PaloAlto Networks PA-3400 Series Application guide

PA-3400 Series Next-Gen Firewall
Hardware Reference
docs.paloaltonetworks.com

Contact Informaon
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support.html
About the Documentaon
• For the most recent version of this guide or for access to related documentaon, visit the
Technical Documentaon portal docs.paloaltonetworks.com.
• To search for a specific topic, go to our search page docs.paloaltonetworks.com/search.html.
• Have feedback or quesons for us? Leave a comment on any page in the portal, or write to us
at documenta[email protected]om.
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
©2021–2022 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks menoned herein may be trademarks of their respecve
companies.
Last Revised
March 24, 2022
PA-3400 Series Next-Gen Firewall Hardware Reference 2©2022 Palo Alto Networks, Inc.

Table of Contents
Before You Begin................................................................................................5
Upgrade/Downgrade Consideraons for Firewalls and Appliances................................ 6
Tamper Proof Statement............................................................................................................ 7
Third-Party Component Support............................................................................................. 8
Product Safety Warnings........................................................................................................... 9
PA-3400 Series Firewall Overview..............................................................13
PA-3400 Series Front Panel................................................................................................... 14
PA-3400 Series Back Panel.................................................................................................... 20
Install the PA-3400 Series Firewall in an Equipment Rack.................... 21
Install the PA-3400 Series Firewall Using the Four-Post Rack Kit.................................22
Connect Power to a PA-3400 Series Firewall...........................................27
Set Up a Connecon to the Firewall....................................................................................28
Connect Power to a PA-3400 Series Firewall....................................................................30
Service the PA-3400 Series Firewall...........................................................33
Interpret the PA-3400 Series Status LEDs..........................................................................34
Replace a PA-3400 Series Power Supply............................................................................ 37
Replace a PA-3400 Series Power Supply.................................................................37
Replace a PA-3400 Series Drive............................................................................................39
PA-3400 Series Firewall Specificaons......................................................41
PA-3400 Series Physical Specificaons............................................................................... 42
PA-3400 Series Electrical Specificaons............................................................................. 43
PA-3400 Series Environmental Specificaons................................................................... 44
PA-3400 Series Miscellaneous Specificaons....................................................................45
PA-3400 Series Firewall Hardware Compliance Statements.................47
PA-3400 Series Firewall Compliance Statements............................................................. 48
PA-3400 Series Next-Gen Firewall Hardware Reference 3©2022 Palo Alto Networks, Inc.

Table of Contents
PA-3400 Series Next-Gen Firewall Hardware Reference 4©2022 Palo Alto Networks, Inc.

Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-
generaon firewall or appliance. The following topics apply to all Palo Alto Networks
firewalls and appliances except where noted.
>Upgrade/Downgrade Consideraons for Firewalls and Appliances
>Tamper Proof Statement
>Third-Party Component Support
>Product Safety Warnings
5

Before You Begin
Upgrade/Downgrade Consideraons for Firewalls and
Appliances
The following table lists hardware features that have upgrade or downgrade impact. Make sure
you understand all upgrade/downgrade consideraons before you upgrade or downgrade from
the specified version of PAN-OS.
Feature Release Upgrade Consideraons Downgrade
Consideraons
PA-7000 Log
Forwarding Card (LFC)
10.0 If you are using an LFC
with a PA-7000 Series
Firewall, when you
upgrade to PAN-OS
10.0, you must configure
the management plane
or dataplane interface
for the service route
because the LFC ports
do not support the
requirements for the
service route. We
recommend using the
dataplane interface for
the Data Services service
route.
n/a
Upgrading a PA-7000
Series Firewall with a
first generaon switch
management card
(PA-7050-SMC or
PA-7080-SMC)
PAN-OS 8.0
and later
Before upgrading
the firewall, run the
following CLI command
to check the flash drive’s
status: debug system
disk-smart-info
disk-1.
If the value for
aribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with
the upgrade. If the value
is less than 20, then
contact support for
assistance.
Before downgrading
the firewall, run the
following CLI command
to check the flash drive’s
status: debug system
disk-smart-info
disk-1.
If the value for
aribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with
the downgrade. If the
value is less than 20,
then contact support for
assistance.
PA-3400 Series Next-Gen Firewall Hardware Reference 6©2022 Palo Alto Networks, Inc.

Before You Begin
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during
shipping, verify the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the
tracking number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.
(PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and
therefore do not include a warranty label on the firewall.
PA-3400 Series Next-Gen Firewall Hardware Reference 7©2022 Palo Alto Networks, Inc.

Before You Begin
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party
Component Support statement.
PA-3400 Series Next-Gen Firewall Hardware Reference 8©2022 Palo Alto Networks, Inc.

Before You Begin
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto
Networks hardware, be sure you understand and prepare for the following warnings before you
install or service the hardware. You will also see warning messages throughout the hardware
reference where potenal hazards exist.
All Palo Alto Networks products with laser-based opcal interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a
specific hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component
that has exposed circuits, ensure that you wear an electrostac discharge (ESD) strap. Before
handling the component, make sure the metal contact on the wrist strap is touching your skin
and that the other end of the strap is connected to earth ground.
French Translaon: Lorsque vous installez ou que vous intervenez sur un composant matériel
de pare-feu ou de disposif Palo Alto Networks qui présente des circuits exposés, veillez
à porter un bracelet anstaque. Avant de manipuler le composant, vérifiez que le contact
métallique du bracelet anstaque est en contact avec votre peau et que l’autre extrémité du
bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnec
compliance (EMC) regulaons.
French Translaon: Des câbles Ethernet blindés reliés à la terre doivent être ulisés pour
garanr la conformité de l'organisme aux émissions électromagnéques (CEM).
• (PA-3200, PA-5200, PA-5400, PA-7050, and PA-7080 firewalls only) At least two people are
recommended for unpacking, handling, and relocang the heavier firewalls.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For
details on the electrical range, refer to electrical specificaons in the hardware reference for
your firewall or appliance.
French Translaon: Veillez à ce que la tension d’alimentaon ne dépasse pas la plage d’entrée
du pare-feu ou du disposif. Pour plus d’informaons sur la mesure électrique, consulter la
rubrique des caractérisques électriques dans la documentaon de votre matériel de pare-feu
ou votre disposif.
• Do not replace a baery with an incorrect baery type; doing so can cause the replacement
baery to explode. Dispose of used baeries according to local regulaons.
French Translaon: Ne remplacez pas la baerie par une baerie de type non adapté, cee
dernière risquerait d’exploser. Meez au rebut les baeries usagées conformément aux
instrucons.
• I/O ports are intended for intra-building connecons only and not intended for OSP (Outside
Plant) connecons or any network connecons subject to external voltage surge events.
PA-3400 Series Next-Gen Firewall Hardware Reference 9©2022 Palo Alto Networks, Inc.

Before You Begin
•(All Palo Alto Networks appliances with two or more
power supplies)
Cauon: Shock hazard
Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.
French Translaon: (Tous les appareils Palo Alto
Networks avec au moins deux sources d’alimentaon)
Débranchez tous les cordons d’alimentaon (c.a. ou
c.c.) des entrées d’alimentaon et meez le matériel
hors tension.
•(PA-7000 Series firewalls only)
Cauon: High touch current
Connect to earth before connecng to the power
supply.
Ensure that the protecve earthing conductor is
connected to the provided ground lug on the rear side
of the firewall.
•(PA-7000 Series firewalls only) When removing a fan
tray from a PA-7000 Series firewall, first pull the fan
tray out about 1 inch (2.5cm) and then wait a minimum
of 10 seconds before extracng the enre fan tray.
This allows the fans to stop spinning and helps you
avoid serious injury when removing the fan tray. You
can replace a fan tray while the firewall is powered
on but you must replace it within 45 seconds and you
can only replace one fan tray at a me to prevent the
thermal protecon circuit from shung down the
firewall.
French Translaon: (Pare-feu PA-7000 uniquement)
Lors du retrait d’un roir de venlaon d’un pare-
feu PA-7000, rerez tout d’abord le roir sur 2,5 cm,
puis paentez au moins 10 secondes avant de rerer
complètement le roir de venlaon. Cela permet aux
venlateurs d’arrêter de tourner et permet d’éviter des
blessures graves lors du retrait du roir. Vous pouvez
remplacer un roir de venlaon lors de la mise sous
tension du pare-feu. Toutefois, vous devez le faire dans
les 45 secondes et vous ne pouvez remplacer qu’un
roir à la fois, sinon le circuit de protecon thermique
arrêtera le pare-feu.
PA-3400 Series Next-Gen Firewall Hardware Reference 10 ©2022 Palo Alto Networks, Inc.

Before You Begin
The following applies only to Palo Alto Networks firewalls that support a direct current (DC)
power source:
French Translaon: Les instrucons suivantes s’appliquent uniquement aux pare-feux de Palo Alto
Networks prenant en charge une source d’alimentaon en courant connu (c.c.):
• Do not connect or disconnect energized DC wires to the power supply.
French Translaon: Ne raccordez ni débranchez de câbles c.c. sous tension à la source
d’alimentaon.
• The DC system must be earthed at a single (central) locaon.
French Translaon: Le système c.c. doit être mis à la terre à un seul emplacement (central).
• The DC supply source must be located within the same premises as the firewall.
French Translaon: La source d’alimentaon c.c. doit se trouver dans les mêmes locaux que ce
pare-feu.
• The DC baery return wiring on the firewall must be connected as an isolated DC (DC-I) return.
French Translaon: Le câblage de retour de baerie c.c. sur le pare-feu doit être raccordé en
tant que retour c.c. isolé (CC-I).
• The firewall must be connected either directly to the DC supply system earthing electrode
conductor or to a bonding jumper from an earthing terminal bar or bus to which the DC supply
system earthing electrode conductor is connected.
French Translaon: Ce pare-feu doit être branché directement sur le conducteur à électrode
de mise à la terre du système d’alimentaon c.c. ou sur le connecteur d'une barree/d'un bus
à bornes de mise à la terre auquel le conducteur à électrode de mise à la terre du système
d'alimentaon c.c. est raccordé.
• The firewall must be in the same immediate area (such as adjacent cabinets) as any other
equipment that has a connecon between the earthing conductor of the DC supply circuit and
the earthing of the DC system.
French Translaon: Le pare-feu doit se trouver dans la même zone immédiate (des armoires
adjacentes par exemple) que tout autre équipement doté d’un raccordement entre le
conducteur de mise à la terre du même circuit d’alimentaon c.c. et la mise à la terre du
système c.c.
• Do not disconnect the firewall in the earthed circuit conductor between the DC source and the
point of connecon of the earthing electrode conductor.
French Translaon: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre
entre la source d'alimentaon c.c. et le point de raccordement du conducteur à électrode de
mise à la terre.
• Install all firewalls that use DC power in restricted access areas only. A restricted access area
is where access is granted only to cra (service) personnel using a special tool, lock and key, or
other means of security, and that is controlled by the authority responsible for the locaon.
French Translaon: Tous les pare-feux ulisant une alimentaon c.c. sont conçus pour être
installés dans des zones à accès limité uniquement. Une zone à accès limité correspond à une
zone dans laquelle l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un oul spécial,
cadenas ou clé, ou autre disposif de sécurité, et qui est contrôlée par l'autorité responsable du
site.
PA-3400 Series Next-Gen Firewall Hardware Reference 11 ©2022 Palo Alto Networks, Inc.

Before You Begin
• Install the firewall DC ground cable only as described in the power connecon procedure
for the firewall that you are installing. You must use the American wire gauge (AWG) cable
specified and torque all nuts to the torque value specified in the installaon procedure for your
firewall.
French Translaon: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans la
procédure de raccordement à l’alimentaon pour le pare-feu que vous installez. Ulisez le câble
American wire gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la procédure
d’installaon de votre pare-feu pare-feu.
• The firewall permits the connecon of the earthed conductor of the DC supply circuit to
the earthing conductor at the equipment as described in the installaon procedure for your
firewall.
French Translaon: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit
d’alimentaon c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la
procédure d’installaon du pare-feu.
• A suitably-rated DC mains disconnect device must be provided as part of the building
installaon.
French Translaon: Un interrupteur d'isolement suffisant doit être fourni pendant l'installaon
du bâment.
PA-3400 Series Next-Gen Firewall Hardware Reference 12 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
The Palo Alto Networks® PA-3400 Series next-generaon firewalls are designed
for data center and internet gateway deployments. This series is comprised of the
PA-3410, PA-3420, PA-3430, and PA-3440 firewalls. These models provide flexibility
in performance and redundancy to help you meet your deployment requirements.
All models in this series provide next-generaon security features to help you secure
your organizaon through advanced visibility and control of applicaons, users, and
content.
First Supported Soware Release: PAN-OS® 10.2
The following topics describe the hardware features of PA-3400 Series firewalls. To
view or compare performance and capacity informaon, refer to the Product Selecon
tool.
>PA-3400 Series Front Panel
>PA-3400 Series Back Panel
13

PA-3400 Series Firewall Overview
PA-3400 Series Front Panel
The following image shows the front panel of the PA-3410 and PA-3420 firewalls and the table
describes each front panel component.
Item Component Descripon
1 Ethernet ports 1 through 12 Twelve RJ-45
10Mbps/100Mbps/1Gbps/2.5Gbps/5Gbps/10Gbps
ports for network traffic. The link speed and link
duplex are auto-negoate only.
2 SFP ports 13 through 22 Ports 13 through 22 are SFP (1Gbps) or SFP+
(10Gbps) based on the installed transceiver.
The SFP ports can be remapped as
HA-1 ports via PAN-OS or Panorama.
These remapped HA-1 ports offer high
availability connecvity over a longer
distance than what is permied by the
HA1-A and HA1-B ports listed below.
3 zSFP+ ports 23 through 26 Four SFP28 (25Gbps) ports.
4 HSCI port One SFP+ (10Gbps) port (supports both SFP and
SFP+ transceivers or cables).
Use this port to connect two PA-3400 Series
firewalls in a high availability (HA) configuraon as
follows:
• In an acve/passive configuraon, this port is for
HA2 (data link).
• In an acve/acve configuraon, you can
configure this port for HA2 and HA3. HA3 is
used for packet forwarding for asymmetrically
PA-3400 Series Next-Gen Firewall Hardware Reference 14 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
Item Component Descripon
routed sessions that require Layer 7 inspecon
for App-ID and Content-ID.
The HSCI ports must be connected
directly between the two firewalls in the
HA configuraon (without a switch or
router between them). When directly
connecng the HSCI ports between
two PA-3400 Series firewalls that are
physically located near each other, Palo
Alto Networks recommends that you
use a passive SFP+ cable.
For installaons where the two firewalls
are not near each other and you cannot
use a passive SFP+ cable, use a standard
SFP+ transceiver and the appropriate
cable length.
5 HA1-A and HA1-B ports Two RJ-45 10Mbps/100Mbps/1000Mbps ports for
high availability (HA) control.
If the firewall dataplane restarts due to
a failure or manual restart, the HA1-B
link will also restart. If this occurs and
the HA1-A link is not connected and
configured, then a split brain condion
occurs. Therefore, we recommend that
you connect and configure the HA1-A
ports and the HA1-B ports to provide
redundancy and to avoid split brain
issues.
6 MGT port Use this Ethernet 10Mbps/100Mbps/1000Mbps
port to access the management web interface
and perform administrave tasks. The firewall
also uses this port for management services, such
as retrieving licenses and updang threat and
applicaon signatures.
7CONSOLE port (RJ-45) Use this port to connect a management computer to
the firewall using a 9-pin serial-to-RJ-45 cable and
terminal emulaon soware.
The console connecon provides access to firewall
boot messages, the Maintenance Recovery Tool
(MRT), and the command line interface (CLI).
PA-3400 Series Next-Gen Firewall Hardware Reference 15 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
Item Component Descripon
If your management computer does not
have a serial port, use a USB-to-serial
converter.
Use the following sengs to configure your
terminal emulaon soware to connect to the
console port:
• Data rate: 9600
• Data bits: 8
• Parity: None
• Stop bits: 1
• Flow control: None
8USB port A USB port that accepts a USB flash drive with a
bootstrap bundle (PAN-OS configuraon).
Bootstrapping speeds up the process of configuring
and licensing the firewall to make it operaonal on
the network with or without internet access.
9CONSOLE port (Micro USB) Use this port to connect a management computer to
the firewall using a standard Type-A USB-to-micro
USB cable.
The console connecon provides access to firewall
boot messages, the Maintenance Recovery Tool
(MRT), and the command line interface (CLI).
Refer to the Micro USB Console Port page for more
informaon and to download the Windows driver
or to learn how to connect from a Mac or Linux
computer.
10 LED status indicators Eight LEDs that indicate the status of the firewall
hardware components (see Interpret the PA-3400
Series Status LEDs).
11 System Drive Cover Secures the device SSD.
The following image shows the front panel of the PA-3430 and PA-3440 firewalls and the table
describes each front panel component.
PA-3400 Series Next-Gen Firewall Hardware Reference 16 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
Item Component Descripon
1 Ethernet ports 1 through 12 Twelve RJ-45 1Gbps/2.5Gbps/5Gbps/10Gbps ports
for network traffic. The link speed and link duplex
are auto-negoate only.
2 SFP ports 13 through 22 Ports 13 through 22 are SFP (1Gbps) or SFP+
(10Gbps) based on the installed transceiver.
The SFP ports can be remapped as
HA-1 ports via PAN-OS or Panorama.
These remapped HA-1 ports offer high
availability connecvity over a longer
distance than what is permied by the
HA1-A and HA1-B ports listed below.
3 zSFP+ ports 23 through 26 Four SFP28 (25Gbps) ports that also support 1G
SFP and 10G SFP+ modules.
4 zQSFP+ ports 27 through 36 Two form-factor pluggable (QSFP+/QSFP28)
40Gbps/100Gbps Ethernet ports.
5 HSCI port One SFP+ (10Gbps) port (supports only an SFP+
transceiver or passive SFP+ cable).
Use this port to connect two PA-3400 Series
firewalls in a high availability (HA) configuraon as
follows:
• In an acve/passive configuraon, this port is for
HA2 (data link).
• In an acve/acve configuraon, you can
configure this port for HA2 and HA3. HA3 is
used for packet forwarding for asymmetrically
routed sessions that require Layer 7 inspecon
for App-ID and Content-ID.
PA-3400 Series Next-Gen Firewall Hardware Reference 17 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
Item Component Descripon
The HSCI ports must be connected
directly between the two firewalls in the
HA configuraon (without a switch or
router between them). When directly
connecng the HSCI ports between
two PA-3400 Series firewalls that are
physically located near each other, Palo
Alto Networks recommends that you
use a passive SFP+ cable.
For installaons where the two firewalls
are not near each other and you cannot
use a passive SFP+ cable, use a standard
SFP+ transceiver and the appropriate
cable length.
6 HA1-A and HA1-B ports Two RJ-45 10Mbps/100Mbps/1000Mbps ports for
high availability (HA) control.
If the firewall dataplane restarts due to
a failure or manual restart, the HA1-B
link will also restart. If this occurs and
the HA1-A link is not connected and
configured, then a split brain condion
occurs. Therefore, we recommend that
you connect and configure the HA1-A
ports and the HA1-B ports to provide
redundancy and to avoid split brain
issues.
7 MGT port Use this Ethernet 10Mbps/100Mbps/1000Mbps
port to access the management web interface
and perform administrave tasks. The firewall
also uses this port for management services, such
as retrieving licenses and updang threat and
applicaon signatures.
8 CONSOLE port (RJ-45) Use this port to connect a management computer to
the firewall using a 9-pin serial-to-RJ-45 cable and
terminal emulaon soware.
The console connecon provides access to firewall
boot messages, the Maintenance Recovery Tool
(MRT), and the command line interface (CLI).
If your management computer does not
have a serial port, use a USB-to-serial
converter.
PA-3400 Series Next-Gen Firewall Hardware Reference 18 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
Item Component Descripon
Use the following sengs to configure your
terminal emulaon soware to connect to the
console port:
• Data rate: 9600
• Data bits: 8
• Parity: None
• Stop bits: 1
• Flow control: None
9 USB port A USB port that accepts a USB flash drive with a
bootstrap bundle (PAN-OS configuraon).
Bootstrapping speeds up the process of configuring
and licensing the firewall to make it operaonal on
the network with or without internet access.
10 CONSOLE port (Micro USB) Use this port to connect a management computer to
the firewall using a standard Type-A USB-to-micro
USB cable.
The console connecon provides access to firewall
boot messages, the Maintenance Recovery Tool
(MRT), and the command line interface (CLI).
Refer to the Micro USB Console Port page for more
informaon and to download the Windows driver
or to learn how to connect from a Mac or Linux
computer.
11 LED status indicators Nine LEDs that indicate the status of the firewall
hardware components (see Interpret the PA-3400
Series Status LEDs).
12 System Drive Cover Secures the device SSD.
PA-3400 Series Next-Gen Firewall Hardware Reference 19 ©2022 Palo Alto Networks, Inc.

PA-3400 Series Firewall Overview
PA-3400 Series Back Panel
The following image shows the back panel of the PA-3400 Series firewall and the table describes
each back-panel component. The PA-3410, PA-3420, PA-3430, and PA-3440 back-panel
components are idencal.
Item Component Descripon
1 Fan assemblies Provides venlaon and cooling for the firewall.
The fans are not field replaceable.
2 Ground stud Use the single post ground stud to connect the
firewall to earth ground (ground cable not included).
3 PS1 and PS2 Use the power supply inputs to connect AC power
to the firewall. The second power supply is for
redundancy. When facing the back of the firewall,
PS1 is on the le and PS2 is on the right.
PA-3400 Series Next-Gen Firewall Hardware Reference 20 ©2022 Palo Alto Networks, Inc.