Product Certifications

Common Criteria

On November 12th 2019, the Common Criteria Certification for Palo Alto Networks M-100, M-200, M-500, and M-600 Hardware, and Virtual Appliances all running Panorama 8.1.10, Validation ID 10980, was completed and posted at https://www.niap-ccevs.org/Product/Compliant.cfm?PID=10980

On January 3rd 2019, NIAP posted the Common Criteria assurance maintenance update, adding PAN-OS v8.0.12 and v8.1.3 for the PA-200 Series, PA-500, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5000 Series, PA-5200 Series, PA-7000 Series and VM Series Next-Generation Firewalls to the Product Compliant List at https://www.niap-ccevs.org/Product/Maint.cfm?PID=10839&AMID=1428 . The following hardware appliance models have been added to the list of certified products: PA-220R, PA-3220, PA-3250, PA-3260 and PA-5280.

On April 30th 2018, Palo Alto Networks PA-200 Series, PA-500, PA-800 Series, PA-3000 Series, PA-5000 Series, PA-5200 Series, PA-7000 Series, and VM Series Next-Generation Firewall with PAN-OS v8.0.6 were officially Common Criteria (CC) certified and posted at NIAP Product Compliant List. For certification details, please visit https://www.niap-ccevs.org/Product/Compliant.cfm?PID=10839.

For more information on the previously Common Criteria (CC) certified Palo Alto Networks products please visit https://www.niap-ccevs.org/Product/Archived.cfm and search for Palo Alto Networks.

Previous Common Criteria announcements:

Palo Alto Networks Next-Generation Firewalls have achieved Common Criteria (CC) certification under the rigorous National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS). The certified products are compliant with Protection Profile for Network Devices Version 1.1, Network Device Protection Profile (NDPP) Extended Package Stateful Traffic Filter Firewall Version 1.0, and Network Device Protection Profile (NDPP) Extended Package VPN Gateway Version 1.1. The VPN Gateway evaluation also included additional requirements per the NSA Commercial Solutions for Classified Networks (CSfC).

The certification applies to the Palo Alto Networks PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series and PA-7000 Series next-generation firewalls, and the VM-Series virtual next-generation firewall.

For certification details, please visit https://www.commoncriteriaportal.org/files/epfiles/st_vid10640-st.pdf.

The certification above builds upon the previous Common Criteria certification at Evaluation Assurance Level 4+ (EAL4+) that Palo Alto Networks received in 2013. The certificate was issued by the NIAP. The EAL4+ Assurance Continuity Maintenance Report (ACMR) is available at http://www.commoncriteriaportal.org/files/epfiles/st_vid10392-add2.pdf.

FIPS 140-2

Palo Alto Networks products have been validated against FIPS 140-2, a certification focused on cryptographic functionality. The following certificates have been issued by the National Institute of Standards and Technology (NIST) under the Cryptographic Module Validation Program (CMVP):

Certificate No. 3536 - PA-200, PA-220, PA-220R, PA-500, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5000 Series, PA-5200 Series and PA-7000 Series Firewalls posted at https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/3536

Certificate No. 3531 - Panorama Virtual Appliance posted at https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/3531

Certificate No. 3530 - Panorama M-100, M-200, M-500 and M-600 posted at https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/3530

Certificate No. 3479 - Palo Alto Networks VM-Series posted at https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/3479

Certificate No. 3478 - WildFIre WF-500 posted at https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/3478

Certificate No. 3144 - Palo Alto Networks VM-Series posted at https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/3144

Certificate No. 3133 - PA-200, PA-220, PA-500, PA-800 Series, PA-3000 Series, PA-5000 Series, PA-5200 Series and PA-7000 Series Firewalls posted at https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/3133

Certificate No. 3115 - Panorama M-100 and M-500 posted at https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/3115

Certificate No. 3102 - WildFire WF-500 posted at https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/3102

Certificate No. 2799 - PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series and PA-7050 Firewalls posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2799

Certificate No. 2797 - PA-3060 and PA-7080 Firewalls posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2797

Certificate No. 2800 - PAN-OS VM–Series posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2800

Certificate No. 2802 - WildFire WF-500 posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2802

Certificate No. 2787 - Panorama M-100 and M-500 posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2787

Certificate No. 2637 - PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series and PA-7050 Firewalls posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2637

Certificate No. 2616 - PA-3060 and PA-7080 Firewalls posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2616

Certificate No. 2620 - PAN-OS VM–Series posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2620

Certificate No. 2617 - WildFire WF-500 posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2617

Certificate No. 2453 - Panorama M-100 posted at https://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#2453

Validated modules can be accepted by US Federal Agencies using cryptographic-based security to protect sensitive information in computer and telecommunication systems.

NCSC Foundation Grade Certification

PA-200 Series, PA-500 Series, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5000 Series, PA-5200 Series, PA-7000 Series & VM Series, Next-Generation Firewall Foundation Grade certificate has been posted here.

PA-200 Series, PA-500 Series, PA-800 Series, PA-3000 Series, PA-5000 Series, PA-5200 Series, PA-7000 Series & VM Series, Next-Generation Firewall Foundation Grade certificate has been posted here.

ANSSI top-level certification

The Palo Alto Networks platform was the first to be certified by the Agence nationale de la sécurité des systèmes d’information (ANSSI) on next-generation firewall criteria, including protections based on applications (App-ID) and users (User-ID). The tests were conducted by the CESTI and information technology security consultants at AMOSSYS – organizations approved by the ANSSI to conduct these security assessments.

UC APL

The Department of Defense Information Network (DoDIN) Approved Products List (APL) approval of the Palo Alto Networks PA-500 and PA-200, PA-800, PA-3000, PA-3200, PA-5000, PA-5200, PA-7000 Series and specified Virtual Machine (VM) Series Rel. PAN-OS 8.1.11 TN 1721401 Desktop Review (DTR) #1 as a Data Firewall (DFW), Virtual Private Network Concentrator (VPN), and Intrusion Protection Systems and Intrusion Detection Systems (IPS and IDS) has been granted.

The DoDIN APL Approval Memo is posted on the DoDIN APL site at https://aplits.disa.mil/apl.

Commercial Solutions for Classified (CSfC)

Palo Alto Networks, Inc.’s Next Generation Firewall Product Series is eligible to be used as a Traffic Filtering Firewall component in a CSfC solution. More information can be found at www.nsa.gov.

Palo Alto Networks, Inc.’s Next Generation Firewall Product Series is eligible to be used as an IPSec VPN Gateway component in a CSfC solution. More information can be found at www.nsa.gov.

USGV6

Palo Alto Networks next-generation firewalls have completed IPv6 conformance testing as firewall, IDS, and IPS devices. USGv6, a testing program from the National Institute of Standards and Technology (NIST) provides proof of compliance to IPv6 specifications outlined in current industry standards for common network products.

ICSA

Palo Alto Networks next-generation firewalls and WildFire cloud-based threat analysis environment have been tested and certified by ICSA Labs, an independent division of Verizon. Certified firewall solutions passed the evaluation against ICSA Labs Modular Firewall Product Certification Criteria version 4.2x for general-purpose network firewalls, in the corporate category. WildFire has passed the evaluation against ICSA Labs Advanced Threat Defense Criteria version 1.0.