If you’re provisioning fiber interfaces on a Palo Alto Networks firewall, you’ve run into the PAN- part number system — a lineup that spans 1G through 400G, with a parallel set of TAA-compliant variants alongside the standard ones. This guide walks through what each speed tier covers, what the naming actually means, and how to match a transceiver to your specific PA-Series platform, based on Palo Alto’s own official interface and transceiver specification documentation.
Understanding the PAN- Naming Convention
Every part follows a predictable pattern: PAN-[form factor]-[speed/standard]. A few things are worth knowing before you start matching parts to ports:
- “T-” prefix (e.g., PAN-T-S-LX, PAN-T-Q28-100GBASE-LR4) marks the TAA-compliant version of an otherwise identical transceiver — same optical specification, same reach, same wavelength. If your organization has federal or TAA sourcing requirements, look for the “T-” variant; otherwise the standard part is functionally equivalent.
- SFP vs. SFP+ vs. SFP28 vs. QSFP vs. QSFP28 map directly to speed: SFP is 1G, SFP+ is 10G, SFP28 is 25G, QSFP is 40G, and QSFP28 is 100G. All use the same physical port family within their tier, so a 10G SFP+ won’t fit a 1G SFP-only port and vice versa.
- Connector type is consistent across nearly the whole range: duplex LC for everything except the 40G/100G SR4 modules, which use an MPO/MTP parallel-fiber connector, and the 10G copper module, which uses RJ-45.
1 Gigabit SFP Transceivers
Palo Alto’s 1G tier covers copper and three optical reach classes — short (SX), long (LX), and extended (ZX) — supported across nearly the entire PA-Series lineup, including older and smaller-branch platforms.
| Model | Type | Media | Wavelength | Max Reach |
| PAN-SFP-CG / PAN-T-S-CG | 1000BASE-T copper | Cat5 RJ-45 | — | 100 m |
| PAN-SFP-SX / PAN-T-S-SX | 1000BASE-SX | MMF | 850 nm | 550 m |
| PAN-SFP-LX / PAN-T-S-LX | 1000BASE-LX | SMF | 1310 nm | 10 km |
| PAN-SFP-ZX | 1G extended reach | SMF | 1550 nm | 80 km |
Typical use: Branch firewall uplinks, management interfaces, and shorter data center links where 1G is still sufficient.
10 Gigabit SFP+ Transceivers
The 10G tier is the most heavily used across mid-range PA-Series firewalls, with copper, direct-attach, and three optical reach options.
| Model | Type | Media | Wavelength | Max Reach |
| PAN-SFP-PLUS-10GBASE-T | 10GBASE-T copper | Cat6a RJ-45 | — | 30 m |
| PAN-SFP-PLUS-CU-5M | Direct attach copper | SFP+ Cu | — | 5 m |
| PAN-SFP-PLUS-SR / PAN-T-S-PLUS-SR | 10GBASE-SR | MMF | 850 nm | 300 m OM3 / 450 m OM4 |
| PAN-SFP-PLUS-LR / PAN-T-S-PLUS-LR | 10GBASE-LR | SMF | 1310 nm | 10 km |
| PAN-SFP-PLUS-ER | 10GBASE-ER | SMF | 1550 nm | 40 km |
Typical use: Core firewall interconnects, data center north-south links, and inter-site connections needing single-mode reach beyond 10 km.
25 Gigabit SFP28 Transceivers
Palo Alto’s 25G tier is newer and platform-specific — supported on the PA-3400 Series and PA-5410/5420/5430, not the full legacy lineup.
| Model | Type | Media | Wavelength | Max Reach |
| PAN-SFP28-25GBASE-SR / PAN-T-S28-25GBASE-SR | 25GBASE-SR | MMF | 850 nm | 70 m OM3 / 100 m OM4 |
| PAN-SFP28-25GBASE-LR / PAN-T-S28-25GBASE-LR | 25GBASE-LR | SMF | 1310 nm | 10 km |
Typical use: Higher-throughput firewall interfaces on newer PA-Series platforms where 10G is no longer enough but 40G/100G density isn’t needed yet.
40 Gigabit QSFP+ Transceivers
The 40G tier offers the widest spread of options, including a BiDi module for single-strand multimode links and an LM4 module that works on both MMF and SMF.
| Model | Type | Media | Wavelength | Max Reach |
| PAN-QSFP-40GBASE-SR4 / PAN-T-Q-40GBASE-SR4 | 40GBASE-SR4 | MMF (MPO) | 850 nm | 100 m OM3 / 150 m OM4 |
| PAN-QSFP-40GBASE-LR4 / PAN-T-Q-40GBASE-LR4 | 40GBASE-LR4 | SMF | 1271–1331 nm (4x LAN-WDM) | 10 km |
| PAN-QSFP-40GBASE-ER4 | 40GBASE-ER4 | SMF | 1271–1331 nm | 40 km |
| PAN-QSFP-40GBASE-LM4 | 40GBASE-LM4 | MMF or SMF | 1264.5–1337.5 nm (CWDM) | 140–160 m MMF / 1 km SMF |
| PAN-QSFP-40GBASE-BIDI | 40G BiDi | MMF, single-strand LC | ~832–918 nm | 100 m OM3 / 150 m OM4 |
Typical use: High-throughput firewall interconnects on PA-3260 and above through the PA-7000 Series. The BiDi module is worth calling out specifically — it delivers 40G over the same duplex LC infrastructure already cabled for 10G, without needing new MPO fiber runs.
100 Gigabit QSFP28 Transceivers
The 100G tier is reserved for higher-end platforms — PA-3430/3440 and above, the PA-5250/5260/5280, PA-5400 Series, and PA-7000 Series.
| Model | Type | Media | Wavelength | Max Reach |
| PAN-QSFP28-100GBASE-SR4 / PAN-T-Q28-100GBASE-SR4 | 100GBASE-SR4 | MMF (MPO) | 850 nm | 70 m OM3 / 100 m OM4 |
| PAN-QSFP28-100GBASE-LR4 / PAN-T-Q28-100GBASE-LR4 | 100GBASE-LR4 | SMF | 1295.56–1309.14 nm | 10 km |
| PAN-QSFP28-100GBASE-CWDM4 | 100GBASE-CWDM4 | SMF | 1264.5–1337.5 nm | 2 km |
| PAN-QSFP28-100GBASE-ER4 | 100GBASE-ER4 | SMF | 1295.56–1309.14 nm | 25 km |
| PAN-QSFP28-100GBASE-BIDI | 100G BiDi | MMF | 850/900 nm | 70 m OM3 / 100 m OM4 |
| PAN-QSFP28-DAC-5M | Direct attach copper | Passive cable | — | 5 m |
| PAN-QSFP28-AOC-10M | Active optical cable | Fiber, bonded assembly | — | 10 m |
Typical use: High-capacity firewall interconnects and data center-facing interfaces on Palo Alto’s largest platforms, with reach options spanning from a 2 km in-building CWDM4 link up to a 25 km ER4 connection between sites.
400 Gigabit QSFP-DD Transceivers
The catalog also lists newer 400G QSFP-DD modules — PAN-QSFPDD-400GBASE-LR4, PAN-QSFPDD-400GBASE-ZR, and PAN-QSFPDD-4x100GBASE-LR — for Palo Alto’s highest-throughput platforms. These are recent additions to Palo Alto’s lineup and detailed reach, wavelength, and power figures weren’t available in the primary interface specification document referenced for this guide. If you’re speccing one of these for a deployment, we’d recommend confirming exact figures against the specific hardware platform’s current documentation before ordering, rather than relying on general 400GBASE-LR4/ZR industry conventions.
Matching Transceivers to Your PA-Series Platform
Not every transceiver works on every firewall — platform support is tied to the interfaces physically built into each PA-Series model. A few practical patterns worth knowing:
- Smaller branch platforms (PA-220, PA-415/445, PA-800 Series) top out at 1G SFP interfaces — no point speccing 10G+ optics for these.
- Mid-range platforms (PA-3200/3400 Series, PA-5200 Series) typically support 1G, 10G, and in newer models 25G, with 40G/100G on the higher-numbered models in each series.
- PA-3430/3440 and above, PA-5250/5260/5280, PA-5400 Series, and the PA-7000 Series are where 100G QSFP28 support appears.
- 400G QSFP-DD is limited to the newest, highest-throughput platforms in the current lineup.
Always check your specific model’s supported-interface list before ordering — the platform, not just the port physically present, determines which speed tiers and transceiver types are actually supported.
Buying Guidance
Match reach to your actual link, not the longest option available. ER4 (25–40 km) and ZX/ZR-class modules cost more and aren’t necessary for in-building or short campus links — CWDM4 (2 km) or LR4 (10 km) usually cover that need at a lower price point.
Consider BiDi modules if you want to avoid new MPO cabling. Both the 40G and 100G BiDi modules run over standard duplex LC multimode fiber instead of parallel MPO fiber, which can be useful when you’re upgrading a link’s speed without wanting to repull cabling.
Check TAA requirements before ordering. If your organization needs TAA-compliant hardware, order the “T-” prefixed variant — it’s the same optical specification, just certified to that requirement.
Confirm your firewall’s actual supported interface list. Speed tier and form factor availability vary meaningfully across the PA-Series lineup — don’t assume a transceiver will work just because it physically fits an SFP or QSFP cage.
Where to Source Palo Alto Transceivers
NextGen Networks stocks Palo Alto optical transceivers across the 1G through 100G range shown here, alongside Cisco, Finisar, Aruba, Fortinet, and NVIDIA Mellanox networking hardware. If you’re not sure which transceiver matches your specific PA-Series platform, our team can help confirm compatibility before you order.
Frequently Asked Questions
What does the “T-” prefix mean on a Palo Alto transceiver part number?
It marks the TAA-compliant version of the module — the same optical specification and reach as the standard part, but certified to meet Trade Agreements Act requirements.
What’s the difference between PAN-SFP-PLUS-SR and PAN-SFP-PLUS-LR?
PAN-SFP-PLUS-SR is a 10GBASE-SR module for multimode fiber, reaching 300–450 m. PAN-SFP-PLUS-LR is a 10GBASE-LR module for single-mode fiber, reaching 10 km.
Can I use a 100G transceiver on any Palo Alto firewall?
No. 100G QSFP28 support is limited to specific platforms — PA-3430/3440 and above, PA-5250/5260/5280, the PA-5400 Series, and the PA-7000 Series. Smaller platforms don’t support 100G interfaces.
What is the PAN-QSFP-40GBASE-BIDI module used for?
It delivers 40G Ethernet over standard duplex LC multimode fiber using bidirectional transmission, rather than the parallel MPO fiber a standard 40GBASE-SR4 module requires — useful for upgrading a link without repulling cabling.
Does Palo Alto make 400G transceivers?
Yes, QSFP-DD 400G modules (PAN-QSFPDD-400GBASE-LR4, PAN-QSFPDD-400GBASE-ZR, PAN-QSFPDD-4x100GBASE-LR) are available for the highest-throughput platforms in the current lineup. Confirm platform compatibility and exact specifications directly for your hardware before ordering.
Are Palo Alto’s SFP and SFP+ ports interchangeable?
No. SFP (1G) and SFP+ (10G) are different electrical standards, even though the physical cage looks similar in some cases — use the transceiver rated for your port’s actual speed.
Conclusion
Palo Alto’s PAN- transceiver lineup covers 1G through 400G across copper, multimode, and single-mode options, with a parallel TAA-compliant “T-” series running alongside the standard parts. The key steps are the same regardless of speed tier: confirm what your specific PA-Series platform actually supports, match reach to your real link distance rather than defaulting to the longest option, and check whether you need the TAA-compliant variant. NextGen Networks stocks the full range and can help confirm the right part for your firewall deployment.
