Focus
Focus
Table of Contents

PA-3400 Series Front Panel

Learn about the PA-3400 Series firewall front-panel components.
The following image shows the front panel of the PA-3410 and PA-3420 firewalls and the table describes each front panel component.
Item
Component
Description
1
Ethernet ports 1 through 12
Twelve RJ-45 10Mbps/100Mbps/1Gbps/2.5Gbps/5Gbps/10Gbps ports for network traffic.
Port 1 is a Zero Touch Provisioning (ZTP) port. The ZTP port can be used to automate the on-boarding of new firewalls to a Panorama management server. To use the ZTP port, read how to boot the firewall in ZTP mode.
2
SFP ports 13 through 22
Ports 13 through 22 are SFP (1Gbps) or SFP+ (10Gbps) based on the installed transceiver.
The SFP ports can be remapped as HA-1 ports via PAN-OS or Panorama. These remapped HA-1 ports offer high availability connectivity over a longer distance than what is permitted by the HA1-A and HA1-B ports listed below.
3
SFP28 ports 23 through 26
Four SFP28 (25Gbps) ports that also support 1G SFP and 10G SFP+ modules. These ports support RS-FEC.
The FEC setting of the remote endpoint must be set to RS-514 or RS-528 per the IEEE standards to ensure that the link remains up.
4
HSCI port
One SFP+ (10Gbps) port (supports both SFP and SFP+ transceivers or cables).
Use this port to connect two PA-3400 Series firewalls in a high availability (HA) configuration as follows:
  • In an active/passive configuration, this port is for HA2 (data link).
  • In an active/active configuration, you can configure this port for HA2 and HA3. HA3 is used for packet forwarding for asymmetrically routed sessions that require Layer 7 inspection for App-ID and Content-ID.
The HSCI ports must be connected directly between the two firewalls in the HA configuration (without a switch or router between them). When directly connecting the HSCI ports between two PA-3400 Series firewalls that are physically located near each other, Palo Alto Networks recommends that you use a passive SFP+ cable.
For installations where the two firewalls are not near each other and you cannot use a passive SFP+ cable, use a standard SFP+ transceiver and the appropriate cable length.
5
HA1-A and HA1-B ports
Two RJ-45 10Mbps/100Mbps/1000Mbps ports for high availability (HA) control.
6
MGT port
Use this Ethernet 10Mbps/100Mbps/1000Mbps port to access the management web interface and perform administrative tasks. The firewall also uses this port for management services, such as retrieving licenses and updating threat and application signatures.
The management interface cannot be configured as a HA port.
7
CONSOLE port (RJ-45)
Use this port to connect a management computer to the firewall using a 9-pin serial-to-RJ-45 cable and terminal emulation software.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
If your management computer does not have a serial port, use a USB-to-serial converter.
Use the following settings to configure your terminal emulation software to connect to the console port:
  • Data rate: 9600
  • Data bits: 8
  • Parity: None
  • Stop bits: 1
  • Flow control: None
8
USB port
A USB port that accepts a USB flash drive with a bootstrap bundle (PAN-OS configuration).
Bootstrapping speeds up the process of configuring and licensing the firewall to make it operational on the network with or without internet access.
9
CONSOLE port (Micro USB)
Use this port to connect a management computer to the firewall using a standard Type-A USB-to-micro USB cable.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
Refer to the Micro USB Console Port page for more information and to download the Windows driver or to learn how to connect from a Mac or Linux computer.
10
LED status indicators
Eight LEDs that indicate the status of the firewall hardware components (see Interpret the PA-3400 Series Status LEDs).
11
System Drive Cover
Secures the device SSD.
The following image shows the front panel of the PA-3430 and PA-3440 firewalls and the table describes each front panel component.
Item
Component
Description
1
Ethernet ports 1 through 12
Twelve RJ-45 10Mbps/100Mbps/1Gbps/2.5Gbps/5Gbps/10Gbps ports for network traffic.
Port 1 is a Zero Touch Provisioning (ZTP) port. The ZTP port can be used to automate the on-boarding of new firewalls to a Panorama management server. To use the ZTP port, read how to boot the firewall in ZTP mode.
2
SFP ports 13 through 22
Ports 13 through 22 are SFP (1Gbps) or SFP+ (10Gbps) based on the installed transceiver.
The SFP ports can be remapped as HA-1 ports via PAN-OS or Panorama. These remapped HA-1 ports offer high availability connectivity over a longer distance than what is permitted by the HA1-A and HA1-B ports listed below.
3
SFP28 ports 23 through 26
Four SFP28 (25Gbps) ports that also support 1G SFP and 10G SFP+ modules. These ports support RS-FEC.
The FEC setting of the remote endpoint must be set to RS-514 or RS-528 per the IEEE standards to ensure that the link remains up.
4
QSFP28 ports 27 through 36
Two form-factor pluggable (QSFP+/QSFP28) 40Gbps/100Gbps Ethernet ports. These ports support RS-FEC.
Each interface supports breakout mode to create four 10Gbps or four 25Gbps ports each.
  • Ports 27, 28, 29, and 30 break out from port 35
  • Ports 31, 32, 33, and 34 break out from port 36
The FEC setting of the remote endpoint must be set to RS-514 or RS-528 per the IEEE standards to ensure that the link remains up.
RS-FEC is enabled for most transceiver modules. The exceptions are LR4, AOC v2, and BiDi transceivers.
5
HSCI port
One SFP+ (10Gbps) port (supports only an SFP+ transceiver or passive SFP+ cable).
Use this port to connect two PA-3400 Series firewalls in a high availability (HA) configuration as follows:
  • In an active/passive configuration, this port is for HA2 (data link).
  • In an active/active configuration, you can configure this port for HA2 and HA3. HA3 is used for packet forwarding for asymmetrically routed sessions that require Layer 7 inspection for App-ID and Content-ID.
The HSCI ports must be connected directly between the two firewalls in the HA configuration (without a switch or router between them). When directly connecting the HSCI ports between two PA-3400 Series firewalls that are physically located near each other, Palo Alto Networks recommends that you use a passive SFP+ cable.
For installations where the two firewalls are not near each other and you cannot use a passive SFP+ cable, use a standard SFP+ transceiver and the appropriate cable length.
6
HA1-A and HA1-B ports
Two RJ-45 10Mbps/100Mbps/1000Mbps ports for high availability (HA) control.
7
MGT port
Use this Ethernet 10Mbps/100Mbps/1000Mbps port to access the management web interface and perform administrative tasks. The firewall also uses this port for management services, such as retrieving licenses and updating threat and application signatures.
The management interface cannot be configured as a HA port.
8
CONSOLE port (RJ-45)
Use this port to connect a management computer to the firewall using a 9-pin serial-to-RJ-45 cable and terminal emulation software.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
If your management computer does not have a serial port, use a USB-to-serial converter.
Use the following settings to configure your terminal emulation software to connect to the console port:
  • Data rate: 9600
  • Data bits: 8
  • Parity: None
  • Stop bits: 1
  • Flow control: None
9
USB port
A USB port that accepts a USB flash drive with a bootstrap bundle (PAN-OS configuration).
Bootstrapping speeds up the process of configuring and licensing the firewall to make it operational on the network with or without internet access.
10
CONSOLE port (Micro USB)
Use this port to connect a management computer to the firewall using a standard Type-A USB-to-micro USB cable.
The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
Refer to the Micro USB Console Port page for more information and to download the Windows driver or to learn how to connect from a Mac or Linux computer.
11
LED status indicators
Nine LEDs that indicate the status of the firewall hardware components (see Interpret the PA-3400 Series Status LEDs).
12
System Drive Cover
Secures the device SSD.