Palo Alto SFP compatibility matrix by model
The short answer: PA-400 firewalls with optical cages take 1G SFP (PA-450) and 1G SFP plus 10G SFP+ (PA-460); the PA-3400 series takes SFP and SFP+, with 25G SFP28 on the PA-3430 and PA-3440; the PA-5400 series takes SFP28 and 40G/100G QSFP28; and the PA-7000 chassis takes SFP, SFP+, QSFP+ or QSFP28 depending on the Network Processing Card (NPC) installed. EON Technology validates Palo Alto transceiver compatibility by model, firmware, port and optical part number. This page is a quick lookup reference by model and by Palo Alto part number; for the adaptation process on other multivendor platforms, see the transceiver recoding service.
Palo Alto Networks families with optical ports
The matrix is organized by hardware family, because each PA platform exposes a different mix of cages.
| PA family | Representative models | Cages / form factor | Status |
|---|---|---|---|
| PA-400 | PA-450, PA-460 | SFP (1G) · SFP+ (10G, PA-460) | Validated |
| PA-3400 | PA-3410, PA-3420, PA-3430, PA-3440 | SFP (1G) · SFP+ (10G) · SFP28 (25G, PA-3430/3440) | Validated |
| PA-5400 | PA-5420, PA-5430, PA-5440, PA-5450 | SFP28 (10G/25G) · QSFP28 (40G/100G) | Validated |
| PA-7000 | PA-7050, PA-7080 with NPC cards | SFP/SFP+ (20GXM NPC) · QSFP+ (20GQXM NPC) · QSFP28 (100G NPC) | Validated |
The PA-410, PA-415 and PA-440 desktop models rely mainly on RJ45 copper; confirm the exact cage count on the datasheet of your model before ordering optics.
Form factors and speed per cage
The cage sets the speed, not the module. This is the baseline equivalence used in every row of the matrix:
| Form factor | Speed | Typical optics | Reach |
|---|---|---|---|
| SFP | 1G | SX (MM 850 nm) · LX (SM 1310 nm) · CG copper (RJ45) | 100 m copper · 550 m MM · 10 km SM |
| SFP+ | 10G | SR (MM 850 nm) · LR (SM 1310 nm) | 300 m MM · 10 km SM |
| SFP28 | 25G | SR · LR | 100 m MM · 10 km SM |
| QSFP+ | 40G | SR4 · LR4 | 150 m MM · 10 km SM |
| QSFP28 | 100G | SR4 · LR4 | 100 m MM · 10 km SM |
An SFP28 cage on a PA-5400 or PA-3440 usually accepts a 10G SFP+ with speed downshift, and a QSFP28 cage on a PA-5400 usually accepts a 40G QSFP+; a 1G SFP cage never goes up to 10G. For short runs between adjacent network equipment there are also DAC and AOC assemblies; each end of a DAC or AOC is coded independently for the platform it faces.
Cross-reference: from the Palo Alto part number to the EON equivalent
Each PAN- part number maps to an EON compatible equivalent with the same optics and form factor.
| Palo Alto part number | Description | EON compatible equivalent |
|---|---|---|
| PAN-SFP-SX | 1G SFP MM 850 nm | SFP 1G SX |
| PAN-SFP-LX | 1G SFP SM 1310 nm | SFP 1G LX |
| PAN-SFP-CG | 1G SFP RJ45 copper | SFP-T 1G copper |
| PAN-SFP-PLUS-SR | 10G SFP+ MM 850 nm | SFP+ 10G SR |
| PAN-SFP-PLUS-LR | 10G SFP+ SM 1310 nm | SFP+ 10G LR |
| PAN-SFP28-SR | 25G SFP28 MM | SFP28 25G SR |
| PAN-SFP28-LR | 25G SFP28 SM | SFP28 25G LR |
| PAN-QSFP28-SR4 | 100G QSFP28 MM | QSFP28 100G SR4 |
| PAN-QSFP28-LR4 | 100G QSFP28 SM | QSFP28 100G LR4 |
Need a part number that is not in the table, such as a BiDi or an 80 km ZR option? Browse the transceiver catalog or send us your bill of materials and we map each line.
Fiber type, reach and wavelength
Choose by distance and installed plant: multimode OM3/OM4 at 850 nm covers the rack and the room (300 m at 10G, 100 m at 25G/100G); single-mode at 1310 nm covers campus and metro links up to 10 km, and 1550 nm variants reach 40 to 80 km for site-to-site firewall pairs. BiDi modules use a single simplex LC strand when fiber pairs are scarce. Multimode and single-mode modules are not interchangeable: match the module to the installed cable.
PAN-OS releases and port diagnostics
We record the PAN-OS release on which each module was verified (10.1, 10.2, 11.0 and 11.1 on the current families), because the same module can be recognized on one release and reported as unsupported on another. Before ordering, read the port from the CLI:
show system state filter sys.s1.p*.phylists the physical layer of every port, including transceiver vendor, part number, wavelength and the DDM/DOM readings (TX/RX power, temperature, voltage).show interface hardwaresummarizes port state, speed and duplex.- In the web interface, Network > Interfaces shows link state per port.
A validated module shows as recognized, with optical power inside the budget of the chosen reach. Palo Alto Networks recommends its own PAN- optics; when a module needs adaptation for a PA platform, the transceiver recoding service adapts and validates compatibility for stable operation under the agreed technical conditions, with 90-day service coverage.
Use cases and what to check before ordering
Typical projects: 10G uplinks from a PA-3400 or PA-460 to the core, 25G and 100G data center edge on PA-5400 HA pairs, site-to-site single-mode links between branch firewalls and 1G copper-to-fiber migrations on PA-450 deployments. Multivendor optics on PA hardware deliver significant savings, with engineering support before and after purchase. Before requesting, have three data points at hand: the exact model and its PAN-OS release, the cage type (SFP, SFP+, SFP28 or QSFP28) and the required optical part number. To test before you commit, request a proof of concept. Typical dispatch in 48h*.
Compatibility validated by model, firmware, port and optical part number. EON serves Latin America and Spain from a centralized operation in Colombia.
*Subject to inventory, destination country, carrier, customs, the customer’s import process and third-party logistics conditions.Request Palo Alto compatible modules
Browse transceivers → · Transceiver recoding → · Compatibility hub → · Request a quote →