End-of-Life — Renewals Only

Palo Alto Networks PA-220R

Name: Palo Alto Networks PA-220R
Brand: Palo Alto Networks
Availability: Discontinued

The PA-220R ruggedized firewall is no longer available for new purchases. The designated industrial replacement is the PA-450R, delivering 6x faster throughput with fail-to-wire ports and optional integrated 5G connectivity.

View the PA-450R Contact a specialist

Palo Alto Networks PA-220R Ruggedized Firewall

End-of-life product information

The PA-220R was a ruggedized next-generation firewall designed for uncontrolled environments including utility substations, power plants, manufacturing floors, oil and gas facilities, and healthcare networks. It delivered 500 Mbps of firewall throughput in a fanless, DIN-rail-mountable form factor rated for -40°C to 70°C operation. This model is no longer available for new purchases. Subscription renewals remain available through authorized partners.

Designated replacement

PA-450R

Ruggedized NGFW with 3.2 Gbps firewall throughput, fail-to-wire ports, DIN rail mounting, and dual DC power inputs for industrial environments.

View PA-450R

5G-ready variant

PA-450R-5G

Same ruggedized platform with an integrated 5G cellular modem for remote substations and sites without wired connectivity.

View PA-450R-5G

IP65-rated option

PA-455R-5G

Higher-throughput ruggedized model with IP65 water and dust resistance, integrated 5G, and 3.2 Gbps firewall performance.

View PA-455R-5G

Industrial upgrade path

Why upgrade from PA-220R to PA-450R

Industrial networks cannot afford downtime. Modern SCADA and IIoT traffic demands more processing power than the PA-220R can deliver. The PA-450R provides a significant performance upgrade while retaining the ruggedized certifications required for harsh environments.

6x throughput increase

The PA-220R is limited to 500 Mbps. The PA-450R delivers 3.2 Gbps of firewall throughput, enabling inspection of high-bandwidth industrial video feeds and data logs without introducing latency into control networks.

Fail-to-wire continuity

Unlike the PA-220R, the PA-450R includes fail-to-wire ports. If the firewall loses power, it physically bridges the connection so critical industrial traffic continues to flow uninterrupted.

Integrated 5G option

The PA-450R-5G variant includes an integrated 5G cellular modem, eliminating the need for external cellular routers at remote substations, oil pads, and unmanned sites.

Same rugged certifications

The PA-450R retains the industrial certifications required for critical infrastructure: IEC 61850-3, IEEE 1613, Class 1 Div 2 hazardous locations, -40°C to 70°C operating range, fanless and vibration resistant.

View full PA-450R specifications Browse all ruggedized models

Legacy vs. current generation

A direct specification comparison between the end-of-life PA-220R and its designated industrial replacement, the PA-450R.

Specification	PA-220R (Legacy)	PA-450R (Current)	Improvement
Firewall throughput	500 Mbps	3.2 Gbps	6x faster
Threat prevention throughput	150 Mbps	1.7 Gbps	11x faster
IPSec VPN throughput	100 Mbps	2.2 Gbps	22x faster
Fail-to-wire	Not available	Built-in	Zero downtime
5G / cellular	Not available	Optional (PA-450R-5G)	Remote connectivity
Mounting	DIN rail / rack	DIN rail / rack	Drop-in replacement
Power supply	Dual DC inputs	Dual DC inputs	Redundant power retained
Operating temperature	-40°C to 70°C	-40°C to 70°C	Same industrial range
Cooling	Fanless	Fanless	Same silent design

The PA-450R uses the same DIN rail form factor for drop-in replacement at existing industrial sites.

View PA-450R details Compare all models

Throughput comparison

Firewall throughput improvement from PA-220R to PA-450R.

PA-220R (Legacy) 500 Mbps

PA-450R (Current) 3.2 Gbps

PA-220R technical specifications

Reference specifications for the end-of-life PA-220R ruggedized platform.

Performance and capacity

Firewall throughput	500 Mbps
Threat prevention throughput	150 Mbps
IPSec VPN throughput	100 Mbps
New sessions per second	4,200
Max sessions	64,000
IPSec VPN tunnels / tunnel interfaces	1,000
Virtual routers	3
Security zones	15
Max number of policies	250

Interfaces and I/O

Ethernet ports	(6) RJ-45 10/100/1000 with built-in surge protection
SFP ports	(2) SFP 1 Gbps (also supports 100Base-FX)
Management port	(1) RJ-45 10/100/1000 out-of-band management
Console ports	(1) RJ-45 serial, (1) Micro USB
USB	(1) USB port for bootstrap configuration
LED status indicators	5 LEDs indicating hardware component status

Hardware and environmental

Power input	Dual DC inputs (terminal block: A+, A-, B+, B-)
Grounding	Screw-on ground point or terminal block ground input
Mounting	DIN rail (standard), wall mount option
Cooling	Fanless, no moving parts
Operating temperature	-40°C to 70°C (-40°F to 158°F)
Form factor	Ruggedized, designed for uncontrolled environments