Strata Copilot
    PA-3500 Series Hardware Reference
    : PA-3510 and PA-3520
    Focus
    Download PDF
    Focus
    1. Home
    2. Firewalls & Appliances
    3. PA-3500 Series Hardware Reference
    4. PA-3500 Series Firewall Overview
    5. PA-3500 Series Firewall Components
    6. PA-3510 and PA-3520
    Download PDF

    PA-3500 Series Hardware Reference

    PA-3510 and PA-3520

    Table of Contents

    PA-3510 and PA-3520

    View the front, back, and top panel components and descriptions of the PA-3510 and PA-3520 firewalls.
    The following image shows the front panel of the PA-3510 and PA-3520 firewalls (PA-3520 pictured) and the table describes each front panel component.
    Item
    Component
    Description
    1
    Copper RJ-45 Ports
    Eight 1Gbps/2.5Gbps/5Gbps/10Gbps RJ-45 ports. Port 1 is used for Zero Touch Provisioning (ZTP).
    2
    SFP/SFP+ Ports
    Eight 1Gbps/10Gbps SFP/SFP+ ports.
    3
    SFP28 Ports
    Six 25Gbps SFP28 ports.
    4
    HSCI Ports
    Two HSCI ports that offer 100Gbps connectivity and are used to connect two firewalls in a high availability (HA) configuration as follows:
    • In an active/passive configuration, this port is for HA2 (data link).
    • In an active/active configuration, you can configure this port for HA2 and HA3. HA3 is used for packet forwarding for asymmetrically routed sessions that require Layer 7 inspection for App-ID and Content-ID.
    The HSCI ports must be connected directly between the two firewalls in the HA configuration (without a switch or router between them).
    The HSCI ports are not recommended for long-distance links (½ mile/1 km and above) regardless of the optical transceiver's rated capabilities. For long-distance links, use the data ports.
    Do not assign an IP address to the HSCI port. The port carries raw Layer 1 traffic that is not routable or switchable and does not support IP addressing. Assigning an IP address to the HSCI port causes the firewall to enter a permanent suspended state.
    For high-throughput deployments, do not use a 1Gbps copper interface for HA2. Use the HSCI port or a 10Gbps/40Gbps fiber interface to ensure sufficient bandwidth for HA data synchronization.
    When you configure path monitoring, do not use your HA peer's data interface IP address as the monitored destination. Using the peer's IP address causes the firewall to incorrectly detect a path failure and trigger an unnecessary failover.
    5
    QSFP28 Ports
    Two 40Gbps/100Gbps QSFP28 ports.
    6
    Management Port
    One 1Gbps/10Gbps SFP+ Management port used to access the management web interface and perform administrative tasks. The firewall uses this port for management services, such as retrieving licenses and updating threat and application signatures.
    7
    Logging Port
    One 1Gbps/10Gbps SFP+ logging port that can be used as a log interface. You must Configure Log Forwarding to forward logs from the port to one or more log collectors.
    You can use any port on the firewall as a log interface.
    8
    USB-C Port
    One USB-C port used for debugging and administration only. Use it to bootstrap the firewall or perform self-service enhanced factory reset (EFR).
    • Bootstrapping enables you to provision the firewall with a specific PAN-OS configuration and then license it and make it operational on your network.
    • EFR provides remediation of a compromised or potentially compromised firewall to initiate a complete cleanup of the device.
    9
    Console Port (RJ-45)
    Use this port to connect a management computer to the firewall using a 9-pin serial-to-RJ-45 cable and terminal emulation software.
    The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
    If your management computer does not have a serial port, use a USB-to-serial converter.
    Use the following settings to configure your terminal emulation software to connect to the console port:
    • Data rate: 115,200
    • Data bits: 8
    • Parity: None
    • Stop bits: 1
    • Flow control: None
    10
    Console port (USB-C)
    Use this port to connect a management computer to the firewall using a standard Type-C USB cable.
    The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).
    11
    LED Indicators
    Ten LEDs that indicate the status of various hardware components. For details on the LEDs, see PA-3500 Series Firewall LED Definitions.
    12
    SSD Cover
    Secures the device's SSD, which contains PAN-OS system files, system logs, and network traffic logs.
    The following image shows the back panel of the PA-3510 and PA-3520 firewalls (PA-3520 pictured) and the table describes each back panel component.
    The back panel of the firewall should remain accessible to ensure ease of replacing a power supply or fan assembly.
    Item
    Component
    Description
    1
    Fans
    Six dual-rotor fans that provide the appliance with cooling and ventilation. The fans are not field replaceable.
    The firewall is designed to continue operating even if one fan rotor has failed.
    2
    Power Supplies
    Two power supplies that provide AC or DC power to the firewall.
    The power supplies are numbered 1 through 2 from left to right.
    Connect AC power or DC power to the firewall.
    You cannot mix AC and DC power supplies. You must use two of the same type of power supply.
    3
    Ground Stud
    A stud used to ground the appliance to earth ground.
    The following image shows the top panel of the PA-3500 Series firewalls and the table describes each top panel component.
    Item
    Component
    Description
    1
    PCI Slot Access Hatch
    Reserved for a future release.

    © 2026 Palo Alto Networks, Inc. All rights reserved.