PALO ALTO NETWORKS LIFECYCLE GUIDE
PA-800 to PA-1400 Migration Guide
A fact-checked planning reference for PA-820 and PA-850 owners evaluating PA-1410 or PA-1420 hardware, interfaces, power and PAN-OS requirements.
Start with lifecycle, not appliance price
Palo Alto Networks lists the PA-820, PA-850 and their ZTP variants as end of sale, with an August 31, 2029 end-of-life date and PAN-OS 11.1 as the last supported operating-system branch. The same lifecycle table identifies the PA-1400 Series as the recommended replacement family.
That recommendation does not make PA-1410 or PA-1420 a drop-in replacement. A defensible selection must account for inspected throughput, session demand, interface media, high availability, subscriptions, management, power and the configuration features used by the existing firewall.
Retain temporarily
Appropriate only when the current PA-800 capacity is sufficient, PAN-OS 11.1 supports the required features, valid support remains available and a dated replacement plan is funded.
Evaluate PA-1410
Start here when the design needs more copper and fiber flexibility than PA-800, up to four 5GbE copper interfaces, PoE options and a current PA-1400 software lifecycle.
Evaluate PA-1420
Use the higher model evaluation when measured traffic, sessions, decryption, logging or port-speed requirements exceed the validated PA-1410 design envelope.
Interface map: what changes physically
Record every active data, management and HA connection before choosing optics or cables. Similar-looking cages are not proof that media, speed or HA behavior can remain unchanged.
| Interface area | PA-820 | PA-850 | PA-1410 | PA-1420 |
|---|---|---|---|---|
| RJ-45 data ports | 4 x 10/100/1000 | 4 x 10/100/1000 | 12 total; ports 9-12 support up to 5Gbps | 12 total; ports 5-12 support up to 5Gbps |
| SFP/SFP+ data ports | 8 x 1GbE SFP | 4 x 1GbE SFP plus 4 x grouped 1GbE SFP or 10GbE SFP+ | 10 total; ports 19-22 support 1/10Gbps | 10 total; ports 15-22 support 1/10Gbps |
| PoE-capable ports | None documented | None documented | RJ-45 ports 9-12 | RJ-45 ports 9-12 |
| Dedicated HA data link | HA1 and HA2 RJ-45 ports | HA1 and HA2 RJ-45 ports | 10Gbps HSCI plus HA control interfaces | 10Gbps HSCI plus HA control interfaces |
Important PA-850 boundary: ports 9 through 12 operate as one speed/media group. They can be four 1GbE SFP ports or four 10GbE SFP+ ports, but the two modes cannot be mixed within that group.
Power and rack planning
| Model | Power architecture | Published consumption | Procurement check |
|---|---|---|---|
| PA-820 | One fixed 200W AC supply | 41W average; 120W maximum | No power-supply redundancy |
| PA-850 | Two 450W AC supplies; one redundant | 64W average; 240W maximum | Confirm both feeds and both power cords |
| PA-1410 | AC or DC; second supply provides redundancy | 100W average / 140W maximum without PoE; 250W / 290W with 150W PoE load | Confirm whether the second supply is included in the order |
| PA-1420 | AC or DC; second supply provides redundancy | 110W average / 150W maximum without PoE; 260W / 300W with 150W PoE load | Size rack power for the actual PoE load |
A PA-850 replacement can increase rack-power demand even before PoE is enabled. Treat PoE consumption, redundant feeds, plug type, available circuits and heat load as explicit design inputs.
Do not compare unlike performance numbers
Palo Alto Networks published 1.9Gbps App-ID and 780Mbps Threat Prevention performance for PA-850. Its PA-1400 launch material states a 6.8Gbps to 9.5Gbps App-ID range across the PA-1400 family and describes up to five times the performance and seven times the session capacity of the previous generation.
Those figures are useful for identifying the scale change, but they do not replace sizing. Compare the same test category for each candidate and include the production security profile: threat prevention, decryption, IPsec, GlobalProtect, logging, QoS, routing and expected traffic growth.
- Peak and 95th-percentile inspected throughput, not only internet circuit speed.
- Concurrent and new sessions per second during business peaks.
- Encrypted-traffic percentage and required decryption policy.
- IPsec and remote-access VPN users, tunnels and crypto settings.
- Security subscriptions and logging destinations enabled in production.
Migration checklist
- Inventory: export device state and document interfaces, zones, virtual routers, HA, VPNs, certificates, users, authentication, NAT, policy, QoS and logging.
- Software: choose a PAN-OS release supported by the target model and management platform; validate plugins, content versions and upgrade-path requirements.
- Subscriptions: map support and security services to new entitlements instead of assuming licenses transfer with the configuration.
- Ports: create an old-to-new port map for copper, SFP/SFP+, management and HA; validate every optic and cable against current compatibility data.
- Capacity: size from measured traffic, sessions, decryption, VPN and growth using like-for-like performance metrics.
- Power: confirm AC or DC choice, second power supply, cords, rack circuits and any PoE load.
- Testing: validate routing, NAT, security policy, VPN, identity, HA failover, logging and monitoring before the production cutover.
- Rollback: retain a tested rollback path, maintenance window and old appliance configuration until acceptance criteria pass.
Review the current PA-800 product records
Use these pages to verify the exact legacy model identity before requesting a replacement quotation.
Official manufacturer sources
- Palo Alto Networks hardware end-of-life dates
- PA-800 Series front-panel reference
- PA-800 Series electrical specifications
- PA-1400 Series front-panel reference
- PA-1400 Series electrical specifications
- PAN-OS releases supported by firewall model
This independent procurement guide is not a Palo Alto Networks publication and does not claim partner authorization. Specifications and lifecycle information can change; verify the current manufacturer documents and final bill of materials before purchase or migration.