000 Hardware Reference 13 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION 3000 Front Panel with LEDs
The ION 3000 LEDs indicate the status of the disk, power, and the controller connecvity:
Icons Descripon
Displays disk status. Orange light (Blinking)—Disk Acvity.
Displays controller connecvity status. Blue light—Connected.
Red light—Not Connected
Displays power status. Green light—Powered on.
No light—Powered off.
ION 3000 Hardware Reference 14 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION 3000 Specificaons
The Prisma SD-WAN ION 3000 specificaons are shown below:
I/O
Controller 2 x 10/100/1000 RJ-45
WAN/LAN/Internet 6 pairs of 10/100/1000 RJ-45 with programmable
inline fail-to-wire capability.
Throughput
Throughput Up to 500 Mbps
Encrypted throughput is measured with 1400 byte
HTTP packets with all features turned on.
Power and Mechanical
Type or Was 1 PSU 150W
Power Input AC 100~240 V @50~60 Hz
Fan cooling 1 smart fan, direcon of air-flow is from front to rear.
Cerficaons
Cerficaons CE (EMC), FCC Class A, RoHS, BIS, CCC, KCC
Environmental
Operang temperature 32°F to 104°F (0°C to 40°C)
Storage temperature -4°F to 158°F (-20°C to 70°C)
Operang humidity 5% to 90% (non-condensing)
Storage humidity 5% to 95% (non-condensing)
Physical
Weight 8.8 lbs (4 kg)
Dimensions 16.81" x 1.72" x 11.89" (431 mm x 44 mm x 305 mm)
Local network Access Typically a downstream Layer 2 (L2) or Layer 3 (L3)
Ethernet switch and/or a Wireless Access Point
(WAP).
ION 3000 Hardware Reference 15 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
Internet connecvity This connecvity is used to reach the Cloud
Registraon Service and the Network Controller.
It can be in the form of a private connecon via an
MPLS network through a corporate data center. It
can also be a public internet connecon provided
using a local or broadband connecon.
ION 3000 Hardware Reference 16 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION Device Compliance Statement
The following compliance statements apply to this ION device:
•VCCI—This secon provides the compliance statement for the Voluntary Control Council for
Interference by Informaon Technology Equipment (VCCI), which governs radio frequency
emissions in Japan.
The following informaon is in accordance to VCCI Class A requirements:
Translaon: This is a Class A product. In a domesc environment this product may cause radio
interference, in which case the user may be required to take correcve acons.
•UL—Product Ambient Temperature: 0~40 degree C
Risk of explosion if baery is replaced by an incorrect type. Dispose of used baery
according to local regulaons.
•CE (European Union (EU) Electromagnec Compability Direcve)
This device is herewith confirmed to comply with the requirements set out in the Council
Direcve on the Approximaon of the Laws of the Member States relang to Electromagnec
Compability Direcve (2014/30/EU).
The above product conforms with Low Voltage Direcve 2014/35/EU and complies with the
requirements relang to electrical equipment designed for use within certain voltage limits.
•Federal Communicaons Commission (FCC) statement for a Class A digital device or
peripheral—This equipment has been tested and found to comply with the limits for a Class
A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protecon against harmful interference in a residenal installaon. This equipment
generates, uses, and can radiate radio frequency energy and, if not installed and used in
accordance with the instrucons, may cause harmful interference to radio communicaons.
However, there is no guarantee that interference will not occur in a parcular installaon. If
this equipment does cause harmful interference to radio or television recepon, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the
interference by one or more of the following measures.
• Reorient or relocate the receiving antenna.
• Increase the separaon between the equipment and receiver.
• Connect the equipment to an outlet on a circuit that is different from the one to which the
receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.
ION 3000 Hardware Reference 17 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
•ICES (Canadian EMC Compliance Statement)—This Class A digital apparatus complies with
Canadian ICES-003.
French translaon: Cet appareil numérique de la classe A est conforme à la norme NMB-003
du Canada.
•Korean Communicaons Commission (KCC) Class A Statement—This equipment is an
electromagnec compable device for business purposes (Class A). The provider or user should
be aware that the equipment is intended for use outside the home.
ION 3000 Hardware Reference 18 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION 3000 Fail-to-Wire Cabling Matrix
The ION 3000 fail-to-wire cabling matrix is shown below:
Port Type /
Speed WAN
Port
Device
LAN Port
Device
Recommended
Cable
WAN
Port- to-
WAN
Device
Recommended
Cable
LAN Port-
to-LAN
Device
Recommended
Sengs
ION 3000
Port
Recommended
Cable Connecon
End Result
Gigabit
Ethernet
All All Any
Ethernet
Cable**
Any
Ethernet
Cable**
Auto
Negoaon
Varies
Router/
PC (NIC
MDI)
Router/
PC (NIC
MDI)
Crossover
Ethernet
Cable
Crossover
Ethernet
Cable
Hardcode
to Match
Both
Devices
Crossover
Router/
PC (NIC
MDI)
Hub/
Switch
(HUB
MDI)
Crossover
Ethernet
Cable
Crossover
Ethernet
Cable
Hardcode
to Match
Both
Devices
Straight Through
Hub/
Switch
(HUB
MDI)
Router/
PC (NIC
MDI)
Straight
Through
Ethernet
Cable
Straight
Through
Ethernet
Cable
Hardcode
to Match
Both
Devices
Straight Through
10/100
Ethernet
(Hardcoded
or Auto
Detecon)
Hub/
Switch
(HUB
MDI)
Hub/
Switch
(HUB
MDI)
Straight
Through
Ethernet
Cable
Straight
Through
Ethernet
Cable
Hardcode
to Match
Both
Devices
Crossover
** Gigabit-rated Crossover or Straight-Through Copper Ethernet Cable.
ION 3000 Hardware Reference 19 ©2021 Palo Alto Networks, Inc.

ION 3000 Overview
ION 3000 Installaon Kit Components
The ION 3000 installaon kit contains the following parts and tools to install the device.
• 1x 19-inch 1U rack mount kit with two ears with 3-hole rail paerns with corresponding
screws.
• 2x Red Cat6 Crossover/Rollover Ethernet Cable.
• 1x Power cord, which varies depending on the country/region.
• 1x Screwdriver.
• 1x USB to Cat5 serial cable.
ION 3000 Hardware Reference 20 ©2021 Palo Alto Networks, Inc.