1. DL manuals
  2. PaloAlto Networks
  3. Firewall
  4. PA-7000 Series
  5. Hardware Reference Manual

PaloAlto Networks PA-7000 Series Hardware Reference Manual

Manual is about: Networks Enterprise Firewall

Summary of PA-7000 Series

  • Page 1

    Palo alto networks pa-7000 series hardware reference guide.

  • Page 2

    2 • pa-7000 series hardware reference guide palo alto networks contact information corporate headquarters: palo alto networks 4401 great america parkway santa clara, ca 95054 www.Paloaltonetworks.Com/company/contact-us about this guide this guide describes the pa-7050 and pa-7080 firewall hardware, ...

  • Page 3: Table of Contents

    Palo alto networks table of contents • 3 chapter 1 pa-7000 series firewall overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 pa-7050 front and back panel descriptions . . . . . . . . . . . . . . . . . . . . . . . . 5 pa-7050 front panel (ac) . . . . . . . . . . . . . . . . . . ....

  • Page 4

    4 • table of contents palo alto networks connect cables to a pa-7000 series firewall . . . . . . . . . . . . . . . . . . . . . . . 82 verify the pa-7000 series lpc and npc configuration . . . . . . . . . . . . . . . 85 verify the lpc configuration . . . . . . . . . . . . . . . . . . . . . . . . . . ...

  • Page 5: Chapter 1

    Palo alto networks pa-7000 series firewall overview • 5 pa-7050 front and back panel descriptions chapter 1 pa-7000 series firewall overview the pa-7000 series firewalls (pa-7050 and pa-7080) are high performance modular firewalls designed for large enterprise and carrier class environments. These m...

  • Page 6: Pa-7050 Front Panel (Ac)

    Pa-7050 front and back panel descriptions 6 • pa-7000 series firewall overview palo alto networks pa-7050 front panel (ac) figure 1 shows the front panel of the pa-7050 firewall with ac power supplies installed and table 1 describes the front panel features. Figure 1. Pa-7050 front panel (ac) 1 2 3 ...

  • Page 7

    Palo alto networks pa-7000 series firewall overview • 7 pa-7050 front and back panel descriptions table 1. Pa-7050 front panel features (ac) item description 1. Exhaust fan tray provides ventilation and cooling for the chassis. The fan tray is interchangeable, so you can install it in either fan tra...

  • Page 8: Pa-7050 Back Panel (Ac)

    Pa-7050 front and back panel descriptions 8 • pa-7000 series firewall overview palo alto networks pa-7050 back panel (ac) figure 2 shows the back panel of the pa-7050 firewall and table 2 describes the back panel features. Figure 2. Pa-7050 back panel (ac) 7. Ac power supplies provides power to the ...

  • Page 9

    Palo alto networks pa-7000 series firewall overview • 9 pa-7050 front and back panel descriptions table 2. Pa-7050 back panel features (ac) item description 1. Ground stud two-post stud used to ground the chassis to earth ground. Use the provided 6 awg two-post ground lug to connect a grounded cable...

  • Page 10: Pa-7050 Front Panel (Dc)

    Pa-7050 front and back panel descriptions 10 • pa-7000 series firewall overview palo alto networks pa-7050 front panel (dc) figure 3 shows the front panel of the pa-7050 firewall with dc power supplies. Figure 3. Pa-7050 front panel (dc) note: the only difference between the front panel of the ac pl...

  • Page 11: Pa-7050 Back Panel (Dc)

    Palo alto networks pa-7000 series firewall overview • 11 pa-7050 front and back panel descriptions pa-7050 back panel (dc) figure 4 shows the back panel of the pa-7050 firewall. The ac inlets and switches are not functional and must remain covered using the provided cover plate. Figure 4. Pa-7050 ba...

  • Page 12

    Pa-7080 front and back panel descriptions 12 • pa-7000 series firewall overview palo alto networks pa-7080 front and back panel descriptions • “pa-7080 front panel (ac)” on page 13 • “pa-7080 back panel (ac)” on page 16 • “pa-7080 front panel (dc)” on page 18 • “pa-7080 back panel (dc)” on page 20

  • Page 13: Pa-7080 Front Panel (Ac)

    Palo alto networks pa-7000 series firewall overview • 13 pa-7080 front and back panel descriptions pa-7080 front panel (ac) figure 5 shows the front panel of the pa-7080 firewall with ac power supplies and table 3 describes the front panel features. Figure 5. Pa-7080 front panel (ac) 1 2 3 5 6 7 8 4...

  • Page 14

    Pa-7080 front and back panel descriptions 14 • pa-7000 series firewall overview palo alto networks table 3. Pa-7080 front panel features (ac) item description 1. Exhaust fan tray provides ventilation and cooling for the chassis. The fan trays is interchangeable, so you can install it in either fan t...

  • Page 15

    Palo alto networks pa-7000 series firewall overview • 15 pa-7080 front and back panel descriptions 9. Air filter filters air entering the chassis. Periodically inspect the filter to ensure it is clean. The filter is not designed to be cleaned and it is recommended that you replace it every six month...

  • Page 16: Pa-7080 Back Panel (Ac)

    Pa-7080 front and back panel descriptions 16 • pa-7000 series firewall overview palo alto networks pa-7080 back panel (ac) figure 6 shows the back panel of the pa-7080 firewall with ac power supplies and table 4 describes the back panel features. Figure 6. Pa-7080 back panel (ac) 1 2 3 4.

  • Page 17

    Palo alto networks pa-7000 series firewall overview • 17 pa-7080 front and back panel descriptions table 4. Pa-7080 back panel features (dc) item description 1. Exhaust vent provides air circulation for chassis cooling. Do not obstruct this vent. 2. Ground stud two-post stud used to ground the chass...

  • Page 18: Pa-7080 Front Panel (Dc)

    Pa-7080 front and back panel descriptions 18 • pa-7000 series firewall overview palo alto networks pa-7080 front panel (dc) figure 7 shows the front panel of the pa-7080 firewall with dc power supplies installed. Note: the front ac and dc power supplies are almost identical, but they are keyed diffe...

  • Page 19

    Palo alto networks pa-7000 series firewall overview • 19 pa-7080 front and back panel descriptions figure 7. Front panel (dc).

  • Page 20: Pa-7080 Back Panel (Dc)

    Pa-7080 front and back panel descriptions 20 • pa-7000 series firewall overview palo alto networks pa-7080 back panel (dc) figure 4 shows the back panel of the pa-7080 firewall. Note: the only differences between the back panel ac platform and the back panel dc platform is that the dc platform has t...

  • Page 21

    Palo alto networks pa-7000 series firewall overview • 21 pa-7080 front and back panel descriptions figure 8. Back panel (dc).

  • Page 22

    Pa-7080 front and back panel descriptions 22 • pa-7000 series firewall overview palo alto networks.

  • Page 23: Chapter 2

    Palo alto networks pa-7000 series module and interface card information • 23 chapter 2 pa-7000 series module and interface card information the pa-7000 series firewalls are modular systems and requires a minimum set of front slot cards. The required cards include the switch management card (smc), lo...

  • Page 24: Switch Management Card (Smc)

    Switch management card (smc) 24 • pa-7000 series module and interface card information palo alto networks switch management card (smc) the pa-7000 series switch management card (smc) provides switch fabric management for the chassis and provides system management access. It also includes ports for h...

  • Page 25

    Palo alto networks pa-7000 series module and interface card information • 25 switch management card (smc) table 5. Switch management card features item description 1. Ha1-a ethernet 10/100/1000mbps port for high availability (ha) control and synchronization. Connect this port directly from ha1-a por...

  • Page 26

    Switch management card (smc) 26 • pa-7000 series module and interface card information palo alto networks 5. Hsci-a (high speed chassis interconnect) quad port sfp+ (qsfp+) interface used to connect two pa-7000 series firewalls for a high availability (ha) configuration. Each port is comprised of fo...

  • Page 27: Interpreting The Smc Leds

    Palo alto networks pa-7000 series module and interface card information • 27 switch management card (smc) interpreting the smc leds the following describes how to interpret the led dashboard located on the switch management card (smc). Figure 11. Smc leds table 6. Functions and states of the smc led...

  • Page 28

    Switch management card (smc) 28 • pa-7000 series module and interface card information palo alto networks alm (alarm) red there is a hardware failure, which may include the following: • voltage issue. • power supply detected but not operational. • fan failure. • hard drive failure. • temperature abo...

  • Page 29

    Palo alto networks pa-7000 series module and interface card information • 29 switch management card (smc) table 9. Functions and states of the smc hsci-a and hsci-b port leds led description left the led is solid green if there is a network link. Because this interface is comprised of four 10gbps li...

  • Page 30: Log Processing Card (Lpc)

    Log processing card (lpc) 30 • pa-7000 series module and interface card information palo alto networks log processing card (lpc) the log processing card (lpc) is a dedicated card with a processor, memory, and storage drives used to handle all logging functions for a pa-7000 series firewall. The lpc ...

  • Page 31: Interpreting The Amc Leds

    Palo alto networks pa-7000 series module and interface card information • 31 log processing card (lpc) interpreting the amc leds the following describes how to interpret the leds located on the front of the amc. The log processing card (lpc) does not have leds. If there is a hardware issue with the ...

  • Page 32: Pa-7000 20G Npc

    Network processing cards (npcs) 32 • pa-7000 series module and interface card information palo alto networks network processing cards (npcs) network processing cards (npcs) provide network connectivity for a pa-7000 series firewall. To scale performance and capacity, you can install up to six npcs i...

  • Page 33

    Palo alto networks pa-7000 series module and interface card information • 33 network processing cards (npcs) pa-7000 20g npc component descriptions figure 13. Pa-7000 20g npc version 1 figure 14. Pa-7000 20g npc version 2 table 12. Pa-7000 20g npc features item description 1. Ethernet ports 12 rj-45...

  • Page 34

    Network processing cards (npcs) 34 • pa-7000 series module and interface card information palo alto networks interpreting the pa-7000 20g npc leds the following describes how to interpret the led dashboard located on the pa-7000 20g network processing card (npc). Figure 15. Npc leds table 15. Functi...

  • Page 35: Pa-7000 20Gxm Npc

    Palo alto networks pa-7000 series module and interface card information • 35 network processing cards (npcs) pa-7000 20gxm npc the difference between this npc and the “pa-7000 20g npc” on page 32 is that the pa-7000 20g npc supports up to four million sessions and the pa-7000 20gxm npc supports up t...

  • Page 36

    Network processing cards (npcs) 36 • pa-7000 series module and interface card information palo alto networks interpreting the pa-7000 20gq npc leds the following describes how to interpret the led dashboard located on the pa-7000 20gq network processing card (npc). Figure 18. Npc leds table 16. Pa-7...

  • Page 37: Pa-7000 20Gqxm Npc

    Palo alto networks pa-7000 series module and interface card information • 37 network processing cards (npcs) pa-7000 20gqxm npc the difference between this npc and the “pa-7000 20gq npc” on page 35 is that the pa-7000 20gq npc supports up to four million sessions and the pa-7000 20gqxm npc supports ...

  • Page 38

    Network processing cards (npcs) 38 • pa-7000 series module and interface card information palo alto networks identify npc port activity and link leds figure 20 shows how to identify the activity and link leds for the port types available on pa-7000 series firewall npcs. The illustration shows the po...

  • Page 39: Chapter 3

    Palo alto networks install the pa-7000 series firewall • 39 tamper proof statement chapter 3 install the pa-7000 series firewall the pa-7000 series firewalls are designed for installation in a standard 19-inch rack in a mid-mount or front-mount position. Before you unpack the hardware, ensure that y...

  • Page 40: Before You Begin

    Before you begin 40 • install the pa-7000 series firewall palo alto networks before you begin • before installing the hardware, read the information in “rack install safety information” on page 40 and “cautions and warnings related to working with the hardware” on page 89. • wear the provided electr...

  • Page 41: Rack Installation

    Palo alto networks install the pa-7000 series firewall • 41 rack installation rack installation the following topics describe how to install a pa-7050 or pa-7080 firewall into a 19-inch equipment rack: • “rack mount a pa-7050 firewall” on page 41 • “rack mount a pa-7080 firewall” on page 46 rack mou...

  • Page 42

    Rack installation 42 • install the pa-7000 series firewall palo alto networks 2. Position the chassis into the rack using two or more people and if available, use a mechanical equipment lift. 3. Align the rack-mount bracket mounting holes on each side of the chassis with the holes on the rack rail, ...

  • Page 43

    Palo alto networks install the pa-7000 series firewall • 43 rack installation figure 23. Remove the pa-7050 bracket screws b. Remove the front brackets (a and b) and back brackets (c and d) from the chassis as shown in figure 24. The back brackets (c and d) are not needed in this configuration. Figu...

  • Page 44

    Rack installation 44 • install the pa-7000 series firewall palo alto networks c. Swap the front brackets, so the rack mount screw holes are now on the front of the chassis as shown in figure 25. Use 25 screws to attach each bracket to the chassis in the front position. Figure 24 shows how you swap b...

  • Page 45

    Palo alto networks install the pa-7000 series firewall • 45 rack installation 3. Position the chassis into the rack using two or more people and if available, use a mechanical equipment lift. 4. Align the mounting holes on the side of the chassis with holes in the rack rail, ensuring that the chassi...

  • Page 46

    Rack installation 46 • install the pa-7000 series firewall palo alto networks rack mount a pa-7080 firewall this section describes how to install the pa-7080 firewall in a 19-inch rack in a mid-mount or front-mount position. • “mid-mount rack installation” on page 46 • “front-mount installation” on ...

  • Page 47

    Palo alto networks install the pa-7000 series firewall • 47 rack installation bracket as shown in the illustration. Figure 29. Install the pa-7080 cable management brackets 3. Position the chassis into the rack using two or more people and if available, use a mechanical equipment lift. 4. Align the ...

  • Page 48

    Rack installation 48 • install the pa-7000 series firewall palo alto networks figure 30. Secure the pa-7080 firewall to the rack 5. Proceed to “install the mandatory front slot cards” on page 52..

  • Page 49

    Palo alto networks install the pa-7000 series firewall • 49 rack installation front-mount installation the following describes how to install the pa-7080 firewall in a mid-mount position. Both rack-mount bracket types (mid-mount and front-mount) are preinstalled. For a front-mount install, you must ...

  • Page 50

    Rack installation 50 • install the pa-7000 series firewall palo alto networks figure 32. Install the pa-7080 cable management brackets 3. Position the chassis into the rack using two or more people and if available, use a mechanical equipment lift. 4. Align the rack-mount bracket mounting holes on e...

  • Page 51

    Palo alto networks install the pa-7000 series firewall • 51 rack installation figure 33. Secure the pa-7080 firewall in the front-mount position 5. Proceed to “install the mandatory front slot cards” on page 52..

  • Page 52

    Install the mandatory front slot cards 52 • install the pa-7000 series firewall palo alto networks install the mandatory front slot cards the pa-7000 series firewalls require a minimum of three cards that you install in the front slots of the chassis. These cards are shipped separately from the chas...

  • Page 53

    Palo alto networks install the pa-7000 series firewall • 53 install the mandatory front slot cards figure 34. Install or remove the smc and npc cards on a pa-7050 firewall 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 pa-7000-2 0g-npc pa-7050-s mc alm f p pa-705 0 smc smc npc smc.

  • Page 54

    Install the mandatory front slot cards 54 • install the pa-7000 series firewall palo alto networks figure 35. Install or remove the smc on a pa-7080 firewall 4. Close the handles and ensure that the smc fully seats into the smc slot. 5. Tighten the thumb screws on each side of the smc to secure it t...

  • Page 55

    Palo alto networks install the pa-7000 series firewall • 55 install the mandatory front slot cards install the log processing card (lpc) the log processing card (lpc) is required for chassis operation and the same lpc model is used in both the pa-7050 and pa-7080 firewalls. On a pa-7050 firewall, yo...

  • Page 56

    Install the mandatory front slot cards 56 • install the pa-7000 series firewall palo alto networks figure 36. Pa-7050 lpc install or remove illustration 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 pa-705 0 smc smc.

  • Page 57

    Palo alto networks install the pa-7000 series firewall • 57 install the mandatory front slot cards figure 37. Pa-7080 lpc install or remove illustration 4. Tighten the thumb screws on each side of the lpc to secure it to the chassis. Use a phillips-head screwdriver if necessary. 5. Ensure that the h...

  • Page 58

    Install the mandatory front slot cards 58 • install the pa-7000 series firewall palo alto networks figure 38. Installing an amc into the lpc 7. Proceed to “install a network processing card (npc)” on page 59. After you power on the chassis for the first time, the firewall will format the drives and ...

  • Page 59

    Palo alto networks install the pa-7000 series firewall • 59 install the mandatory front slot cards install a network processing card (npc) you can install up to 6 npcs in a pa-7050 firewall and up to 10 npcs in a pa-7080 firewall to expand port density and throughput. On a pa-7050 firewall, you inst...

  • Page 60

    Install the mandatory front slot cards 60 • install the pa-7000 series firewall palo alto networks figure 39. Install or remove a version 1 npc in a pa-7050 firewall 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 pa-7000-2 0g-npc pa-7050-s mc alm f p pa-705 0 smc smc npc smc.

  • Page 61

    Palo alto networks install the pa-7000 series firewall • 61 install the mandatory front slot cards figure 40. Install or remove a version 2 npc in a pa-7050 firewall.

  • Page 62

    Install the mandatory front slot cards 62 • install the pa-7000 series firewall palo alto networks figure 41. Install or remove a version 2 npc in a pa-7080 firewall 3. Tighten the screws on each side of the card to secure the card to the chassis. The version 1 npc uses a standard phillips-head scre...

  • Page 63

    Palo alto networks install the pa-7000 series firewall • 63 install the mandatory front slot cards install an npc in a high availability (ha) configuration with all palo alto networks firewalls, the platform hardware must match when configuring two firewalls in an ha pair. When configuring pa-7000 s...

  • Page 64

    Install the mandatory front slot cards 64 • install the pa-7000 series firewall palo alto networks configure a log card port on a pa-7000 series firewall after the firewall is installed and powered on, configure a log card port if the configuration contains log forwarding or wildfire ™ forwarding. Y...

  • Page 65

    Palo alto networks install the pa-7000 series firewall • 65 install the mandatory front slot cards configure session distribution on a pa-7000 series firewall after the firewall is installed and powered on, you can review the available session distribution policies to determine if it make sense for ...

  • Page 66

    Install the mandatory front slot cards 66 • install the pa-7000 series firewall palo alto networks table 20. View and modify session distribution settings ingress-slot (default) session processing for a given session stays on the same npc on which the session arrived (the session is initially sent t...

  • Page 67

    Palo alto networks install the pa-7000 series firewall • 67 install the mandatory front slot cards change the session distribution policy. Username@hostname> set session distribution-policy session-load> for example, to specify the round-robin policy, enter the following command: admin@pa-7080> set ...

  • Page 68: Power Configuration Options

    Connect power to a pa-7000 series firewall 68 • install the pa-7000 series firewall palo alto networks connect power to a pa-7000 series firewall the following topics describe the pa-7050 and pa-7080 firewall power configuration options, how to determine power requirements based on your hardware con...

  • Page 69

    Palo alto networks install the pa-7000 series firewall • 69 connect power to a pa-7000 series firewall figure 42. Pa-7080 ac and dc power supplies ac front ac rear dc rear dc front key to prevent installation of this ac power supply in a dc chassis key to prevent installation of this dc power supply...

  • Page 70

    Connect power to a pa-7000 series firewall 70 • install the pa-7000 series firewall palo alto networks determine power configuration requirements the number of active power supplies required to operate a pa-7000 series firewall depends on the power input that you connect to the power supplies (120va...

  • Page 71

    Palo alto networks install the pa-7000 series firewall • 71 connect power to a pa-7000 series firewall connect ac power to a pa-7050 firewall this topic describes how to connect power to a pa-7050 firewall with ac power supplies installed. The power supplies require 120vac 15-amp or 240vac 20-amp po...

  • Page 72

    Connect power to a pa-7000 series firewall 72 • install the pa-7000 series firewall palo alto networks 10. Proceed to “connect cables to a pa-7000 series firewall” on page 82. Figure 44. Pa-7050 ac power connection connect dc power to a pa-7050 firewall this topic describes how to connect power to d...

  • Page 73

    Palo alto networks install the pa-7000 series firewall • 73 connect power to a pa-7000 series firewall 5. Connect the two-post lug connector to the two-post studs on the chassis using the provided star washers and nuts and then torque the nuts to 50 in-lbs. Be careful not to strip the nuts and lug s...

  • Page 74

    Connect power to a pa-7000 series firewall 74 • install the pa-7000 series firewall palo alto networks figure 46. Connect the pa-7050 dc power cable connect ac power to a pa-7080 firewall this topic describes how to connect power to a pa-7080 firewall with ac power supplies installed. The power supp...

  • Page 75

    Palo alto networks install the pa-7000 series firewall • 75 connect power to a pa-7000 series firewall figure 47. Pa-7080 ground cable connection 7. Connect the first two power supplies (pem a power inlets 1 and 2) to the appropriate (120vac 15-amp circuit breaker or 240vac 20-amp) circuit breaker u...

  • Page 76

    Connect power to a pa-7000 series firewall 76 • install the pa-7000 series firewall palo alto networks figure 48. Pa-7080 ac power connection circuit breaker a circuit breaker b.

  • Page 77

    Palo alto networks install the pa-7000 series firewall • 77 connect power to a pa-7000 series firewall connect dc power to a pa-7080 firewall this topic describes how to connect power to dc power supplies in a pa-7080 firewall. The power supplies require -40vdc to -60vdc power input. For details on ...

  • Page 78

    Connect power to a pa-7000 series firewall 78 • install the pa-7000 series firewall palo alto networks figure 49. Pa-7080 ground cable connection 6. While facing the back of the chassis, remove the plastic covers that protect the dc power connections for pem a (1 and 2) and pem b (1 and 2). 7. Remov...

  • Page 79

    Palo alto networks install the pa-7000 series firewall • 79 connect power to a pa-7000 series firewall 9. Power off your dc power feed. 10. Connect a positive cable (red) from your power source to the two-post rtn studs for pem a 1 and then connect a negative cable (black) from your power source to ...

  • Page 80

    Connect power to a pa-7000 series firewall 80 • install the pa-7000 series firewall palo alto networks view firewall power statistics this topic provides details on how to view active power statistics on a pa-7000 series firewall.You can view the power that each power supply is producing and the pow...

  • Page 81

    Palo alto networks install the pa-7000 series firewall • 81 connect power to a pa-7000 series firewall as indicated in the last row of table 22, the four 2500 watt power supplies provide 10000 watts and the installed hardware components (smc, lpc, and npcs) use 3740 watts. If you subtract 3,740 from...

  • Page 82

    Connect cables to a pa-7000 series firewall 82 • install the pa-7000 series firewall palo alto networks connect cables to a pa-7000 series firewall after you connect power to the firewall, you then connect the mgt port directly to your management computer or management network so you can configure t...

  • Page 83

    Palo alto networks install the pa-7000 series firewall • 83 connect cables to a pa-7000 series firewall figure 51. Pa-7050 cable connections management console ha1 ha1 backup network network sfp sfp+ ha2/ha3 qsfp ha2/ha3 qsfp pa-7050 4 smc 4 smc.

  • Page 84

    Connect cables to a pa-7000 series firewall 84 • install the pa-7000 series firewall palo alto networks pa-7080 cable connections console ha1 ha1 backup sfp sfp+ ha2/ha3 qsfp ha2/ha3 qsfp backup management network network.

  • Page 85: Verify The Lpc Configuration

    Palo alto networks install the pa-7000 series firewall • 85 verify the pa-7000 series lpc and npc configuration verify the pa-7000 series lpc and npc configuration after you install the front-slot cards and power on the pa-7000 series firewall (described in “connect power to a pa-7000 series firewal...

  • Page 86: Verify The Npc Configuration

    Verify the pa-7000 series lpc and npc configuration 86 • install the pa-7000 series firewall palo alto networks the output also shows the model, size, status, and the amc serial number. Table 23 describes the possible status levels for a drive. For information on replacing a failed drive and command...

  • Page 87

    Palo alto networks install the pa-7000 series firewall • 87 verify the pa-7000 series lpc and npc configuration for more information on installing npcs, see “replace a pa-7000 series network processing card (npc)” on page 133 and for information on slot status indicators, see “pa-7000 series front s...

  • Page 88

    Verify the pa-7000 series lpc and npc configuration 88 • install the pa-7000 series firewall palo alto networks.

  • Page 89: Chapter 4

    Palo alto networks service the pa-7000 series hardware • 89 cautions and warnings related to working with the hardware chapter 4 service the pa-7000 series hardware the following information describes how to replace the field serviceable components on a pa-7000 series firewall. For an overview of th...

  • Page 90

    Cautions and warnings related to working with the hardware 90 • service the pa-7000 series hardware palo alto networks french translation: un pare-feu pa-7000 series configuré avec des blocs d'alimentation c.A. Peut fonctionner de 100 à 240 v c.A., 50/60 hz, à 20 a maximum. Ne branchez pas une tensi...

  • Page 91: Hardware Warnings

    Palo alto networks service the pa-7000 series hardware • 91 cautions and warnings related to working with the hardware hardware warnings • to reduce the risk of electric shock, disconnect all power supply cords before servicing the firewall. French translation: pour réduire le risque de choc électri...

  • Page 92

    Cautions and warnings related to working with the hardware 92 • service the pa-7000 series hardware palo alto networks adjacentes par exemple) que tout autre équipement doté d'un raccordement entre le conducteur mis à la terre du même circuit d'alimentation c.C. Et le conducteur de mise à la terre, ...

  • Page 93

    Palo alto networks service the pa-7000 series hardware • 93 replace a pa-7000 series ac or dc power supply replace a pa-7000 series ac or dc power supply the following topics describe how to interpret the power supply leds and how to replace a pa-7000 series power supply: • “interpret the pa-7000 se...

  • Page 94

    Replace a pa-7000 series ac or dc power supply 94 • service the pa-7000 series hardware palo alto networks pa-7080 power supply leds table 26 describes the pa-7080 ac power supply leds and table 27 describes the pa-7080 dc power supply leds. The descriptions are in order of the leds as displayed in ...

  • Page 95

    Palo alto networks service the pa-7000 series hardware • 95 replace a pa-7000 series ac or dc power supply replace a pa-7000 series ac power supply • “replace a pa-7050 ac power supply” on page 95 • “replace a pa-7080 ac power supply” on page 96 replace a pa-7050 ac power supply 1. Read “cautions an...

  • Page 96

    Replace a pa-7000 series ac or dc power supply 96 • service the pa-7000 series hardware palo alto networks figure 52. Remove or install an ac power supply from a pa-7050 firewall 7. Remove the replacement power supply from the packaging and open the front ejector handle until it is fully open. 8. Sl...

  • Page 97

    Palo alto networks service the pa-7000 series hardware • 97 replace a pa-7000 series ac or dc power supply 3. Locate the failed power supply by viewing the system logs or by viewing the led on the front of the power supply. A red led indicates a failed power supply. For details on the power supply l...

  • Page 98

    Replace a pa-7000 series ac or dc power supply 98 • service the pa-7000 series hardware palo alto networks the door, it properly seats the power supply. 8. Plug the power cable into the corresponding ac power module on the back of the chassis and turn on the power switch. The new power supply will t...

  • Page 99

    Palo alto networks service the pa-7000 series hardware • 99 replace a pa-7000 series ac or dc power supply replace a pa-7000 series dc power supply • “replace a pa-7050 dc power supply” on page 99 • “replace a pa-7080 dc power supply” on page 101 replace a pa-7050 dc power supply 1. Read “cautions a...

  • Page 100

    Replace a pa-7000 series ac or dc power supply 100 • service the pa-7000 series hardware palo alto networks figure 54. Remove a pa-7050 dc power supply 8. Remove the replacement power supply from the packaging and open the front ejector handle until it is fully open. 9. Slide the new power supply in...

  • Page 101

    Palo alto networks service the pa-7000 series hardware • 101 replace a pa-7000 series ac or dc power supply figure 55. Install a pa-7050 dc power supply 10. Tighten the upper left screw on the power supply to secure the power supply. 11. Insert the dc power cable back into the power supply ensuring ...

  • Page 102

    Replace a pa-7000 series ac or dc power supply 102 • service the pa-7000 series hardware palo alto networks 3. Locate the failed power supply by viewing the system logs or by viewing the led on the front of the power supply. A red led indicates a failed power supply. For details on the power supply ...

  • Page 103: Replace A Pa-7080 Dc Pem

    Palo alto networks service the pa-7000 series hardware • 103 replace a pa-7080 dc pem door, it pulls the power supply inward and seats it into place. 8. Plug the power cable into the corresponding ac power module on the back of the chassis and turn on the power switch. Replace a pa-7080 dc pem the d...

  • Page 104

    Replace a pa-7080 dc pem 104 • service the pa-7000 series hardware palo alto networks figure 57. Remove a pa-7080 dc pem 6. Remove the failed pem from the chassis using the handles on each side of the pem. 7. Carefully slide the replacement pem into the pem slot and secure it with the eight screws. ...

  • Page 105

    Palo alto networks service the pa-7000 series hardware • 105 replace a pa-7000 series lpc drive replace a pa-7000 series lpc drive the log processing card (lpc) contains four advanced mezzanine cards (amcs) used to house one 2.5” sata drive each. The first two drives (a1 and a2) are configured in a ...

  • Page 106

    Replace a pa-7000 series lpc drive 106 • service the pa-7000 series hardware palo alto networks figure 58. Amc release handle operation figure 59. Replace an amc/drive 5. Remove the replacement drive from the packaging and compare the drive model on the label with the drive model of the failed drive...

  • Page 107

    Palo alto networks service the pa-7000 series hardware • 107 replace a pa-7000 series lpc drive b. Install the replacement drive by gently sliding it into the empty amc slot (slot a2 in this example) and then push the release handle inward until it stops to lock the amc to the lpc. C. Add the replac...

  • Page 108

    Replace a pa-7000 series lpc drive 108 • service the pa-7000 series hardware palo alto networks disk pair s7a available status clean, degraded disk id a1 present model : st91000640ns size : 953869 mb status : not in use card serial : 002901000061 disk id a2 present model : st1000nx0423 size : 953869...

  • Page 109

    Palo alto networks service the pa-7000 series hardware • 109 increase log capacity on a pa-7000 series firewall increase log capacity on a pa-7000 series firewall the pa-7000 series firewall ships with four 1tb drives installed in the log processing card (lpc) and each drive pair (a1/a2 and b1/b2) i...

  • Page 110

    Increase log capacity on a pa-7000 series firewall 110 • service the pa-7000 series hardware palo alto networks model : st91000640ns size : 953869 mb status : active sync card serial : 002901000237 disk id b2 present model : st91000640ns size : 953869 mb status : active sync card serial : 0029010003...

  • Page 111

    Palo alto networks service the pa-7000 series hardware • 111 increase log capacity on a pa-7000 series firewall figure 60. Amc release handle operation figure 61. Replace an amc/drive c. Remove a new 2tb drives from the packaging and pull the amc handle out to prepare it for installation into the lp...

  • Page 112

    Increase log capacity on a pa-7000 series firewall 112 • service the pa-7000 series hardware palo alto networks e. To view the status of the copy process, run the following command: admin@pa-7080> show system raid detail continue running this command to view the raid detail output until you see that...

  • Page 113

    Palo alto networks service the pa-7000 series hardware • 113 increase log capacity on a pa-7000 series firewall 5. Upgrade the firewall from 1tb to 2tb drives if the firewall is running pan-os 7.0.7 or earlier: a. To remove the first two 1tb drives (a1 and a2 in this example) from the raid 1 array, ...

  • Page 114

    Increase log capacity on a pa-7000 series firewall 114 • service the pa-7000 series hardware palo alto networks figure 62. Amc release handle operation figure 63. Replace an amc/drive c. Remove two 2tb drives from their packaging and pull the amc handle out on each drive to prepare them for installa...

  • Page 115

    Palo alto networks service the pa-7000 series hardware • 115 increase log capacity on a pa-7000 series firewall e. View the status of the array configuration to confirm that the new array was created. Admin@pa-7080> show system raid detail the following output shows that the s7a array is available. ...

  • Page 116: Replace A Pa-7050 Fan Tray

    Replace a pa-7000 series fan tray 116 • service the pa-7000 series hardware palo alto networks replace a pa-7000 series fan tray if one fan on a fan tray fails, the fault led on the fan tray will turn red. If this occurs, replace the fan tray immediately to avoid service interruption. If a two or mo...

  • Page 117

    Palo alto networks service the pa-7000 series hardware • 117 replace a pa-7000 series fan tray figure 64. Loosen the thumb screws to unlock the fan tray 6. Grasp the fan tray handles and pull the tray out about two inches. After all working fans have stopped spinning, remove the fan tray from the ch...

  • Page 118

    Replace a pa-7000 series fan tray 118 • service the pa-7000 series hardware palo alto networks figure 65. Install a pa-7050 fan tray 9. Verify that the fan tray is operational by noting the status of the fan tray leds and the fan led on the smc (slot 4). The fault led on the fan tray turns off, the ...

  • Page 119: Replace A Pa-7080 Fan Tray

    Palo alto networks service the pa-7000 series hardware • 119 replace a pa-7000 series fan tray replace a pa-7080 fan tray 1. Read “cautions and warnings related to working with the hardware” on page 89. 2. Put the provided esd wrist strap on your wrist ensuring that the metal contact is touching you...

  • Page 120

    Replace a pa-7000 series fan tray 120 • service the pa-7000 series hardware palo alto networks figure 66. Remove the pa-7080 fan tray 6. Verify that the front set of fans have stopped spinning and then continue to pull the fan tray outward while supporting the back of the tray. Note that the fan tra...

  • Page 121

    Palo alto networks service the pa-7000 series hardware • 121 replace a pa-7000 series air filter 8. Verify that the fan tray is operational by noting the status of the fan tray leds and the fan led on the smc (slot 6). The fault led on the fan tray turns off, the power led on the fan tray illuminate...

  • Page 122

    Replace a pa-7000 series air filter 122 • service the pa-7000 series hardware palo alto networks figure 67. Replace a pa-7050 air filter 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 fault pa-7000 -blank pa-7000-amc-itb power activity fault 1 3 5 7 9 11 2 4 6 8 10 12 14 16 18 20 22 24 13 15 17 19 21 23 pa-7000-am...

  • Page 123

    Palo alto networks service the pa-7000 series hardware • 123 replace a pa-7000 series air filter figure 68. Replace a pa-7080 air filter gride side faces up..

  • Page 124

    Replace a pa-7000 series front slot card 124 • service the pa-7000 series hardware palo alto networks replace a pa-7000 series front slot card the pa-7000 series firewalls require one switch management card (smc), one log processing card (lpc), and at least one network processing card (npc). The pro...

  • Page 125

    Palo alto networks service the pa-7000 series hardware • 125 replace a pa-7000 series front slot card figure 69. Install or remove a pa-7050 smc 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 pa-7000-2 0g-npc pa-7050-s mc alm f p pa-705 0 smc smc npc smc.

  • Page 126

    Replace a pa-7000 series front slot card 126 • service the pa-7000 series hardware palo alto networks figure 70. Install or remove a pa-7080 smc 6. Remove the replacement smc from the antistatic bag and slide it into the smc slot, ensuring that the handles are in the open position. When the card is ...

  • Page 127

    Palo alto networks service the pa-7000 series hardware • 127 replace a pa-7000 series front slot card replace a pa-7000 series log processing card (lpc) if the lpc fails, the chassis reboots and will attempt to recover the lpc. If the lpc continues to fail and the chassis reboots more than 3 times i...

  • Page 128

    Replace a pa-7000 series front slot card 128 • service the pa-7000 series hardware palo alto networks figure 71. Remove or install an lpc in a pa-7050 firewall 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 pa-705 0 smc smc.

  • Page 129

    Palo alto networks service the pa-7000 series hardware • 129 replace a pa-7000 series front slot card figure 72. Remove or install an lpc on a pa-7080 firewall 7. Remove the new lpc from the antistatic bag. Slide the lpc into the lpc slot, ensuring that the handles are in the open position. When the...

  • Page 130

    Replace a pa-7000 series front slot card 130 • service the pa-7000 series hardware palo alto networks re-index the lpc drives if you reuse the drives from a failed log processing card (lpc) when installing a new lpc, you must install the drives in the same order in which they were removed from the o...

  • Page 131

    Palo alto networks service the pa-7000 series hardware • 131 replace a pa-7000 series front slot card 5. Monitor the indexing progress. This process may take several hours, depending on the amount of data on the drives. Run the following commands to view the progress log for the first logical raid p...

  • Page 132

    Replace a pa-7000 series front slot card 132 • service the pa-7000 series hardware palo alto networks edm-vsys5-sec-pol-2 allow edm-vwire-vsys5 135 10.5.40.161 aged-out you can also use the web interface to view logs. For example, to view the traffic logs, select monitor > logs > traffic..

  • Page 133

    Palo alto networks service the pa-7000 series hardware • 133 replace a pa-7000 series front slot card replace a pa-7000 series network processing card (npc) if a network processing card (npc) fails, the card will reboot and attempt to recover. If the card does not recover, it will change to a down s...

  • Page 134

    Replace a pa-7000 series front slot card 134 • service the pa-7000 series hardware palo alto networks 4. Make note of the cable connections and then loosen the screws on each side of the npc. 5. Remove the npc using the appropriate procedure below depending on the version of the installed npc. There...

  • Page 135

    Palo alto networks service the pa-7000 series hardware • 135 replace a pa-7000 series front slot card figure 75. Install or remove a pa-7000 20g npc version 2 6. Remove the replacement npc from the antistatic bag and slide it into the empty slot, ensuring that the handles are in the open position. W...

  • Page 136

    Replace a pa-7000 series front slot card 136 • service the pa-7000 series hardware palo alto networks replace an npc in a high availability (ha) configuration when ha is configured on the firewall, the firewall is designed to allow the insertion of new network processing cards (npcs) without causing...

  • Page 137

    Palo alto networks service the pa-7000 series hardware • 137 replace a pa-7000 series front slot card 4. Make note of the cable connections and then loosen the screws on each side of the card that secure the npc to the chassis. 5. Remove the failed npc from the chassis. 6. Remove the replacement npc...

  • Page 138

    Replace a pa-7000 series front slot card 138 • service the pa-7000 series hardware palo alto networks for information on troubleshooting card slots and changing slot states, see “network processing card (npc) troubleshooting commands” on page 138. Network processing card (npc) troubleshooting comman...

  • Page 139

    Palo alto networks service the pa-7000 series hardware • 139 replace a pa-7000 series front slot card power off a slot. When using this option, the slot stays powered off, even after a chassis reboot. To power off a slot: admin@pa-7080> request chassis admin-power-off slot enable a slot, so the npc ...

  • Page 140

    Replace a pa-7000 series front slot card 140 • service the pa-7000 series hardware palo alto networks.

  • Page 141: Chapter 5

    Palo alto networks specifications • 141 physical specifications chapter 5 specifications the following topics provide chassis and component specifications for the pa-7000 series firewalls. The log processing card (lpc) and network processing cards (npcs) are universal, so you can install them in a p...

  • Page 142

    Physical specifications 142 • specifications palo alto networks chassis weight • pa-7050 firewall – chassis (ac)—111.2 lbs (50 kg) includes the chassis, two fan trays, air filter, and four power supplies. Does not include the blank slot covers, smc, npcs, or lpc. Total weight (fully loaded)— 187.4 l...

  • Page 143

    Palo alto networks specifications • 143 physical specifications chassis component weights • switch management card (smc) – pa-7050 firewall—11 lbs (4k g 989.52 g) – pa-7080 firewall—12.5 lbs (5 kg 669.90 g) • network processing card (npc) – 9.4 lbs (4 kg 263.77 g) • log processing card (lpc) – lpc o...

  • Page 144: Electrical Specifications

    Electrical specifications 144 • specifications palo alto networks electrical specifications • “component electrical specifications” on page 144 • “power cord types” on page 146 component electrical specifications this table describes the power supply output and rated power consumption for the pa-700...

  • Page 145

    Palo alto networks specifications • 145 electrical specifications pa-7080-pwr25-ac • input voltage 100-240vac (50-60 hz) • output voltage +2500 watts @ 240vac +1200 watts@ 120vac pa-7080-pwr25-dc • input voltage -40 to -60vdc • output voltage +2500 watts table 31. Pa-7000 series hardware component p...

  • Page 146: Power Cord Types

    Electrical specifications 146 • specifications palo alto networks power cord types the pa-7000 series firewalls ship with four ac or four dc power supplies by default. On the pa-7080 firewall, you can order up to four additional power supplies (eight total) and power cords are included with each ac ...

  • Page 147: Environmental Specifications

    Palo alto networks specifications • 147 environmental specifications environmental specifications table 33 lists environmental specifications for the pa-7000 series firewalls. Table 33. Environmental specifications specification value operating temperature range 0° to 50°c (32°f to 122°f) storage te...

  • Page 148

    Environmental specifications 148 • specifications palo alto networks.

  • Page 149: Chapter 6

    Palo alto networks compliance statement • 149 nebs requirements chapter 6 compliance statement this section lists the hardware compliance statements for the following: • “nebs requirements” on page 149 • “vcci statement” on page 150 • “bsmi emc statement” on page 150 nebs requirements the following ...

  • Page 150: Vcci Statement

    Vcci statement 150 • compliance statement palo alto networks vcci statement this section provides the compliance statement for the voluntary control council for interference by information technology equipment (vcci), which governs radio frequency emissions in japan. The following information is in ...