The PA-500 Series Quantum-Optimized NGFWs is a family of next-generation firewalls that includes models such as PA-501, PA-505, PA-510, PA-520, PA-520-5G, PA-540, PA-545-POE, PA-550, PA-555-POE, and PA-560.

They bring ML-powered security to:

• Distributed enterprise branch offices
• Retail locations
• Midsize organizations

All models run PAN-OS, which:

• Natively classifies all traffic (applications, threats, content) and ties it to specific users, no matter their device or location.
• Uses embedded AI in the firewall core to prevent file-based attacks without signatures and to stop never-before-seen phishing attempts inline.
• Helps improve your security posture and reduce incident response time by using this rich traffic context for policy decisions.

The series is also designed for operational simplicity:

• High port density (up to 24 copper and fiber interfaces, depending on model).
• PoE support up to 330W and IEEE 802.3bt with up to 90W per PoE port on select models.
• Zero touch provisioning (ZTP) to streamline rollouts at branches and remote sites.
• High availability with active/active and active/passive modes.

Managed centrally through Strata Cloud Manager, the PA-500 Series fits organizations that want to reimagine branch and mid-market security with consistent, AI-assisted protection and policy management across many locations.

The PA-500 Series is built to help you manage both today’s encrypted traffic and tomorrow’s post-quantum needs.

Inspection of current SSL/TLS traffic

PA-500 Series NGFWs can:

• Inspect and enforce policy on SSL/TLS-encrypted traffic (inbound and outbound), including SSLv3, TLS 1.1, 1.2, and 1.3.
• Work across key application protocols such as SMTP, WebSocket, gRPC, HTTP/1.0, HTTP/1.1, and HTTP/2.
• Decrypt and inspect sessions using classic key exchanges: RSA, ECDHE, and DHE.
• Gather metrics on TLS traffic—encrypted volume, protocol versions, and ciphers in use.
• Control the use of legacy TLS protocols, insecure ciphers, and misconfigured certificates (including SNI/CN mismatches).
• Use Decrypt Mirror to send a copy of decrypted traffic to external tools for forensics or DLP.

To make operations manageable, you can:

• Enable or disable decryption based on URL category, zones, addresses, user/user group, device, and port.
• Use enhanced logs to troubleshoot client-side and server-side sessions independently.

Post-quantum cryptography (PQC) readiness

The PA-500 Series is PQC-ready with PAN-OS 12.1 and above, helping you move toward quantum-safe security in both hardware and software. It supports:

• PQC for SSL/TLS decryption
• PQC site-to-site VPN
• PQC SSL/TLS Cipher Translation Proxy
• PQC SSL/TLS Service Profile for secure management access to the firewall

Supported PQC algorithms include NIST standards such as:

• ML-KEM
• ML-DSA
• SLH-DSA

And pre-standard options like:

• Classic McEliece, BIKE, HQC, Frodo-KEM, NTRU-Prime

You can also decrypt and inspect sessions using post-quantum key exchanges such as ML-KEM and HQC, plus experimental BIKE and Frodo-KEM, alongside traditional RSA/ECDHE/DHE.

This combination allows you to:

• Gain visibility into cryptographic parameters of all SSL/TLS sessions that pass through the firewall, even when you don’t decrypt.
• Start a gradual transition to quantum-safe cryptography without a rip-and-replace of your security stack.

The PA-500 Series combines AI-driven threat prevention with identity-aware controls to help you rethink how you secure users, data, and applications.

AI-driven threat prevention and visibility

• Precision AI powers Cloud-Delivered Security Services (CDSS) for proactive detection, inline prevention, and automated response to never-before-seen attacks.
• Threat intelligence is backed by data from over 75,000 customers globally, allowing models to continuously learn and adapt.
• Advanced Threat Prevention stops both known threats and zero-day C2 and unknown exploits inline.
• Advanced WildFire uses ML-based detection engines in the cloud to identify and block highly evasive malware across network, cloud, and endpoints.
• Advanced URL Filtering analyzes URLs and web content in real time to classify and block phishing, malware, ransomware, and C2 traffic.
• Advanced DNS Security inspects every DNS request/response inline to stop hijacking, DGA domains, DNS tunneling, and C2 callbacks.
• Advanced IP Defense adds zero trust DNS concepts to block direct-to-IP C2 connections and exfiltration using real-time IP intelligence.

Application and device visibility is enhanced through:

• App-ID with full Layer 7 inspection on all ports, using protocol decoding, heuristics, and signatures.
• Optional App-ID Cloud Engine (ACE) for on-demand coverage of SaaS apps.
• AI techniques to recognize and manage AI-powered and GenAI applications accurately.
• Device Security capabilities to discover connected devices and reduce hidden device risks.
• SaaS Security and AI Access Security to monitor sanctioned and unsanctioned SaaS/GenAI apps and prevent sensitive data leakage.

Identity-based and user-centric security

PA-500 Series NGFWs enforce user-centric policies wherever people work:

• Apply visibility, policies, reporting, and forensics based on users, groups, and IP addresses.
• Keep policies consistent across locations (office, home, travel) and devices (iOS, Android, macOS, Windows, Linux, VDI, terminal servers).
• Use IP geolocation to enforce rules by country or region to reduce attack surface and control application access.
• Leverage Cloud Identity Engine to authenticate and authorize users consistently, whether identities live in cloud directories, on-prem directories, or both—supporting a move toward zero trust.
• Support passwordless authentication for on-prem, SaaS, and hybrid applications.
• Define Cloud Dynamic User Groups (CDUGs) to take time-bound, risk-based actions automatically when user behavior looks suspicious.
• Prevent corporate credentials from leaking to third-party sites and reduce reuse of stolen credentials by enforcing MFA at the network layer for any app, without changes to the apps themselves.
• Integrate with wireless LAN controllers, VPNs, directory servers, and SIEMs to centralize user information.
• Automate policy recommendations to save time and reduce configuration errors.

Unified AI-powered operations

With Strata Cloud Manager and Strata Copilot you can:

• Get real-time, unified visibility into users, apps, devices, and critical threats.
• Manage policy and configuration consistently across firewalls, SASE, and security services.
• Use AI analysis to detect and fix policy issues (e.g., shadow rules, overly permissive rules) and maintain alignment with InfoSec standards.
• Predict and address up to 130 categories of network issues—including user experience and capacity bottlenecks—up to 90 days in advance.
• Query your environment via natural language through Strata Copilot and streamline case creation when you need support.

Together, these capabilities help you reimagine security as a unified, AI- and identity-driven system rather than a collection of point tools.