Palo Alto Networks PA-7000 PA-7050 firewall Hardware Reference Guide
The PA-7050 is a high performance modular firewall designed for large enterprise and carrier class environments. This device is capable of providing up to 120 Gbps of throughput when fully loaded with six Network Processing Cards (NPCs). It boasts full hardware redundancy in an active/passive or active/active configurations, and a dedicated log card handles all log processing, using two pairs of drives in a RAID 1 configuration to provide two terabytes of log storage. The chassis can use either AC or DC power supplies installed in the front of the chassis.
Advertisement
Advertisement
PA-7050
Hardware Reference Guide
Contact Information
http://www.paloaltonetworks.com/contact/contact/
About this Guide
This guide describes the PA-7050 firewall hardware, provides instructions on installing the hardware, describes how to perform maintenance procedures, and provides product specifications. This guide is intended for system administrators responsible for installing and maintaining the PA-7050 firewall.
All PA-7050 devices run PAN-OS, a purpose-built operating system with extensive functionality. For additional information, refer to the following resources:
•
For information on the additional capabilities and for instructions on configuring the features on the firewall, refer to https://www.paloaltonetworks.com/documentation.
•
For access to the knowledge base, complete documentation set, discussion forums, and videos, refer to https://live.paloaltonetworks.com.
•
For contacting support, for information on the support programs, or to manage your account or devices, refer to https://support.paloaltonetworks.com.
•
For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates .
•
For capacity and performance information for all Palo Alto Networks firewalls, refer to
https://www.paloaltonetworks.com/products/product-selection.html
.
To provide feedback on the documentation, please write to us at:
[email protected].
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2007–2015 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at http://www.paloaltonetworks.com/company/trademarks.html
. All other marks mentioned herein may be trademarks of their respective companies.
Revision Date: June 4, 2015
Table of Contents
10
12
PA-7050 Modules and Interface Card Overview . . . . . . . . . . . . . . . . . .
13
Switch Management Card (SMC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
Network Processing Card (NPC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18
22
Installing the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
25
25
25
26
Install the Mandatory Front Slot Cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
32
40
44
Verify the LPC and NPC Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . .
46
Maintaining the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
49
49
Replace an AC or DC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
52
Palo Alto Networks Table of Contents • 3
Replace an AMC/Disk Drive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
55
58
60
61
Replace a Switch Management Card (SMC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Replace a Network Processing Card (NPC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
71
71
72
Electrical Specifications and Power Cords . . . . . . . . . . . . . . . . . . . . . . . . . .
73
74
Compliance Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
75
75
76
76
4 • Table of Contents Palo Alto Networks
Chapter 1
Overview
The PA-7050 firewall is a high performance modular firewall designed for large enterprise and carrier class environments. The multi-blade chassis has hot-swappable line cards to enable expandability as needs grow and can provide up to 120 Gbps of throughput when fully loaded with six Network
Processing Cards (NPCs). Dedicated High Availability HA1 (control) ports are available as well as dedicated 80 gigabit (when both HSCI ports are connected) QSFP HA ports used for HA2 (data link) and HA3 (packet forwarding) to provide full hardware redundancy in an active/passive or active/active configurations. A dedicated log card handles all log processing and uses two pairs of drives, each pair in a RAID 1 configuration, to provide two terabytes of log storage. The chassis can use either AC or DC power supplies that are installed in the front of the chassis.
This chapter describes the features of the front and back panel of the PA-7050 firewall. For details on
See the following topics:
•
•
•
•
Palo Alto Networks Overview • 5
Front Panel (AC)
Front Panel (AC)
1
Figure 1 shows the front panel of the PA-7050 (AC) platform and Table 1 describes the front panel
features.
Figure 1. PA-7050 Front Panel (AC)
PA-7050-FAN
POWER
FAULT
PA-7050 PA-7050-FAN
POWER
FAULT
PA-7000-BLANK
1 1
PA-7000-BLANK
2 2
PA-7000-BLANK
3 3
PA-7050-SMC
4
SMC
HA1-A HA1-B MGT
CONSOLE HSCI-A HSCI-B
USB
PWR
STS
HA
TMP
ALM
FAN
PS
LOG
4
SMC
PA-7000-BLANK
5 5
PA-7000-BLANK
6 6
PA-7000-20G-NPC
1 3 5 7 9 11
7
8
ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
14 16 18 20
POWER
PA-7000-AMC-1TB
ACTIVITY
FAULT
PA-7000-AMC-1TB
PWR
STS
ALM
TMP
POWER
7
8
4
5
6
7
2
3
8
6 • Overview Palo Alto Networks
Front Panel (AC)
Table 1. PA-7050 (AC) Front Panel Features
Item Description
1.
Exhaust Fan Tray Hot-swappable exhaust fan tray that provides ventilation and cooling for the chassis. The fan tray is interchangeable and can be installed on either side of the chassis to perform exhaust or air intake functionality.
During normal operation, the top fan tray LED is green. If one or more fans fail on the fan tray, the green LED will go out and the red LED will illuminate.
2.
Air Intake Fan Tray
3.
Switch Management
Card (SMC)
4.
Air Filter
5.
Network Processing
Card (NPC)
6.
Log Processing Card
(LPC)
Hot-swappable air intake fan tray that provides ventilation and cooling for the chassis. The fan tray is interchangeable and can be installed on either side of the chassis to perform exhaust or air intake functionality.
During normal operation, the top fan tray LED is green. If one or more fans fail on the fan tray, the green LED will go out and the red LED will illuminate.
The SMC provides management access to the chassis using a serial console cable connected to the Console port or an RJ-45 cable connected to the
MGT port. The card also contains HA ports that provide high availability
(HA) connectivity between two chassis. LED indicators provide information on various chassis components.
IMPORTANT: The SMC must be installed in slot 4 and is required to operate the chassis.
For more information on the management interface, see “Switch
Management Card (SMC)” on page 14.
NOTE: The PAN-OS software preinstalled on the embedded Solid State
Drive (SSD) on the SMC. The SSD is not serviceable.
Replaceable air filter that provides filtering of air entering the chassis. The filter tray should be inspected periodically for cleanliness. The filter is not designed to be cleaned and it is recommended that you replace the filter every six months.
Provides data traffic connectivity.
IMPORTANT: NPCs can be installed in slots 1,2,3,5,6, and/or 7. You must have at least one NPC installed before the firewall can process data traffic.
For more information on the NPC, see “Network Processing Card (NPC)” on page 18.
The LPC manages all of the logs generated by the firewall. It contains four disk drives that are configured in two separate RAID 1 pairs to provide redundancy. Each drive is installed in an Advanced Mezzanine Card
(AMC), which connects the drive to the LPC. When replacing a drive, the
AMC/Drive is ordered and installed as one unit and is hot-swappable.
IMPORTANT: The LPC is required to operate the chassis and must be installed in slot 8.
For more information on the LPC, see “PA-7000-20GQ-NPC” on page 21.
Palo Alto Networks Overview • 7
Front Panel (AC)
Table 1. PA-7050 (AC) Front Panel Features (Continued)
Item Description
7.
AC Power Supplies
8.
Electrostatic Discharge
(ESD) ports
Provides AC power to the chassis. The chassis should always have all four power supplies operational at all times.
DC power supplies are also available for the PA-7050 and are installed in the same power supply slots as the AC power supplies. When DC power supplies are installed, the back panel AC inlets and switches are not functional and must be covered with the provided cover plate. For more
information, see “Electrical Specifications and Power Cords” on page 73.
Three ESD ports to be used when removing/installing any of the chassis hardware components. You can use any of the three ports and an ESD strap is provided.
8 • Overview Palo Alto Networks
Back Panel (AC)
Back Panel (AC)
Figure 2 shows the back panel of the PA-7050 (AC) platform and Table 2 describes the back panel
features.
Figure 2. Back Panel (AC)
1
2
3
Palo Alto Networks Overview • 9
Front Panel (DC)
Table 2. Back Panel Features (AC)
Item
1.
Grounding Lugs
2.
AC power inlets
3.
AC power switches
Description
To ground the system, use a grounding wire of at least 6 American Wire
Gauge (AWG). The 6 AWG wire must be attached to the provided copper grounding lug and crimped with the proper crimping tool. Attach one end of the grounding cable to building ground and attach the other end to the grounding lug bolts on the chassis using the provided star washers and nuts.
Four 20 amp AC power inlets. Each power inlet provides AC power to the power supplies located on the front of the chassis. Each inlet/switch corresponds to the power supply on the front of the chassis. For example, if you are facing the back of the device, the switch on the far left side provides power to the power supply on the front far right side when facing the front of the chassis.
For information on connecting AC power, see “Connect AC Power” on page 41.
Note: The AC power module that contains the inlets and power switches is not field serviceable.
Four AC on/off power switches. Each switch has a circuit breaker that will trip if the amperage reaches 25 amps.
Front Panel (DC)
Figure 3 shows the front panel of the PA-7050 (DC) platform. The only difference between the front
panel AC platform and the front panel DC platform is that the DC platform uses four DC power supplies instead of four AC power supplies. The same power supply slots are used for the AC and DC power supplies.
When DC power supplies are installed, the back panel AC inlets and switches are not functional
10 • Overview Palo Alto Networks
Front Panel (DC)
Figure 3. Front Panel (DC)
PA-7050-FAN
POWER
FAULT
PA-7000-BLANK
1
PA-7000-BLANK
2
PA-7000-BLANK
3
PA-7050-SMC
4
SMC
HA1-A HA1-B
PA-7000-BLANK
5
PA-7000-BLANK
6
PA-7000-20G-NPC
MGT
1 3 5 7 9 11
7
8
ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
CONSOLE HSCI-A HSCI-B
POWER ACTIVITY
FAULT
14 16 18 20
POWER
PA-7000-AMC-1TB
ACTIVITY
FAULT
PA-7000-AMC-1TB
PWR
STS
ALM
TMP
POWER
PA-7050 PA-7050-FAN
POWER
FAULT
USB
PWR
STS
HA
TMP
ALM
FAN
PS
LOG
1
2
3
4
SMC
5
6
7
8
Four DC Power Supplies
Palo Alto Networks Overview • 11
Back Panel (DC)
Back Panel (DC)
Figure 4 shows the back panel of the PA-7050 (DC) platform. The only differences between the back
panel AC platform and the back panel DC platform is that the DC platform will have a cover plate over the AC inlets and power switches. When using DC power supplies, the AC power cord inlets and switches are not functional. The grounding lug is utilized for both AC and DC installations. For
information on connecting power, see
Figure 4. Back Panel (DC)
Grounding Lugs AC Inlet and Power Switch Cover Plate
(Only used when DC power supplies are installed)
12 • Overview Palo Alto Networks
Chapter 2
PA-7050 Modules and Interface Card
Overview
This chapter describes modules and the interface cards that you can install in a PA-7050 firewall. The minimum cards that must be installed to operate the PA-7050 firewall is one Switch Management Card
(SMC), one Network Processing Card (NPC), and one Log Processing Card (LPC). You can install up to five additional NPCs to expand port density and processing.
Although all front slot cards have protection to prevent damage if they are installed or removed when the chassis is powered, only the NPC is intended to be hot-swapped during normal operation. The SMC and LPC should only be installed/replaced when the chassis is powered off. For details on replacing
PA-7050 hardware components, see “Maintaining the Hardware” on page 49.
Note: The SMC must be installed in slot 4, the LPC in slot 8, and NPCs can be installed in slots 1,2,3,5, 6, and/or 7.
•
“Switch Management Card (SMC)” on page 14
•
“Network Processing Card (NPC)” on page 18
•
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 13
Switch Management Card (SMC)
Switch Management Card (SMC)
The Switch Management Card (SMC) provides switch fabric and system management access to the chassis using a serial console cable connected to the Console port or an Ethernet cable connected to the
MGT port. The SMC also provides high availability (HA) connectivity between two chassis. LED indicators provide information on various components of the chassis.
IMPORTANT: The SMC must be installed in slot 4 and is required to operate the device.
•
“SMC Component Descriptions” on page 14
•
“Interpreting the SMC LEDs” on page 16
SMC Component Descriptions
Figure 5 shows the Switch Management Card (SMC) and Table 3 describes the SMC components.
Figure 5. Switch Management Card (SMC)
Lever Release Latch
1
2
3
4
5
6 7
8
PA-7050-SMC
HA1-A HA1-B MGT
CONSOLE HSCI-A HSCI-B
USB
PWR
STS
HA
TMP
ALM
FAN
PS
LOG
9
Lever Release Latch
Table 3. Switch Management Card Features
Item Description
1.
HA1-A
2.
HA1-B
3.
MGT
Ethernet 10/100/1000 port for High Availability (HA) control and synchronization. Connect this port directly from HA1-A port the first device in the pair to the HA1-A on the second device in the pair, or connect them together through a switch or router.
HA1 cannot be configured on NPC data ports or the MGT port.
Ethernet 10/100/1000 port for high-availability (HA) control and synchronization used as a backup for HA1-A. Connect this port directly from HA1-B port the first device in the pair to the HA1-B on the second device in the pair, or connect them together through a switch or router.
HA1 cannot be configured on NPC data ports or the MGT port.
Ethernet 10/100/1000 port to access the device management interfaces through an Ethernet interface. The default URL for the MGT port is https:/
/192.168.1.1. For example, change the management computer IP address to
192.168.1.2, connect directly to the MGT port and browse to the MGT IP address. You can also SSH to 192.168.1.1. The default login name and password is admin/admin.
14 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Switch Management Card (SMC)
Table 3. Switch Management Card Features (Continued)
Item Description
4.
Console
5.
HSCI-A
(High Speed Chassis
Interconnect)
One RJ-45 port for connecting a serial console for device management using the CLI.
The console connection is a standard RS-232 type. The following shows the pin-outs:
Signal ------- DB-9 ----RJ45
CTS -------_---8 ----------8
DSR -----_-----6 ------_--7
RXD -----------2 ----------6
GND -----_----5 ----------5,4
TXD -----------3 ----------3
DTR -----------4 ----------2
RTS ------_----7 ----------1
Note: If the management computer does not have a serial port, a USB to serial converter can be used.
Quad Port SFP (QSFP) interfaces used to connect two PA-7050s for a
High Availability (HA) configuration. Each port is comprised of four 10 gigabit links internally for a combined speed of 40 gigabits and is used for
HA2 data link in an active/passive configuration. When in active/active mode, the port is also used for HA3 packet forwarding for asymmetrically routed sessions that require Layer 7 inspection for App-ID and Content-ID.
In a typical installation, HSCI-A on the first chassis connects directly to
HSCI-A on the second chassis and HSCI-B on the first chassis connects to
HSCI-B on the second chassis. This will provide full 80 gigabit transfer rates. In software, both ports (HSCI-A and HSCI-B) are treated as one HA interface.
The HSCI ports are not routable and must be connected directly to each other.
HA2 (data link) can be configured on the HSCI ports or on NPC data ports.
6.
HSCI-B
(High Speed Chassis
Interconnect)
7.
USB
See the HSCI-A description above. The HSCI-B port is used to increase the bandwidth for HA2/HA3 purposes.
The HSCI ports are not routable and must be connected directly to each other.
HA2 (data link) can be configured on the HSCI ports or on NPC data ports.
USB port for future use.
8.
LED Indicators
9.
SMC card release hardware
Eight LEDs that indicate status for various hardware components. For
details on the LEDs, see “Interpreting the SMC LEDs” on page 16.
Levers, screws, and lever release latches used to install and remove the
SMC card. The lever release on each side slides upward to release the lever.
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 15
Switch Management Card (SMC)
Interpreting the SMC LEDs
Figure 6 shows the LED dashboard that is located on the Switch Management Card (SMC). Table 4
describes the LED functions and states of the LED dashboard, Table 5 describes the SMC SFP and Port
LEDs, Table 6 describes the SMC HA port LEDs, and Table 7 describes the HSCI ports.
Figure 6. SMC LEDs
PWR
STS
HA
TMP
ALM
FAN
PS
LOG
Table 4. Functions and States of the SMC LED Dashboard
LED State Description
PWR
(POWER)
STS
(STATUS)
HA
TMP
(Temp)
ALM
(Alarm)
FAN
PS
(Power
Supply)
Green
Off
Green
Yellow
Green
Yellow
Off
Note
Green
Yellow
Red
Off
Green
Red
Green
Red
The device is powered.
Power is off.
Device is operating normally.
Device is booting up.
Device is the current active device.
Device is the current passive device.
High availability (HA) is not enabled on this device.
The above LED status descriptions are for an Active/Passive configuration. In an Active/Active configuration, the HA LED only indicates HA status for the local device and does not indicate HA connectivity of the peer. If HA is active on the given device the LED is green; if HA is not active the LED is off.
Chassis temperature is normal.
Chassis temperature is outside the normal tolerance for one or more of the installed cards.
There is a hardware failure, which may include a voltage issue, power supply/module detected (but not working), fan failure, hard drive failure,
HA failover, or temperature above high temperature threshold.
Device is operating normally.
All fans are operating normally.
One or more fans have failed on one or both of the fan trays. To find out which fan tray has a fan failure, check the fan tray LEDs. A red LED on the fan tray will indicate that one or more fans have failed.
All AC or DC power supplies are operating normally.
One or more AC or DC power supplies has failed.
16 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Switch Management Card (SMC)
Table 4. Functions and States of the SMC LED Dashboard (Continued)
LED State Description
LOG Red LED will change to red if there is a drive failure, temperature issue, or other issue with the Log Processing Card (LPC). To determine which drive has failed, check the LEDs on each AMC/Disk drive.
Off There are no alarms present on the Log Processing Card (LPC) and the card and drives are operating normally.
Table 5. Functions and States of the SMC MGT Port LEDs
LED Description
Left
Right
Shows solid green if there is a network link.
Blinks green if there is network activity.
Table 6. Functions and States of the SMC HA1-A and HA1-B Port LEDs
LED Description
Left Shows green if there is a network link.
Right Blinks green if there is network activity.
Table 7. Functions and States of the SMC HSCI-A and HSCI-B Port LEDs
LED Description
Left
Right
Shows green if there is a network link. Because this interface is comprised of four 10 gigabit links, the LED is an AND operation of all four link states.
Blinks green if there is network activity. Because this interface is comprised of four 10 gigabit links, the LED is an OR operation of all four activity states.
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 17
Network Processing Card (NPC)
Network Processing Card (NPC)
The Network Processing Card (NPC) provides data traffic connectivity for the PA-7050 firewall and you can install up to six NPCs to expand system capacity. When viewing the NPCs from the web interface at Network > Interfaces, the NPCs are organized by slot and an icon is available to expand the slot to show all ports on the NPC. In the CLI, the first number in the interface name indicates the slot and the second number indicates the port. For example, slot 1 Ethernet port 1 will show ethernet1/
1, port 2 will show ethernet1/2, slot 2 port 1 is ethernet 2/1, port 2 is ethernet 2/2, and so on.
IMPORTANT: You can install NPCs in slots 1,2,3,5,6, and/or 7 and you must install at least one NPC to enable the firewall to process data traffic.
There are two NPC card types that you can install:
•
•
PA-7000 20G NPC
There are two versions of the PA-7000 20G NPC that provide connectivity to 20 gigabit Ethernet ports and the only difference between the two versions is the levers used to install and remove the card.
Figure 7 shows version 1 of the NPC and Figure 8 shows version 2 of the NPC.
•
“PA-7000-20G Component Descriptions” on page 18
•
“Interpreting the PA-7000 20G NPC LEDs” on page 20
PA-7000-20G Component Descriptions
Figure 7. PA-7000 20G NPC Version 1
1
PA-7000-20G-NPC
1 3 5 7 9 11
2
3
4
PWR
STS
ALM
TMP
14 16 18 20
5
6
18 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Network Processing Card (NPC)
Figure 8. PA-7000 20G NPC Version 2
PA-7000-20G-NPC
1 3 5 7 9 11 13 15 17 19 21 23
2 4 6 8
6
14 16 18 20 22 24
PWR
STS
ALM
TMP
Table 8. PA-7000 20G NPC Features
Item Description
1.
Ethernet ports
2.
SFP ports
3.
SFP+ ports
12 RJ-45 10/100/1000 ports.
Eight Small Form-Factor Pluggable (SFP) ports for network traffic.
Four SFP+ ports for network traffic.
4.
LED dashboard Four LEDs indicating NPC status. For details on the LEDs, see
“Interpreting the PA-7000 20G NPC LEDs” on page 20.
One screw on each side of the NPC to secure the NPC to the chassis.
5.
Mounting Screws
6.
NPC installation and removal hardware
• Figure 7 shows the screws, lever release latches, and ejector levers used
to install/remove a version 1 NPC card. The lever release latches on each side slides upward to release the levers used to eject the card from the chassis. The left release latch has a micro-switch that will power off the card as soon as it is moved upward to unlock the ejector lever. Only move this latch if you intend to remove the card.
• Figure 8 shows the thumb screws and levers used to install/remove a
version 2 NPC. With this version, there are thumb screws and double lever release latches on each side of the card. Each inner lever contains a micro-switch and when both inner levers are pulled outward simultaneously to release the outer ejector levers, the NPC will power off. Only move these levers if you intend to remove the card.
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 19
Network Processing Card (NPC)
Interpreting the PA-7000 20G NPC LEDs
LEDs.
Figure 9. NPC LEDs
PWR
STS
ALM
TMP
Table 9. Functions and States of the NPC LED Dashboard
LED State Description
PWR Green Card is powered.
STS
(STATUS)
ALM
(Alarm)
TMP
(Temp)
Off
Green
Yellow
Red
Off
Green
Yellow
Power is off.
Card is operating normally.
Card is booting up.
There is a hardware failure on the card.
The card is operating normally.
The NPC temperature is normal.
The NPC temperature is outside the normal tolerance.
Table 10. Functions and States of the Ethernet and SFP Port LEDs
LED Description
Left Shows green if there is a network link.
Right Blinks green if there is network activity.
Table 11. Functions and States of the SFP+ Port LEDs
LED
Left
Right
Description
Shows green if there is a network link.
Blinks green or stays green if there is transmit (TX) network activity.
20 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Network Processing Card (NPC)
PA-7000-20GQ-NPC
The PA-7000 20GQ NPC provides data connectivity to 40 gigabit Ethernet ports. Table 12 describes the
Note: The PA-7050 firewall must have PAN-OS 7.0 or later installed to use the
PA-7000-20GQ-NPC.
•
“PA-7000-20GQ Component Descriptions” on page 21
•
“Interpreting the PA-7000 20GQ NPC LEDs” on page 22
PA-7000-20GQ Component Descriptions
Figure 10. PA-7000 20GQ NPC
1
PA-7000-20GQ-NPC
2 3
4
5
Table 12. PA-7000 20GQ NPC Features
Item Description
1.
SFP+ ports 12 SFP+ ports.
2.
QSFP ports
3.
LED dashboard
Two Quad Small Form-Factor Pluggable (QSFP) 40 Gigabit Ethernet ports as defined by the IEEE 802.3ba standard.
Four LEDs indicating NPC status. For details on the LEDs, see
“Interpreting the PA-7000 20GQ NPC LEDs” on page 22.
One screw on each side of the NPC to secure the NPC to the chassis.
4.
Mounting Screws
5.
NPC installation and removal hardware
Thumb screws and levers used to install/remove the NPC. There are thumb screws and double lever release latches on each side of the card. Each inner lever contains a micro-switch and when both inner levers are pulled outward simultaneously to release the outer ejector levers, the NPC will power off. Only move these levers if you intend to remove the card.
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 21
Log Processing Card (LPC)
Interpreting the PA-7000 20GQ NPC LEDs
LEDs.
Figure 11. NPC LEDs
PWR
STS
ALM
TMP
Table 13. Functions and States of the NPC LED Dashboard
LED State Description
PWR Green Card is powered.
STS
(STATUS)
ALM
(Alarm)
TMP
(Temp)
Off
Green
Yellow
Red
Off
Green
Yellow
Power is off.
Card is operating normally.
Card is booting up.
There is a hardware failure on the card.
Card is operating normally.
NPC temperature is normal.
NPC temperature is outside the normal tolerance.
Table 14. Functions and States of the QSFP and SFP+ Port LEDs
LED Description
Left Shows green if there is a network link.
Right Blinks green or stays green if there is network activity.
Log Processing Card (LPC)
The Log Processing Card (LPC) is a dedicated card with a processor, memory, and storage drives used to handle all logging for the PA-7050 firewall. The LPC contains four Advanced Mezzanine Cards
(AMCs) used as a carrier for each drive.
When replacing a drive, the AMC/Disk drive is ordered and installed as one unit and is hot-swappable.
There is no special configuration needed for the chassis to use this card for logging.
IMPORTANT: The LPC must be installed in slot 8 and is required to operate the chassis. The LPC must also contain at least one formated AMC/drive. During normal operation, all four AMC/drives should be installed in two RAID 1 pairs.
•
“LPC and AMC Component Descriptions” on page 23
•
“Interpreting the AMC/Disk Drive LEDs” on page 23
22 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Log Processing Card (LPC)
LPC and AMC Component Descriptions
Figure 12 shows the Log Processing Card (LPC) and Advanced Mezzanine Cards (AMCs) and Table 15
describes the LPC and AMC features.
Figure 12. Log Processing Card (LPC)
1
2
3 4
ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
5
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER
Table 15. LPC and AMC features
Item Description
1.
LPC
2.
AMC
3.
Advanced Mezzanine
Card (AMC) release handle.
Log Processing Card (LPC) that processes all logs and then stores the logs on the four Advanced Mezzanine Cards (AMCs) that contain one disk drive each.
Four Advanced Mezzanine Cards (AMCs) and drives used to store all logs generated by the chassis. The AMC is a Printed Circuit Board (PCB) card that holds a disk drive and connects the drive to the LPC.
Each AMC contains one 2.5” SATA disk drive with a 1 terabyte capacity.
The first two drives on the left (Drives A1 and A2) are a RAID 1 pair and the next two drives on the right (B1 and B2) are also a RAID 1 pair for a total of 2 terabytes of log storage.
Important: Do not attempt to replace the drive on an AMC. If a drive failure occurs, contact Palo Alto Networks or your reseller for a replacement AMC that will contain the AMC and the drive as one unit.
Handle used to remove the AMC/Disk drive from the LPC card. Pull the handle toward you to unlock and remove the AMC/Disk drive.
4.
AMC/Disk drive LED panel
5.
LPC Card release hardware
Three LEDs that indicate drive activity, failure, and power. Top left is activity, bottom left is fault, and top right is power.
Release levers and screws used to install and remove the LPC card. The main lever has a similar smaller lever as part of the release mechanism that must be pulled toward you before the main lever will release the card from the slot. The left and right inner lever also has a micro-switch that will power down the card as soon as the levers are both moved to release the outer lever.
Interpreting the AMC/Disk Drive LEDs
The LPC itself does not have LEDs; the AMCs inserted into the LPC that holds the disk drives has
LEDs used for drive activity, drive failures, and power. If there is a hardware issue with the LPC, the
LOG LED on the Switch Management Card (SMC) will change to red and the system logs can also be checked for status.
Palo Alto Networks PA-7050 Modules and Interface Card Overview • 23
Log Processing Card (LPC)
Table 16 describes the functions and states of the AMC LEDs
Table 16. Functions and States of the LPC LEDs
LED State Description
Activity Green Blinks green when there is activity on the drive.
Fault
POWER
Off
Red
Off
Green
Off
No activity or powered off.
The drive is missing or faulty.
No fault or powered off.
The drive is powered.
Power is off.
24 • PA-7050 Modules and Interface Card Overview Palo Alto Networks
Tamper Proof Statement
Chapter 3
Installing the Hardware
This chapter describes the steps needed to install the PA-7050 firewall in a standard 19” 2-post or 4-post equipment rack. It is important that the steps are followed in order, which includes: installing the chassis in an equipment rack, installing the three mandatory cards required for the chassis to operate
See the following topics to install the PA-7050:
•
“Tamper Proof Statement” on page 25
•
•
“Equipment Rack Installation” on page 26
•
“Install the Mandatory Front Slot Cards” on page 32
•
•
•
“Verify the LPC and NPC Configuration” on page 46
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks have not been tampered with during shipping, verify the following upon receipt of each product:
•
The tracking number provided to you electronically when ordering the product matches the tracking number that is physically labelled on the box or crate.
•
The integrity of the tamper-proof tape used to seal the box or crate has not been compromised.
•
The warranty seals on the device itself do not show evidence of tampering. Being a modular system, please note that the PA-7050 does not have a warranty seal.
Before You Begin
•
Before installing the hardware, read the information in “Cautions and Warnings” on page 49.
•
Use two or more people to perform the rack installation using a mechanical equipment lift. To reduce the weight of the chassis, do not install the front slot cards until after you install the chassis in the rack. You can also remove the front power supplies and fan trays to reduce the weight.
•
Have a Phillips-head screwdriver available. A power screwdriver is recommended if you will be moving the mounting brackets for a 4-post rack installation.
Palo Alto Networks Installing the Hardware • 25
Equipment Rack Installation
•
Verify that the intended location has adequate air circulation and meets the temperature
requirements. See to “Environmental Specifications” on page 74.
•
Allow clear space on both sides of the device.
•
Unpack the equipment and verify that all items have been received. The PA-7050 ships on two pallets and will contain the following items:
– The first pallet includes the PA-7050 chassis, installed power supplies (AC or DC), two fan trays, the air filter, two cable management brackets, and the accessories kit.
– The second pallet will contain the following items:
› Front slot cards, which include the Switch Management Card (SMC), Log Processing Card
(LPC), and at least one Network Processing Card (NPC).
› Four AC power cords for the AC model.The DC model will have four DC power connectors and one end of the power connector connects to the DC power supply and the other end will have bare wires due to the variety of lengths and cable connections that may be required in your environment. Grounding lug that attaches to the grounding point on the back of the chassis.
› Electrostatic Discharge (ESD) wrist strip.
› Management cable and serial connector.
•
Ensure that the proper power source is available to power all four power supplies. Two circuits should be used for each pair of power supplies to provide redundancy and to allow for planned electrical circuit maintenance. A copper grounding lug is provided to connect the ground point on the back of the chassis to earth ground.
•
12mm or 1/2” socket wrench for the grounding lug.
•
Wear the provided Electrostatic Discharge strap when installing components or servicing the
PA-7050 hardware.
Equipment Rack Installation
This section describes the steps needed to install the PA-7050 firewall in a 2-post or 4-post standard 19” equipment rack. Please read the cautions, warnings, and safety guidelines located in each section.
•
“2-Post Rack Installation” on page 27
•
“4-Post Rack Installation” on page 28
The following safety guidelines apply to rack installation:
•
Elevated ambient operating temperature—If the PA-7050 is installed in a closed or multi-unit rack assembly, the ambient operating temperature of the rack environment may be greater than the ambient room temperature. Verify that the ambient temperature of the rack assembly meets the
maximum rated ambient temperature requirements listed in “Environmental Specifications” on page 74.
•
Reduced airflow—Ensure that the airflow required for safe device operation is not compromised by the rack installation.
26 • Installing the Hardware Palo Alto Networks
Equipment Rack Installation
•
Mechanical loading—Ensure that the rack-mounted device does not cause hazardous conditions due to uneven mechanical loading.
•
Circuit overloading—Ensure that the circuit that supplies power to the device is sufficiently rated
to avoid circuit overloading or excess load on supply wiring. See “Electrical Specifications and
•
Reliable earthing—Maintain reliable earthing of rack mounted equipment. Pay special attention to supply connections other than direct connections to the branch circuit (such as use of power strips).
2-Post Rack Installation
This section describes the required steps to install the PA-7050 firewall in a 2-Post rack.
Note: The PA-7050 chassis and the front slot cards (SMC, LPC, NPC) ship in separate boxes and it is recommended that you install the cards after you rack-mount the chassis. This will prevent any damage to the cards that could occur during rack mounting and will reduce the chassis weight. To further reduce the chassis weight, remove the fan trays and front power supplies.
1.
(Optional) Install the 2-post cable management brackets using the fives screws included with the bracket. In a 2-post installation, the sides of the chassis should be exposed after installing the chassis in the rack, so the brackets can also be installed after rack mounting. The following illustration shows how the 2-post cable management brackets are installed:
3
4
5
6
7
8
1
2
PA-7050-
FAN
POWER
FAULT
PA-7000-BLANK
5
6
3
4
7
8
1
2
PA-7050-
FAN
POWER
FAULT
2.
Lift the device and position it in the rack. It is recommended that two people perform this operation using a mechanical equipment lift.
3.
Align the mounting holes on the side of the device with holes in the rack rail ensuring that the chassis is level.
Palo Alto Networks Installing the Hardware • 27
Equipment Rack Installation
4.
Attach the chassis brackets to the rack using rack mount screws (not provided) and tighten with a
screwdriver. Install four screws on each side of the chassis as shown in Figure 13.
Figure 13. PA-7050 2-Post Rack Installation
7
8
3
4
SMC
5
6
1
2
PA-7050-F
AN
POWER
FAULT
PA-7000-BLANK
PA-7050
PA-7050-F
AN
POWER
FAULT
1
2
3
7
8
5
6
4-Post Rack Installation
The PA-7050 has removable rack mount brackets on each side that can be placed in a 2-post mid-mount or 4-post front mount configuration. The chassis ships in the 2-post position, so for a 4-post installation, the brackets will need to be re-positioned as described in the following section.
Note: The PA-7050 chassis and the front slot cards (SMC, LPC, NPC) ship in separate boxes and it is recommended that you install the cards after you rack-mount the chassis. This will prevent any damage to the cards that could occur during rack mounting and will reduce the chassis weight. To further reduce the chassis weight, remove the fan trays and front power supplies.
To install the PA-7050 in a grounded 19-inch 4-post rack:
1.
Move the brackets from the 2-post to 4-post mount position. The brackets are in two sections on
each side of the chassis; the front section and the back section. It is recommended that a power screwdriver is used due to the number of screws that need to be removed.
Perform the following steps to move the brackets:
28 • Installing the Hardware Palo Alto Networks
Equipment Rack Installation a.
Remove the 6 screws on each side of the chassis where the two brackets come together in the mid-mount position and then remove 25 screws to remove each of the 4 bracket (2 brackets on
each side). There is a total of 112 bracket screws (56 on each side), as shown in Figure 14.
Figure 14. PA-7050 Bracket Removal Screws
3
4
SMC
5
6
7
8
1
2
PA-7050-F
AN
POW
ER
FAULT
PA-7000-BLAN
K
PA-7050
PA-7050-F
AN
POWER
FAULT
1
2
3
4
SMC
5
6
7
8
Remove 25 screws from the back brackets.
(25 per side)
Remove 6 screws from the mid-mount section.
Remove 25 screws from the front brackets.
(25 per side) b.
Remove the front brackets (A and B) and rear brackets (C and D) from the chassis as shown in
Figure 15. Store the rear brackets because they are not needed for a 4-post installation.
Figure 15. PA-7050 Front and Rear Bracket Removal
Bracket C
Remove Back Brackets
(Not needed for 4-post)
Bracket A
5
6
7
8
1
2
PA-7050-F
AN
POWER
FAULT
PA-7000-BLANK
3
PA-705
0
PA-7050-F
AN
POWER
FAULT
1
2
3
4
SMC
5
6
7
8
Remove Front Brackets and Swap
Bracket B
Bracket D
Palo Alto Networks Installing the Hardware • 29
Equipment Rack Installation c.
Swap the front brackets, so the rack mount screw holes are now on the front of the chassis as
shown in Figure 16. Use 25 screws to attach each bracket to the chassis in the front position.
Figure 15 shows that brackets A and B are swapped. The brackets are then rotated 180 degrees,
so the screw holes line up and the rack mount holes are on the front of the chassis.
Figure 16. Attach the Front Brackets in the Front-Mount Position
5
6
7
8
PA-7050-F
AN
POWE
R
FAULT
1
2
PA-7000
-BLANK
3
PA-7050
PA-70
50-FAN
POWER
FAULT
1
2
3
4
SMC
5
6
7
8
4- Post Bracket Configuration
Install 25 screws to attach each front bracket
2.
(Optional) Install the 4-post cable management brackets using the six screws included with the bracket. In a 4-post installation, the cable management brackets install over the chassis rack mount bracket used to mount the chassis to the rack, so it is recommended that you install the cable management bracket before installing the chassis into the rack. The following illustration shows how the 4-post cable management brackets are installed:
5
6
3
4
7
8
1
2
PA-7050-F
AN
POWER
FAULT
PA-7000-BLANK
5
6
3
4
7
8
1
2
PA-7050-F
AN
POWER
FAULT
30 • Installing the Hardware Palo Alto Networks
Equipment Rack Installation
3.
(Optional) If NEBs compliance is required in your region, install a PA-7050 4-post rack mount shelf.
4.
Lift the device and position it in the rack aligning the chassis on top of the shelf. It is recommended that two people perform this function using a mechanical equipment lift.
5.
Align the mounting holes on the side of the chassis with holes in the rack rail ensuring that the chassis is level.
6.
Attach the chassis brackets to the rack using the provided rack mount screws and tighten with a
Figure 17. PA-7050 4-Post Rack Install
3
4
SMC
5
6
7
8
1
2
PA-7050-F
AN
POWER
FAULT
PA-7000-BLANK
PA-7050
PA-7050-F
AN
POWER
FAULT
1
2
3
4
SMC
5
6
7
8
Palo Alto Networks Installing the Hardware • 31
Install the Mandatory Front Slot Cards
Install the Mandatory Front Slot Cards
The PA-7050 requires a minimum of three cards that are installed in the front slots of the chassis. These cards are shipped separately from the chassis and include the following: The Switch Management Card
(SMC) provides management connectivity to the chassis and HA connectivity; the Log Processing Card
(LPC) handles all log processing and log storage for the firewall; and at least one Network Processing
Cards (NPC) must be installed before the firewall can process data traffic. Up to five more NPCs can be
added expand port density and processing. For details about these cards, see “PA-7050 Modules and
Note: Although all front slot card have protection to prevent damage if they are installed or removed when the chassis is powered, only the NPC is intended to be hot-swapped during normal operation. The SMC and LPC should only be installed/replaced when the chassis is powered off.
The following topics describe the required steps to install each card:
•
“Install the Switch Management Card (SMC)” on page 32
•
“Install the Log Processing Card (LPC)” on page 33
•
“Install a Network Processing Card (NPC)” on page 36
•
“Configure a Log Port for Log Forwarding” on page 40
Install the Switch Management Card (SMC)
The Switch Management Card (SMC) is required to operate the chassis and must be installed in slot 4.
The SMC has different size alignment pins, which prevents it from being installed in any other slot. For
information about the SMC, see “Switch Management Card (SMC)” on page 14.
1.
Ensure that the chassis is powered off and that no power cords are connected.
2.
Attach the provided ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see
3.
Remove the SMC from the anti-static bag and slide it into slot 4 ensuring that the handles are in the open position by pressing upward on the black release latches.
4.
When the cards is about 1/4” from being fully inserted, adjust the levers to align with the chassis
and then close the levers to seat the card in place as shown in Figure 18.
32 • Installing the Hardware Palo Alto Networks
Figure 18. Install/Remove the SMC and NPC Cards
Install the Mandatory Front Slot Cards
PA-7000-20G-NPC
PA-7050-SMC
3
4
SMC
5
6
1
2
7
8
ALM
F
P
PA-705
0
3
4
SMC
5
6
7
8
1
2
SMC must be Installed in slot 4
NPCs can be installed in slots 1,2,3,5,6, and/or 7
5.
Tighten the thumb screws on each side of the SMC to secure it to the chassis. Use a Phillips-head screwdriver if necessary.
Install the Log Processing Card (LPC)
The Log Processing Card (LPC) is required to operate the chassis and must be installed in slot 8. The
LPC must also contain at least one AMC/drive. During normal operation, all four AMC/drives should be installed in two RAID 1 pairs, which are automatically configured when all four drives are present and the chassis is brought up for the first time. The LPC does not ship with the AMC/Drives installed, so the LPC should be installed in the chassis first and then the AMC/Drives can then be installed into the LPC.
When the PA-7050 is initially installed, you must allow enough time for drives to be formatted and put into the RAID configuration before traffic can be processed and logged. The chassis will operate with one drive, but there will be no drive redundancy.
Initial boot and system logs are stored on the embedded SSD on the Switch Management Card (SMC) and traffic logs, threat logs, User-ID logs, and so on are stored on the LPC. Also, the auto-commit function requires the LPC, so do not perform an upgrade of PAN-OS until the LPC is ready.
For information in verifying the drive status, see “Verify the LPC Configuration” on page 46.
For information about the LPC, see “LPC and AMC Component Descriptions” on page 23.
To install the LPC and AMC/Drives:
1.
Ensure that the chassis is powered off and that no power cords are connected.
Palo Alto Networks Installing the Hardware • 33
Install the Mandatory Front Slot Cards
2.
Attach the provided ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see
3.
Remove the LPC from the anti-static bag and slide it into slot 8 ensuring that the handles are in the open position. When the card is about 1/4” from being fully inserted, adjust the levers to align with
the chassis and then close the levers to seat the card in place as shown in Figure 19.
Note: The LPC uses a double lever on each side of the card. After loosening the thumb screws, you must pull the inner lever toward you to unlock the outer lever from the chassis and then pull the outer lever to release the card from the chassis.
When installing the card, when you push the outer lever in, it will lock the inner lever. The left and right inner levers have a micro-switch that will power off the card as soon as they are pulled to unlock the outer lever.
Figure 19. LPC Install/Remove Illustration
3
4
SMC
5
6
1
2
7
8
PA-705
0
3
4
SMC
5
6
1
2
7
8
LPC must be installed in slot 8
4.
Tighten the thumb screws on each side of the LPC to secure it to the chassis. Use a Phillips-head screw driver if necessary.
34 • Installing the Hardware Palo Alto Networks
Install the Mandatory Front Slot Cards
5.
Install each of the four AMC/Drives into the four slots on the LPC. Figure 20 shows how an AMC/
Drive is installed. Ensure that the handle on the front of each AMC/Drive is pulled outward to the unlocked position before sliding it into the LPC. After an AMC/drive is installed in a slot, push the front handle in to lock it in place.
Note: The AMC/Drives can be installed in any order in the LPC slots during the initial set up of the chassis. After the chassis is powered on for the first time, the drives will be formatted and configured with two RAID 1 pairs.
Figure 20. Installing an AMC/Drive into the LPC
OWER
ACTIVI
TY
FAULT
PA-700
-AMC-1TB
ACTIVI
TY
FAULT
PA-700
-AMC-1TB
POWER
Pull this lever outward when installing and then push all the way in after the
AMC/Drive is inserted into the LPC.
This will lock the AMC/Drive in place.
Palo Alto Networks Installing the Hardware • 35
Install the Mandatory Front Slot Cards
After the chassis is powered up for the first time, the drives will be formatted and configured in a
RAID 1 configuration. The first two drives on the left (A1 and A2) will be a RAID 1 pair and the second two drives (B1 and B2) on the right will be a second RAID 1 pair. The initial formating and
RAID configuration should only take 3-4 minutes. To verify the drive configuration see “Verify the
LPC Configuration” on page 46.
Install a Network Processing Card (NPC)
The Network Processing Card (NPC) is not required to operate the chassis, but you need at least one
NPC to allow the firewall to process data traffic. NPCs can be installed in slots 1,2,3,5,6, and/or 7. For
more information about NPCs, see “Network Processing Card (NPC)” on page 18.
This section describes how to install an NPC during the initial configuration of the chassis in a single chassis or in an High Availability (HA) configuration. If you are replacing a failed NPC or installing
additional NPCs, see “Replace a Network Processing Card (NPC)” on page 64. For information on
verifying the NPC configuration, see “Verify the NPC configuration” on page 47.
If an NPC is installed in slot 1, ethernet1/1 and ethernet1/2 will be configured as a virtual wire. When installed in any other slot, there is no default configuration applied to the ports.
The following sections describe the steps required to install an NPC in a single chassis or in a High
Availability (HA) configuration:
•
“Install an NPC in a Single Chassis” in the next section
•
“Install an NPC in an HA Configuration” on page 39
Install an NPC in a Single Chassis
This topic describes the required steps to install an NPC in a single PA-7050. NPCs can be installed in slots 1,2,3,5,6, and/or 7.
Note: There are two versions of the PA-7000 20G NPC and the only difference between the two versions is that the levers used to install and remove the cards are different. Version 1 uses a slide switch on each side of the card to release the ejector levers and version two does not use the slide switch, but instead uses a double lever where you pull the inner lever to unlock the outer ejector lever. The following procedure describes both NPC versions.
To install a NPC:
1.
Attach the provided ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see
2.
Remove the new NPC from the anti-static bag and partially slide it into any of the available NPC slots, ensuring that the handles are in the open position. When the card is about 1/4” from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in
place. Figure 21 shows a version 1 NPC installation/removal and Figure 22 shows a version 2
NPC. The install procedures are the same for both versions.
36 • Installing the Hardware Palo Alto Networks
Install the Mandatory Front Slot Cards
Figure 21. Installation and Removal of the SMC and a version 1 NPC
PA-7000-20G-NPC
PA-7050-S
MC
3
4
SMC
5
6
1
2
7
8
ALM
F
P
PA-705
0
3
4
SMC
5
6
7
8
1
2
NPCs can be installed in slots 1,2,3,5,6, and/or 7.
Palo Alto Networks Installing the Hardware • 37
Install the Mandatory Front Slot Cards
Figure 22. Installation and Removal of a Version 2 NPC
3.
Tighten the screws on each side of the card to secure the card to the chassis. The version 1 NPC uses a standard Phillips-head screw and the version 2 NPC uses a thumb screw that can also be tightened with a Phillips-head screw driver.
4.
Cover any empty slots with the provided blank slot covers. For example, if you initially ordered three NPCs, you will have three empty slots. Each empty slot must be covered with the provided blank slot covers to ensure proper airflow and to prevent debris from entering the chassis. The number of blank slot covers that you will receive for a new purchase is based on the number of
NPC ordered. For example, if you order one NPC there will be five empty NPC slots remaining, so you will receive five blank slot covers.
5.
Re-connect network cables.
38 • Installing the Hardware Palo Alto Networks
Install the Mandatory Front Slot Cards
Install an NPC in an HA Configuration
This topic describes the steps required to install a Network Processing Card (NPC) when two PA-7050 devices are in an HA configuration.
Note: In an HA configuration, you can add a new NPC to one of the chassis in the pair and HA will not fail over. This is done to allow time to install NPCs in both chassis. The NPCs will stay in a disabled state until a matching NPC is installed in the secondary chassis and both cards have been powered on and enabled. The cards will then be ready to use. After both NPCs are installed and functioning, if one NPC fails, an HA failover will occur.
As with all Palo Alto Networks firewalls, the hardware must match in both devices in the HA configuration, so when adding NPCs, you must install an NPC in the same slot in each chassis in the
HA pair.
Important: When installing a new NPC in a PA-7050, the HA software will manage how the NPC is brought up. When you insert the new cards into each chassis, the cards will stay in a disabled state. This will ensure that the NPCs do not initiate and start passing traffic until both cardsare enabled. The following procedures will describe how to bring up the NPCs after they are installed.
1.
Attach the provided ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see
2.
Using a Phillips-head screwdriver, remove the blank slot cover from the slot on each chassis that the NPC will be installed in. For example, if slot 3 will be used, remove the blank slot card from slot 3 on both chassis. NPCs can be installed in slots 1,2,3,5,6, and/or 7 and must match when installed in an HA pair.
3.
Insert an NPC in an available slot on the first chassis and the second NPC in the same slot number in the second chassis.
4.
Run the following command to power-on both cards in the HA pair:
request chassis power-on slot slot-number target ha-pair
For example, if you install the NPCs in slot 3 of both chassis run:
request chassis power-on slot s3 target ha-pair
This will simultaneously power-on both cards in each chassis.
Enable the NPCs by running the following command:
request chassis enable slot s3 target ha-pair
5.
You can check the status of the card in slot 3 on either chassis by running:
show chassis status slot s3
If the cards are successfully installed, the status will show an output similar to the following:
Slot ...
Component ........
Card Status
.....
Config Status
3 .....
PA-7000-20G-NPC .
Up ..............
Success
6.
Connect the network cables and the NPCs are ready to use.
Palo Alto Networks Installing the Hardware • 39
Connect Power
Configure a Log Port for Log Forwarding
If you configure log forwarding on a PA-7050 firewall or enable WildFire, after powering on the firewall, you will need to configure one available port on a Network Processing Card (NPC) with the type Log Card. This is because the traffic processing and logging capabilities of a PA-7050 firewall exceeds the capabilities of the management port, which is the port used for these services on other platforms. This special port is used by the firewall for the following functions: Syslog, Emails generated by the firewall, SNMP and WildFire file forwarding. The PA-7050 firewall also differs from other Palo
Alto Networks firewalls in regards to Panorama. In this case, Panorama queries the logs directly on the
Log Processing Card (LPC), so log forwarding is not required for Panorama. For information on
Panorama, see the Panorama Administrator’s Guide.
Note: You can only set one NPC port on the firewall to the type Log Card. If you enable log forwarding and this port is not configured, a commit error occurs. Also ensure that this port can reach the servers that will receive content sent by the firewall. For example, if you configure a log forwarding profile for a Syslog server, this port must be able to reach the Syslog server. As another example, if you enable WildFire file forwarding, the interface must be able to reach the WildFire cloud server or a private WF-500 appliance.
1.
Select Device > Interfaces and click the Ethernet tab.
2.
Expand the slot that contains the NPC that you will modify and click on an available port. For example, to configure ethernet2/1, expand Slot 2 and click on ethernet2/1.
3.
Select the Interface Type drop-down and select Log Card.
4.
If virtual systems is enabled, select the desired virtual system in the Config tab.
5.
Click the Log Card Forwarding tab.
6.
Enter the IPv4 and/or the IPv6 IP Address, Netmask, and Default Gateway.
7.
Click OK to save the interface settings and then Commit the configuration. After the commit is complete, connect the network cable for the log port.
8.
Verify that the port is sending/receiving traffic by viewing logical interface counters. To view counters, run the following command: admin@PA-7050> debug log-card-interface info slot s8
If counters are incrementing, but traffic is not flowing to the remote server, you can ping the server from the log port by running the following command: admin@PA-7050> debug log-card-interface ping slot s8 host
ip_address
After you configure the log card port, Syslog, Email, SNMP and WildFire file forwarding services will automatically use the log card port.
For complete details on configuring log forwarding, refer to the PAN-OS Administrator’s Guide.
Connect Power
The PA-7050 firewall can use either four AC or four DC hot-swappable power supplies that are inserted into the front of the chassis. With AC power supplies, the power cords and switches are located on the back of the chassis; with DC power supplies, the DC power cables are connected to the front of the
40 • Installing the Hardware Palo Alto Networks
Connect Power power supply. In both configurations, at least two power supplies must be powered on before the chassis will operate. During normal operation, all four power supplies should be connected for redundancy and power circuit maintenance purposes.
Note: The power configuration can be changed in the field. For example, if you order a chassis with DC power supplies, you can change it to an AC configuration.
When changing the power supply type, you must power down the chassis before switching power modules.
WARNING: The chassis is designed to user either AC or DC power supplies, not a combination of the two. Do not attempt to mix power supply types (AC/DC).
The following topics describe the required procedures for AC and DC connections:
•
•
Connect AC Power
When connecting the PA-7050 to power, it is recommend that 240V circuits are used and that each pair of AC power supplies is on a different circuit. During normal operation, all four power supplies should
be connected to provide redundancy. See Figure 23 for an illustration of the AC power connection.
IMPORTANT: When the front chassis slots are fully populated, you must have a minimum number of power supplies operational for the chassis to stay powered on. For 240V AC or -48V DC power, at least two power supplies must be powered on at all times. This is important to consider for redundancy and for scheduled electrical circuit maintenance.
Connecting the AC power:
1.
Ensure that all AC power switches are in the off position.
2.
Remove the two nuts over the grounding lug bolts located on the back of the chassis on the upper left side.
3.
Use the provided two post grounding lug and crimp it to a 6 AWG cable of the correct length that connects to your ground source.
4.
Connect the two post lug connector to the two post lugs on the chassis using the provided star washer and nut and then torque the nuts to 50 in-lbs.
Ground
Grounding lugs on the back of the chassis.
Palo Alto Networks Installing the Hardware • 41
Connect Power
5.
Connect the first two power supplies to a 240V 20 amp AC power source using the provided power cords and then connect the second two power supplies to a difference 240V 20 amp AC power circuit. This will ensure that if one power circuit goes down, the other power circuit will provide enough temporary power to keep the chassis operational.
6.
Secure the power cord inlets using the power cord retainer clips. These clips will secure the cords to the AC inlets on the back of the chassis to ensure that the cords stay in place.
7.
Ensure that the ground cable is connected and that all front slot cards are properly inserted and then turn on each of the four AC power switches located on the back of the chassis. The chassis will then power on.
Figure 23. AC Power Connection
Ground
Circuit A
Circuit B
240VAC 20 AMP Configuration
Connect DC Power
CAUTION: For the DC input circuit, make sure there is a 60 amp circuit breaker, minimum 48VDC, and double pole on the input to the DC power. The power cables used to connect DC power is provided with the PA-7050 firewall.
To connect DC power:
1.
Use the provided two post copper grounding lug and crimp it to a 6 AWG cable of the correct length that connects to your ground source.
42 • Installing the Hardware Palo Alto Networks
Connect Power
2.
Connect the two post lug connector to the two post lugs on the chassis using the provided star washer and nut and then torque the nuts to 50 in-lbs.
Ground
Grounding lugs on the back of the chassis.
3.
Ensure that the DC power feed that will provide power to the chassis is powered off.
4.
Connect each of the four DC power supplies to a DC power source using the provided DC power cables. Each cable has a plastic connector on one end that attaches to the front of the DC power supply. The plastic connector has release clips on each side that will click in place when the cable is fully inserted. The other end of the cable has two red (positive) and two black (negative) wires that are 15 feet long. Crimp the two black wires together using a lug designed to connect to your
DC negative terminal and then crimp the two red wires together using a second lug to connect to
the positive terminal. Do this for each of the four power supplies. Figure 24 on page 44 provides an
illustration of the connection.
Note: It is recommended that each pair of power supplies is connected to a separate circuits. This is important to consider for redundancy and for scheduled electrical circuit maintenance.
5.
Ensure that the DC power source is powered off and then connect the red cable to the positive terminal and the black cable to the negative terminal. Do this for each of the four power supplies.
6.
After each DC cable is securely connected, power on the DC power source and the chassis will power on.
Palo Alto Networks Installing the Hardware • 43
Connect Cables
Figure 24. DC Power Connection
Crimp and connect both cable pairs for each power supply to your DC power source observing the correct polarity.
Black (-)
7
8
7
8
Red (+)
Connect Cables
Figure 25 shows the PA-7050 cable connections. For details on the front slot cards, see “PA-7050
Modules and Interface Card Overview” on page 13. When using DC power supplies, the DC power
cables will be connected at the front of the DC power supplies.
When connecting the High Availability (HA) cables, HA1 (control) must be configured on the HA1-A and/or HA1-B ports. HA2 (data link) can be configured on NPC data ports, or the dedicated HSCI ports.
HA3 (packet forwarding) must be configured on the dedicated HSCI ports. You can connect HA1-A and HA1-B through a switch or router. With the QSFP ports (HSCI-A and HSCI-B), you must connect directly and cannot connect through a switch.
44 • Installing the Hardware Palo Alto Networks
Figure 25. PA-7050 Cable Connections
PA-7050
Connect Cables
4
SMC
4
SMC
HA1
HA1 Backup
Management Console
Network Network
HA2/HA3
QSFP
HA2/HA3
QSFP
SFP SFP+
Palo Alto Networks Installing the Hardware • 45
Verify the LPC and NPC Configuration
Verify the LPC and NPC Configuration
The following sections describe procedures that can be used to verify the configuration of the Log
Processing Card (LPC) and Network Processing Card (NPC).
Verify the LPC Configuration
After the LPC and AMC/drives are installed in the chassis, it will take a few minutes before the drives are formatted and put into the RAID configuration. Drives A1 and A2 will be one RAID 1 pair and drivers B1 and B2 will be configured as a second RAID 1 pair. All four AMC/drives should be installed in the LPC during normal operation.
Note: The chassis will not operate without a functioning LPC that has at least one
RAID 1 pair configured. During normal operation, all four drives should be installed.
To view the status of the RAID configuration, run the following command: admin@PA-7050> show system raid detail
Confirm that at least one RAID 1 pair shows Available, which indicates that a drive pair is ready and the LPC can process and receive logs. The initial formatting to ready the drives should take approximately 3-4 minutes. In the following output, Disk Pair S8A shows Available and the status of the first RAID 1 is clean. The second RAID 1 pair (Disk Pair S8B) is also ready.
Disk Pair S8A Available
Status clean
Disk id A1 Present
model : ST91000640NS
size : 953869 MB
status : active sync
card serial : 002901000061
Disk id A2 Present
model : ST91000640NS
size : 953869 MB
status : active sync
card serial : 002901000067
Disk Pair S8B Available
Status clean
Disk id B1 Present
model : ST91000640NS
size : 953869 MB
status : active sync
card serial : 002901000089
Disk id B2 Present
model : ST91000640NS
size : 953869 MB
status : active sync
card serial : 002901000076
Each drive in the RAID 1 pairs will also show model, size, status, and the card serial number. The following output shows a working disk and the possible status level:
Disk id A1 Present
model : ST91000640NS
size : 953869 MB
status : active sync
card serial : 002901000061
46 • Installing the Hardware Palo Alto Networks
Verify the LPC and NPC Configuration
commands to add and remove drives, see “Replace an AMC/Disk Drive” on page 55.
Table 17. AMC/Drive Status Indicators
Status Description
not in use The drive is not part of a RAID pair.
spare rebuilding active sync failed
The drive is currently rebuilding to sync data with the existing drive in the
RAID 1 pair. This will appear after replacing a failed drive and the data from the current drive is being mirrored to the new drive.
The drive is currently part of a RAID 1 pair and is ready.
The drive has failed and should be replaced.
Verify the NPC configuration
When the PA-7050 is first installed, all NPC slots are ready to use. If you are working with an existing configuration, you may want to check the slot status before adding a new NPC. In HA configuration, the
NPC will stay in a disabled state until a matching NPC is installed. After the matching NPC is installed in the same slot number as the peer device, they must be enabled, which is described in the following section.
To check slot status, run the following command: admin@PA-7050> show chassis status slot slot-number
For example, to check slot 3 run the command: admin@PA-7050> show chassis status slot s3
If the slot is ready to use, it will show empty. When a card is inserted the status will be updated. For a
show Card Status Up and Config Status Success. A slot may also be powered down by an admin and will need to be powered up. If the status is AdminPowerOff it will need to be powered on by running request chassis admin-power-on slot slot-number. To power off a slot, run request chassis admin-power-off slot slot-number. When using the
AdminPowerOff
command, the slot will remain off, even after the chassis is rebooted. Use the following command to temporarily power down a slot request chassis power-off slot
slot-number
.
In an HA configuration, when NPCs are installed in matching slots, they will stay in the disabled state until you enable them. If the NPC is disabled, run the following command to enable both NPC in the
HA pair: admin@PA-7050> request chassis power-on slot slot-number target hapair
For example, to enable the NPCs installed in slot 3 of both chassis, run the following command: admin@PA-7050> request chassis power-on slot 3 target ha-pair
For more information on installing NPCs, see “Replace a Network Processing Card (NPC)” on page 64
and for information on slot status indicators, see “Front Card Slot States” on page 68.
Palo Alto Networks Installing the Hardware • 47
Verify the LPC and NPC Configuration
48 • Installing the Hardware Palo Alto Networks
Cautions and Warnings
Chapter 4
Maintaining the Hardware
This chapter describes the steps required to replace serviceable hardware components on the PA-7050 firewall.
For an overview of each PA-7050 hardware component and details on interpreting LEDs for
troubleshooting purposes, see the “PA-7050 Modules and Interface Card Overview” on page 13.
Before continuing, read the “Cautions and Warnings” on page 49.
•
“Cautions and Warnings” on page 49
•
“Replace an AC or DC Power Supply” on page 52
•
“Replace an AMC/Disk Drive” on page 55
•
“Replace a Fan Tray” on page 58
•
“Replace the Air Filter” on page 60
•
“Replace Front Slot Cards” on page 61
Cautions and Warnings
The following lists cautions and warnings that must be observed before working with the hardware.
THIS PRODUCT COMPLIES WITH 21 CFR 1040.10 and 1040.11
French Translation: CE PRODUIT EST CONFORME AUX NORMES 21 CFR 1040.10 ET 1040.11
•
“General Cautions/Warnings” on page 49
•
“DC Power Related Cautions/Warnings” on page 50
General Cautions/Warnings
This section describes general cautions and warnings related to working with the hardware:
CAUTION: Equipment may be affected by electrostatic discharge. ESD reduction procedures (wearing a wrist strap) must be implemented during the installation and maintenance of equipment.
CAUTION: Shielded interface cables which are grounded must be used to ensure agency compliance with electromagnetic emissions (EMC).
Palo Alto Networks Maintaining the Hardware • 49
Cautions and Warnings
CAUTION: The PA-7050 firewall configured with AC power supplies is capable of operating from 100 to 240 VAC 50/60 Hz at 27 amps maximum.
WARNING: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN
INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE
INSTRUCTIONS" (Cl. 1.7.13)
French Translation:
ATTENTION: RISQUE D'EXPLOSION SI LA BATTERIE EST REMPLACÉE
PAR UN MODÈLE DE TYPE INCORRECT. METTEZ AU REBUT LES
BATTERIES USAGÉES CONFORMÉMENT AUX INSTRUCTIONS (CL.
1.7.13)
WARNING: Laser radiation exposure should be avoided. Cover any unused fiber optical ports. Do not look directly at exposed fiber optical transmitters or cables.
WARNING: To reduce the risk of electric shock, disconnect all power supply cords before servicing the switch (the switch might have more than one).
French Translation:
Pour réduire le risque de choc électrique, débranchez tous les câbles d'alimentation avant d'intervenir sur le commutateur (il peut en comporter plusieurs).
WARNING: (PA-7050 Firewall) When removing a fan tray, it is recommended that you first pull the fan tray out one inch and then wait 5-10 seconds before extracting the entire fan tray. This will allow the fans time to stop spinning, before removing the tray. Serious injury can occur if you come in contact with the spinning fan blades.
DC Power Related Cautions/Warnings
This section lists cautions and warnings for the hardware when DC power supplies are installed:
WARNING: You must shut off the electric current to the DC feed wires before connecting or disconnecting the wires from the DC power supply.
50 • Maintaining the Hardware Palo Alto Networks
Cautions and Warnings
CAUTION: All devices that use DC power are intended for installation in restricted access areas only. A restricted access area is where access can be gained only by craft (service) personnel through the use of a special tool, lock and key, or other means of security, and is controlled by the authority responsible for the location.
CAUTION: For the DC input circuit, make sure there is a 60 amp circuit breaker, minimum 48VDC, and double pole on the input to the DC power. The power cables used to connect DC power is provided with the PA-7050 firewall.
CAUTION: For a DC system ground, use a grounding wire of at least 6
American Wire Gauge (AWG). The 6 AWG wire must be attached to the provided copper grounding lug and crimped with the proper crimping tool. Attach the lug to the grounding lug bolts on the chassis using the provided star washers and nuts and attach the other end to the building ground. Torque the lug nut to 50 in.-lbs. Do not over tighten.
CAUTION: This equipment is designed to permit the connection of the earthed conductor of the DC supply circuit to the earthing conductor at the equipment. See installation instructions.
French Translation:
CAUTION: ATTENTION : Cet équipement est conçu pour permettre de connecter le conducteur de terre du circuit d'alimentation CC au conducteur de terre de l'équipement. Reportez-vous aux instructions d'installation.
CAUTION: The PA-7050 firewall configured with DC power supplies is capable of operating from -40 to 60 VDC at a maximum current level of 60 amps.
Important notes on connecting DC power:
•
If a DC connection is used, all of the following conditions must be met:
– This equipment must be connected directly to the DC supply system earthing electrode conductor or to a bonding jumper from an earthing terminal bar or bus to which the DC supply system earthing electrode conductor is connected.
– This equipment must be located in the same immediate area (such as adjacent cabinets) as any other equipment that has a connection between the earthed conductor of the same DC supply circuit and the earthing conductor, and also the point of earthing of the DC system.
– The DC system must not be earthed elsewhere.
– The DC supply source must be located within the same premises as this equipment.
– The battery returns of the PA-7050 firewall must be connected as either DC-C or DC-I.
Switching or disconnecting devices must not be in the earthed circuit conductor between the DC source and the point of connection of the earthing electrode conductor.
Palo Alto Networks Maintaining the Hardware • 51
Replace an AC or DC Power Supply
Replace an AC or DC Power Supply
The PA-7050 firewall can use four AC or four DC power supplies that are inserted in the front of the chassis. When using DC power supplies, the AC power inlets and switches on the back of the device are not functional and must be covered with the provided cover plate.
All four power supplies on the front of the chassis should be connected during normal operation. If the system detects a loss of power, either due to loss of power connection or failure of a power supply, the power LED located on the power supply and the PWR LED on the SMC card will both turn red.
WARNING: The chassis is designed to user either AC or DC power supplies, not a combination of the two. Do not attempt to mix power supply types (AC/DC).
To replace a power supply, see the following topics:
•
“Replace an AC Power Supply” on page 52
•
“Replace a DC Power Supply” on page 54
Replace an AC Power Supply
Before servicing the hardware, read the information in “Cautions and Warnings” on page 49.
The PA-7050 can be configured with four serviceable hot-swappable AC power supplies located on the front of the chassis and the power switch on the back of the chassis corresponds to each power supply.
To locate the failed power supply, view the system logs or check the LEDs located on each power supply. A red LED indicates a failed power supply. You must have at least two power supplies functional for the chassis to remain operational. During normal operation, all four power inputs should be installed and powered.
Note: The AC power module that contains the on/off switch and the power cord inlet is not serviceable.
To replace an AC power supply:
1.
Put the power supply switch for the failed power supply in the off position and unplug the power cord. For example, if you are facing the front of the chassis and the far left power supply has failed, the corresponding switch/cord is located on the back of the chassis opposite of the failed power supply. Removing the power cord will prevent the risk of arcing inside the chassis.
2.
Loosen the power supply thumb screw located at the top left of the power supply.
52 • Maintaining the Hardware Palo Alto Networks
Replace an AC or DC Power Supply
3.
Pull the power supply lever from the top center of the power supply to disengage it from the chassis
and then slide the power supply out of the chassis using the handle as shown in Figure 26.
Figure 26. Remove an AC Power Supply
Pull handle to remove.
4.
Before installing the new power supply, pull the handle out to the open position. When the handle is halfway open, you will notice two small tabs on each end that will fit into two notches in the chassis. These tabs are used to fully seat the power supply into the chassis as the handle is closed.
5.
Slide the new power supply in until it almost fully seated and then close the handle to seat the power supply in place.
6.
Tighten the upper left screw on the power supply to secure the release handle.
7.
Plug the power cable into the AC power module and turn on the power switch located below the power outlet.
Palo Alto Networks Maintaining the Hardware • 53
Replace an AC or DC Power Supply
Replace a DC Power Supply
Before servicing the hardware, read the information in “Cautions and Warnings” on page 49.
The PA-7050 can be configured with four serviceable hot-swappable DC power supplies located on the front of the chassis. To locate the failed power supply, view the system logs or check the LEDs located on each power supply. A red LED indicates a failure.
You must have at least two power supplies functional for the chassis to remain operational. During normal operation, all four power supplies should be installed and powered on.
To replace a failed DC Power Supply:
1.
Power off the DC power source that is connected to the failed DC power supply.
2.
Remove the DC power cable from the failed DC power supply by squeezing the two clips on each side of the plastic connector inward and then pull the connector away from the power supply as
3.
Loosen the power supply thumb screw located at the top left of the power supply.
4.
Pull the power supply lever from the top center of the power supply toward you to disengage it from the chassis and then slide the power supply out of the chassis using the power supply handle
Figure 27. Remove a DC Power Supply
8
5.
Before installing the new power supply, pull the handle out to the open position. When the handle is halfway open, you will notice two small tabs on each end that will fit into two notches in the
54 • Maintaining the Hardware Palo Alto Networks
Replace an AMC/Disk Drive chassis. These tabs are used to fully seat the power supply into the chassis as the handle is closed.
6.
Slide the new power supply in until it almost fully seated and then close the handle to seat the power supply in place.
Figure 28. Install a DC Power Supply
7
8
7
8
7.
Tighten the upper left screw on the power supply to secure the release handle.
8.
Insert the DC power cable plastic connector into the front of the DC power supply. There are two clips on each side of the connector that will click in place when fully inserted.
9.
Turn on the electric current to the DC feed and the new power supply will power on.
Replace an AMC/Disk Drive
Before servicing the hardware, read the information in “Cautions and Warnings” on page 49.
The PA-7050 firewall has a dedicated Log Processing Card (LPC) that contains four disk drives. The disk drives are connected to the LPC using an Advanced Mezzanine Card (AMC) and each AMC contains one 2.5” SATA disk drive with 1 terabyte capacity. The first two drives on the left (Drives A1 and A2) are a RAID 1 pair and the next two drives on the right (B1 and B2) are also a RAID 1 pair for a
Palo Alto Networks Maintaining the Hardware • 55
Replace an AMC/Disk Drive total of 2 terabytes of storage. If a drive fails in one of the RAID 1 pairs, when you order a replacement from Palo Alto Networks or your reseller, you will receive a new AMC that will also contain a new drive. Do not attempt to replace the drive on an AMC.
Note: The disk drives in the LPC are used for logging. The SSD located on the
SMC contains the PAN-OS software and is not serviceable.
To replace an AMC/Disk drive:
1.
Identify the failed drive using the system log or by viewing the LED on the front of the AMC front panels. The bottom left drive LED labeled FAULT will turn red in the event of a drive failure. To look for the failed drive from the CLI, run the command show system raid detail and locate the drive with the status failed.
2.
Gently pull the release handle of the AMC toward you to unlock the AMC from the chassis as
shown in Figure 29 and then remove the AMC/Disk drive from the chassis as shown in Figure 30.
56 • Maintaining the Hardware Palo Alto Networks
Figure 29. Unlock and Lock the AMC/Disk Drive
WER
ACTIVIT
Y
FAULT
PA-7000-
AMC-1TB
POWER
ACTIVITY
FAULT
PA-7000-AMC-1TB
Replace an AMC/Disk Drive
Pull handle out to unlock, push in to lock.
Figure 30. Replace an AMC/Disk Drive
OWER
ACTIVITY
FAULT
PA-700
-AMC-1TB
ACTIVI
TY
FAULT
PA-700-
AMC-1TB
POWER
3.
Install the new AMC/Disk drive by gently sliding the drive into the AMC slot and then push the release handle all the way in to lock the AMC in place.
4.
To add the new drive to the RAID 1 pair, run request system raid slot 8 add
diskname
. For example, if A2 drive failed in the A1/A2 pair and you installed a new drive for
A2, run request system raid slot 8 add A2. A reboot of the system would also add the drive automatically. If you are replacing a functioning drive, the drive must be removed first by running request system raid slot 8 remove diskname.
5.
The new drive will automatically be mirrored with the other drive in the RAID 1 pair and the mirror operation will be completed in a few hours. To check the status of the RAID, run the command: show system raid detail.
Palo Alto Networks Maintaining the Hardware • 57
Replace a Fan Tray
Replace a Fan Tray
Before servicing the hardware, read the information in “Cautions and Warnings” on page 49.
The following procedures describe the required steps to replace a fan tray. Please read the following
cautions and warnings related to the fan tray and read the “Cautions and Warnings” on page 49.
CAUTION: You can replace a fan tray while the firewall is powered on; however, you must replace it within 45 seconds and you can only replace one fan tray at a time (two total) or the thermal protection circuit will automatically shut down the firewall. If more than two individual fans fail (on one or both fan trays) the system will power down and you will need to replace the fan tray(s) with the failed fan(s). After installing a replacement fan tray, the power switch must be switched off and then back on to power on the chassis.
WARNING: When removing a fan tray, it is recommended that you first pull the fan tray out one inch and then wait 5-10 seconds before extracting the entire fan tray. This will allow the fans time to stop spinning before removing the tray. Serious injury can occur if you come in contact with the spinning fan blades.
To replace a fan tray:
1.
Identify the failed fan tray by viewing the LEDs. The FAN LED on the SMC card and the FAULT
LED on the failed fan tray will both change to red in the event of a failure
CAUTION: Prepare the new fan tray by ensuring that both thumb screws are turned all the way counter clockwise to the open position until the thumb screws stop. This will ensure that the latches are in the full open position as shown in
Figure 31 and will prevent the latches from being damaged when inserting the fan
tray into the chassis.
2.
Loosen the top and bottom fan tray thumb screws by turning them counter clockwise until the screws stop. This will move the latches to the open position to prepare for the fan tray removal as
58 • Maintaining the Hardware Palo Alto Networks
Figure 31. Loosening the Thumb Screws to Unlock the Fan Tray
Replace a Fan Tray
Open Position
5
6
3
4
1
2
7
8
3
4
5
6
1
2
7
8
5
6
3
4
1
2
7
8
Beware of spinning fans.
3.
Grasp the fan tray handles and pull the tray out about two inches. After all fans have stopped spinning, remove the fan tray from the chassis.
4.
Install the new fan tray by sliding the tray into the chassis, ensuring it is seated properly.
5.
Turn the thumb screws to the right until they stop. This will lock the top and bottom latches to
secure the tray to the chassis as shown in Figure 32. Use a Phillips-head screwdriver to tighten the
thumb screws.
Palo Alto Networks Maintaining the Hardware • 59
Replace the Air Filter
Figure 32. Install a Fan Tray
Lock Position
3
4
5
6
1
2
7
8
5
6
3
4
1
2
7
8
5
6
3
4
1
2
7
8
Replace the Air Filter
There is one air filter located on the right of the chassis (intake side). This filter should be inspected on a periodic basis and can be pulled out and inserted without setting off any alarms. A dirty air filter restricts airflow in the unit, reducing the ventilation and effective cooling of the system. To maintain optimum system operation, Palo Alto Networks recommends that you replace the filter every six months. Discard used filters; do not attempt to clean and reuse them. You can purchase replacement air filters from Palo Alto Networks or an authorized reseller.
It is not necessary to power off the chassis to replace the air filter and there are no logs or LED indicators that will show that a filter has been removed or that it needs cleaning.
To replace the air filter:
1.
Grasp both air filter handles and gently pull the air filter out to unsnap it from the mount point located at the back of the filter. The filter tray is not fastened with any screws or levers.
2.
Pull the filter completely away from the chassis as shown in Figure 33.
60 • Maintaining the Hardware Palo Alto Networks
Replace Front Slot Cards
3.
Install a new filter ensuring that it snaps into the back of the air filter slot. The filter installs with
the grid side of the filter facing the inside of the chassis as shown in Figure 33.
Note: When servicing the air filter, only replace with a new filter; do not attempt to clean old filters.
Figure 33. Remove the Air Filter
3
4
5
6
1
2
PA-7050-
FAN
POWER
FAULT
PA-7000
-BLANK
7
8
ACTIVITY
FAULT
PA-7000-AMC-ITB
HA1-A
HA1-B
MGT
CONSOLE
MSCI-A
MSCI-B
USB
PWR
STS
HA
TMP
ALM
FAN
PS
LOG
POWER
1
3
5
7
9
11
2
ACTIVITY
FAULT
4
PA-7000-AMC-ITB
6
8
13 15
17
10
POWER
12
14
ACTIVITY
FAULT
PA-7000-AMC-ITB
16
19
18
20
POWER
21
23
22
24
ACTIVITY
FAULT
PA-7000-AMC-ITB
PWR
STS
ALM
TMP
POWER
1
2
PA-7050-
FAN
POWER
FAULT
7
8
3
4
5
6
Grid faces toward card slots (inside)
Replace Front Slot Cards
This section describes the steps needed to replace a failed front slot card. At minimum, the PA-7050 must have one SMC, one LPC, and at least one NPC card. If the SMC or LPC card fails, the chassis will not operate, so it is recommended that you use High Availability (HA) for full redundancy.
•
“Replace a Switch Management Card (SMC)” on page 62
•
“Replace a Log Processing Card (LPC)” on page 63
•
“Replace a Network Processing Card (NPC)” on page 64
Palo Alto Networks Maintaining the Hardware • 61
Replace Front Slot Cards
Replace a Switch Management Card (SMC)
The Switch Management Card (SMC) is required to operate the chassis. If the SMC fails, the LPC and
NPC cards will power down and the chassis will reboot and will try to recover the SMC. If the chassis is restarted more than 3 times in 30 minutes, it will enter maintenance mode at which time it should be powered off until the SMC can be replaced.
Note: The SMC is required to run the chassis. If two chassis are in high availability (HA) mode, and the SMC is removed or fails, a failover will occur.
To replace the SMC:
1.
Ensure that the chassis is powered off and that no power cords are connected.
2.
Attach an ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see three ports,
any of which can be used. For details on the ESD port location, see “Front Panel (AC)” on page 6.
3.
Make note of the cable connections and then loosen the screws that secure the SMC to the chassis using a Phillips-head screwdriver. The SMC will always be located in slot 4.
4.
Remove the failed SMC by sliding the black switch upward next to each screw to unlock the release levers and then pull the release levers toward you to pull the card out of the chassis as
Figure 34. Install/Remove an SMC
62 • Maintaining the Hardware
PA-7000-20G-NPC
PA-7050-SMC
3
4
SMC
5
6
7
8
1
2
ALM
F
P
PA-705
0
3
4
SMC
5
6
1
2
7
8
Switch Management Card (SMC)
Palo Alto Networks
Replace Front Slot Cards
5.
Remove the new SMC card from the anti-static bag and slide it into slot 4 ensuring that the handles are in the open position. When the card is about 1/4” from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in place.
6.
Tighten the screws on each side of the SMC with a Phillips-head screw driver to secure it to the chassis.
7.
Reconnect the cables and power cords and power on the chassis.
Note: The session distribution policy configuration is stored on the SMC. If this option has been changed from the default setting, you will need to re-configure the
distribution policy after installing the new SMC. For information on the set session distribution-policy
command, refer to the Palo Alto Networks
PAN-OS Command Line Reference Guide 6.0 or later.
Replace a Log Processing Card (LPC)
The Log Processing Card (LPC) is required for the chassis to operate. If the LPC fails, the chassis will reboot and attempts to recover the LPC. If the LPC continues to fail and the chassis restarts more than three times in 30 minutes, it will enter maintenance mode at which time it should be powered off until the LPC can be replaced.
The LPC also contains the disk drives used to store logs, so if the LPC fails, you will need to remove the
AMC/Disk drives and then re-install them in the new LPC. It is important that the AMC/Disk drives are installed in the same order in which they were removed to maintain the RAID configuration.
Note: The LPC is required to run the chassis. If two chassis are in high availability (HA) mode, and the LPC is removed or fails, a failover will occur.
To replace the LPC:
1.
Ensure that the chassis is powered off and that no power cords are connected.
2.
Attach an ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see three ports,
3.
Remove the four AMC/Disk drive from the front of the LPC installed in slot 8 (note the location of each) and temporarily store them in anti-static bags or on an anti-static mat. The AMC/Disk drive
CAUTION: It is important that the AMC/Disk drives are installed in the same order in which they were removed to maintain the RAID configuration.
4.
Loosen the thumb screws on each side of the LPC that are used to secure the card to the chassis.
Use a Phillips-head screwdriver if necessary.
5.
Remove the LPC by pulling the inner release lever to unlock the outer release lever and then use
Palo Alto Networks Maintaining the Hardware • 63
Replace Front Slot Cards
the outer release leave to pull the LPC out of the chassis as shown in Figure 35.
Note: The LPC uses a double lever on each side of the card. After loosening the thumb screws, you must pull the inner lever toward you to unlock the outer lever from the chassis and then pull the outer lever to release the card from the chassis.
When installing the card, pushing the outer lever in will lock the inner lever.
Figure 35. Remove the LPC
3
4
SMC
5
6
7
8
1
2
PA-705
0
3
4
SMC
5
6
1
2
7
8
LPC in slot 8
6.
Remove the new LPC from the anti-static bag and slide it into slot 8 ensuring that the handles are in the open position. When the cards is about 1/4” from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in place.
7.
Tighten the thumb screws on each side of the LPC to secure it to the chassis.
8.
Install the AMC/Disk drives that you removed earlier and install them in the same locations in
which they were removed. For details on replacing AMC/Disk drives, “Replace an AMC/Disk
9.
Reconnect the power cords and power on the chassis.
Replace a Network Processing Card (NPC)
If a Network Processing Card (NPC) fails, the card will reboot to try to recover; if the card does not recover it will change to a down state and will need to be replaced. If there is only one functioning NPC card in the chassis and the NPC fails after three recovery attempts, the chassis will reboot to try to recover the card.
64 • Maintaining the Hardware Palo Alto Networks
Replace Front Slot Cards
You do not have to power off the chassis to install or remove NPCs.
For information on slot status details, see Table 18 on page 68 and for information on common CLI
commands to view slot information, see Table 19 on page 69.
The following topics describe the replacement procedures in a single chassis or an HA configuration:
•
“Replace a Network Processing Card in a Single Chassis” in the next section
•
“Replace a Network Processing Card in a HA Configuration” on page 68
Replace a Network Processing Card in a Single Chassis
This topic describes the steps required to replace a Network Processing Card (NPC) in a single PA-7050 firewall.
To replace an NPC:
1.
First verify the status of the NPC that is having a problem. You can do this from the web interface or from the CLI. In the web interface, navigate to Network > Interfaces and each NPC slot will
show status as shown in Figure 36.
Figure 36. Network Processing Card (NPC) Status
If the NPC failed due to a hardware problem, the status will show Failure. The NPC may also have a configuration problem. In this situation, you can try to force a commit by running commit force
. Table 18 on page 68 describes the possible states of an NPC.
2.
Attach an ESD strap to your wrist and plug it into one of the ESD ports located on the front of the chassis. The ESD ports are located along the bottom row of the chassis and you will see three ports,
any of which can be used. For details on the ESD port location, see “Front Panel (AC)” on page 6.
3.
Make note of the cable connections and then loosen the screws that secure the NPC to the chassis using a Phillips-head screwdriver.
4.
Remove the NPC using the procedures that follow based on the version of NPC that is installed.
There are two versions of the PA-7000 20G NPC as described in “Network Processing Card
(NPC)” on page 18. Version 1 uses a black slide switch on each side of the card used to release the
ejector lever. Version 2 does not use the slide switch, it uses a double lever where the inner lever is used to release the outer ejector lever. a.
Removing a version 1 PA-7000 20G NPC—Unscrew the card screws on each side of the card and then slide the black lever release upward on both sides to unlock the release levers and then wait for the power LED to go off. After the power LED is off, pull the outer ejector release
lever toward you to pull the card out of the chassis as shown in Figure 37.
Palo Alto Networks Maintaining the Hardware • 65
Replace Front Slot Cards b.
Removing a version 2 PA-7000 20G NPC—Unscrew the card screws on each side of the card and then gently pull the inner release lever to release the outer ejector levers. Wait for the power
LED to go off. After the power LED is off, pull the release lever toward you to pull the card out of the chassis as shown in
Figure 37. Install/Remove a PA-7000 20G NPC Version 1
PA-7000-20G-NPC
PA-7050-SMC
5
6
7
8
1
2
3
ALM
F
P
PA-705
0
3
4
SMC
5
6
1
2
7
8
NPC Release Levers
66 • Maintaining the Hardware Palo Alto Networks
Figure 38. Install/Remove a PA-7000 20G NPC Version 2
Replace Front Slot Cards
5.
Remove the new NPC card from the anti-static bag and slide it into the empty slot, ensuring that the handles are in the open position. When the cards is about 1/4” from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in place.
6.
Tighten the screws on each side of the NPC with a Phillips-head screw driver to secure it to the chassis.
7.
In an HA configuration, you must enable the slots that contain the existing NPC and the NPC that was replaced. Run the following command: request chassis power-on slot slot-number target ha-pair.
For example, running the following command will enable slot 3 on both devices: request chassis power-on slot 3 target ha-pair.
8.
Insert the network cables that were removed earlier.
page 68 and “NPC Troubleshooting Commands” on page 69.
Palo Alto Networks Maintaining the Hardware • 67
Replace Front Slot Cards
Replace a Network Processing Card in a HA Configuration
This topic describes the requirements for replacing a Network Processing Card (NPC) that is installed in a PA-7050 HA configuration. As with all Palo Alto Networks firewalls, the hardware must match in both devices in the HA configuration. With the PA-7050, it is also required that all cards installed in the front slots are the same on both devices in the HA pair. The PAN-OS software is designed to allow the insertion of new cards (NPCs) without causing a failover. This is done by not allowing a new card to come up in one chassis until both chassis have matchings cards and both cards can be brought up together.
If an NPC fails on one of the chassis, the chassis will change to a non-functional state when in active/ passive mode and to a tentative state when in active/active mode. The chassis will stay in a failover state until a new NPC is installed and configured or if the matching NPC in the working device is removed or admin-powered-off. After the failed card is replaced, the chassis will come up as passive in active/ passive or active-secondary in an active/active configuration. To force a specific device in an HA configuration to always be primary, you can use the preemptive option.
To identify the failed NPC, check the LEDs on the NPC or check the system logs. For example, if slot 3 has a failed NPC, the following error will be displayed: “Slot 3 failure; moving to failure state.”
Table 18 describes the possible slot states and descriptions and Table 19 describes common CLI
command that can be usedyou can use to view slot and card status.
Network Processing Card in a Single Chassis” on page 65. In addition to these steps, in an HA
configuration you must enable the slots after replacing the failed card by running request chassis enable slot slot-number target ha-pair
. For example, running the following command will enable slot 3 on both devices: request chassis enable slot slot-number target ha-pair
.
Front Card Slot States
The following table describes the possible states that a PA-7050 slot can be in as well as the states of an installed card. To view slot status from the web interface, select Network > Interfaces and the slot status will be shown to the right of the slot number. From the CLI operational mode, run show chassis status slot slot-number
. For example, show chassis status slot s1.
You can also run show chassis status to view the status of all slots.
For information on troubleshooting slots and changing the state of slots, see “NPC Troubleshooting
Table 18. PA-7050 Slot States
State Description
Empty
Up
Disabled
HA-Disabled
Stopping
Starting
PowerOff
No card is installed and the slot is ready to use.
Card is powered on and the software configuration is running.
The slot is not enabled (HA only). In an HA configuration, NPC slots will not be enabled until you enable them.
After the slots have been enabled, this will appear until both slots are ready
(HA only).
This will also occur if the peer does not have a matching card in the same slot number or the card in the peer is not ready.
Card is preparing for removal.
Card is in the process of powering on and the software is initiating.
Card is powered down and ready for removal.
68 • Maintaining the Hardware Palo Alto Networks
Replace Front Slot Cards
Table 18. PA-7050 Slot States
State Description
AdminPowerOff An administrator has powered down this slot and it will not be available until the admin powers it back on. If there is a slot that you do not want to be part of the HA configuration, it should be put in this state.
Failure
Unsupported
Card has failed and should be replaced.
Card is not a supported type for this slot.
NPC Troubleshooting Commands
Table 19 describes common commands that you can use to troubleshoot NPC issues:
Table 19. CLI Commands to Troubleshoot NPC Issues
Purpose Command
Show the status of a slot.
Run the following to view all of the slots: show chassis status
To view the status of one slot run: show chassis status slot slot-number
For example, to check the status of slot 3, run the command: show chassis status slot s3
To power off a slot: request chassis power-off slot slot-number
To power on a slot: request chassis power-on slot slot-number
Temporarily power on and off a slot.
This will gracefully power off a slot and will end sessions. You can use this command to remove an NPC.
Power off a slot using the adminpower command.
When using this option, the slot will stay powered off, even after a chassis reboot.
Enable a slot, so the NPC can start passing traffic.
Enable new NPCs on both chassis in an HA configuration.
To power off a slot: request chassis admin-power-off slot slot-number request chassis enable slot slot-number
To enable new NPCs after inserting them into the same slot numbers on both chassis in an HA configuration: (Using slot 3 in this example) request chassis power-on slot 3 target ha-pair
You can use the ha-pair option in an HA configuration for many of the slot control commands.
Palo Alto Networks Maintaining the Hardware • 69
Replace Front Slot Cards
70 • Maintaining the Hardware Palo Alto Networks
Physical Specifications
Chapter 5
Specifications
This chapter provides specifications for the PA-7050 firewall. For information on the modules and
The following topics describe the PA-7050 specifications:
•
“Physical Specifications” in the next section
•
“Interface Specifications” on page 72
•
“Electrical Specifications and Power Cords” on page 73
•
“Environmental Specifications” on page 74
Physical Specifications
Table 20 lists physical specifications for the PA-7050 firewall.
Table 20. Physical Specifications
Specification Description
Height
Depth
15.75 inches (40cm) 9 RU
23.75 inches (60.32cm)
Width
Weights
Weights (continued)
17.5 inches (44.45cm)
• Chassis (AC) —111.2 lbs (50kg)
Includes the chassis, two fan trays, air filter, and four AC power supplies. Does not include the SMC, NPC, and LPC.
• Chassis (DC) —108.8 lbs (49kg)
Includes the chassis, two fan trays, the air filter, and four DC power supplies. Does not include the SMC, NPC, and LPC.
• Switch Management Card (SMC)
—11 lbs (4kg 989.52g)
• Network Processing Card (NPC)
—9.4 lbs (4kg 263.77g)
• Log Processing Card (LPC):
– LPC only with no drives
—6.4 lbs (2kg 902.99g)
– Individual drives trays (AMC)
—0.6 lbs (272.16g)
– LPC Fully loaded with four drives
—8.8 lbs (3kg 991.61g)
• Fan tray
—9.8 lbs (4kg 445.20g)
• Power supply (AC)
—4.8 lbs (2kg 177.24g)
• Power supply (DC)
—4.2 lbs (1kg 905.09g)
• Blank slot cover
—2.98 lbs (1kg 355g)
• Air filter
—1.4 lbs (635g)
Palo Alto Networks Specifications • 71
Interface Specifications
Table 20. Physical Specifications (Continued)
Specification Description
Mounting Standard 19-inch rack 2-post or 4-post installation.
The chassis ships with the rack mount brackets in the mid-mount (2-post) position. For a 4-post installation, the mounting brackets must be moved from the mid-mount (2-post) position to a front mount (4-post) position.
Power supplies PA-7050 uses four AC or four DC self-contained hot-swappable power supplies located at the bottom front of the chassis. For more details, see
“Electrical Specifications and Power Cords” on page 73.
Interface Specifications
contain one SMC, one LPC, and up to six Network Processing Cards (NPCs). In a fully loaded chassis, you would multiply the NPC numbers in the following table by six. For example, if six NPC are installed, the chassis would have 72 10/100/1000 Ethernet ports.
Table 21. Interface Specifications
Specification Description
Ethernet ports (NPC) 12 RJ-45 10/100/1000 ports for network traffic.
SFP ports
SFP+ ports
(NPC) Eight Small Form-Factor Pluggable (SFP) ports for network traffic.
(NPC) Four 10 gigabit Small Form-Factor Pluggable (SFP+) ports for network traffic.
(SMC) Two RJ-45 ports for high-availability control and synchronization.
High-availability (HA) port
(HA1-A and HA1-B)
Management ports (MGT)
Management console port
(CONSOLE)
QSFP HA Ports (HSCI-A and
HSCI-B)
USB port
(SMC) One RJ-45 port to access the device CLI through an Ethernet interface.
(SMC) One RJ-45 port for connecting a serial console. Use these settings:
– Data rate: 9600
– Data bits: 8
– Parity: none
– Stop bits: 1
– Flow control: None
(SMC) Two Quad Port SFP (QSFP) interfaces used to connect two PA-
7050s for a High Availability (HA) configuration. Each port is comprised of four 10 gigabits links internally for a combined speed of 40 gigabits and is used for HA2 data link in an active/passive configuration or HA3 forwarding in an active/active configuration. When HSCI-A and HSCI-B are both connected, the total bandwidth will be 80 gigabits.
HA2 (data link) can be configured on the HSCI ports or on NPC data ports.
(SMC) USB port for future use.
72 • Specifications Palo Alto Networks
Electrical Specifications and Power Cords
Electrical Specifications and Power Cords
This section describes the PA-7050 firewall electrical specifications and the types of power cords that can be ordered. The PA-7050 firewall can be ordered with four AC or four DC power supplies.
•
“Electrical Specifications” on page 73
•
Electrical Specifications
This table describes the PA-7050 firewall electrical specifications.
Specification
Maximum rated power output per power supply (four total)
Voltage Input
Description
• PA-7050 firewall AC power supplies —2750W
• PA-7050 firewall DC power supplies — 2500W
• PA-7050 with AC power supplies
—(100-240 VAC, 20A, 50-60 Hz)
(Although the range is from 100-240 VAC, you must use 200-
240VAC for full 2+2 redundancy on the power supplies.)
• PA-7050 with DC power supplies
—(-40 to -60VDC, 60A)
Power Cord Types
The PA-7050 firewall ships with four AC or four DC power supplies and four power cords. The DC configuration supports one type of DC power cord (first item in the following table) that you terminate to fit your power source. The AC configuration ships with four power cords that you choose from a list of types described in the following table:
SKU Number
PAN-PWR-DC-CBL-A
PAN-PWR-C19-AUS
PAN-PWR-C19-EU
PAN-PWR-C19-JP
PAN-PWR-C19-TW
PAN-PWR-C19-UK
PAN-PWR-C19-US
PAN-PWR-C19-US-L
Description
Power cable harness with connector for PAN-7050-PWR25-DC and
15 feet leads, customer must terminate
Power cord with IEC-60320 C19 and AS/NZS 4417 cord ends, 3 meters
Power cord with IEC-60320 C19 and CEE 7/7 SCHUKO cord ends, 3 meters
Power cord with IEC-60320 C19 and NEMA L6-20P cord ends, 3 meters
Power cord with IEC-60320 C19 and CNS 10917-3 cord ends, 3 meters
Power cord with IEC-60320 C19 and BS 1363 UK13 cord ends, 3 meters
Power cord with IEC-60320 C19 and NEMA 6-20P cord ends, 3 meters
Power cord with IEC-60320 C19 and locking NEMA L6-20P cord ends, 3 meters
Palo Alto Networks Specifications • 73
Environmental Specifications
Environmental Specifications
Table 22 lists environmental specifications for the PA-7050.
Table 22. Environmental Specifications
Specification Description
Operating temperature range 0° to 50° C. (32°F to 122°F)
Storage temperature range
Humidity
Chassis airflow
-20° to 70° C. (-4°F to 158°F)
5% to 90% non-condensing
Side-to-side
Note: You can modify the chassis airflow to front-to-back airflow by installing the PAN-AIRDUCT kit. Contact your reseller or Palo Alto
Networks for ordering information.
74 • Specifications Palo Alto Networks
NEBS Requirements
Chapter 6
Compliance Statement
This section lists the hardware compliance statements for the following:
•
“NEBS Requirements” in the next section
•
•
“BSMI EMC Statement” on page 76
NEBS Requirements
This section describes the Network Equipment Building System (NEBS) requirements for the PA-7050 firewall.
•
The device is intended to be installed in a Network Telecommunication Facilities (Central Office) as part of a Common Bonding Network (CBN) or Isolated Bonding Network (IBN). Bare conductors must be coated with an appropriate antioxidant compound before crimp connections are made. All unplated connectors, braided strap, and buss bars must be brought to a bright finish and then coated with an antioxidant before they are connected.
•
Fastening hardware must be compatible with the materials being joined and must preclude loosening, deterioration, and electrochemical corrosion of the hardware and the joined materials.
•
The device is suitable for connection to the Central Office (CO) or Customer Premise Equipment
(CPE).
•
The battery returns on the device must be connected as DC-I.
WARNING: The intra-building ports (12 RJ-45 Ethernet ports on each NPC, two HA ports on the SMC, and the MGT port on the SMC) of the equipment or subassembly is suitable for connection to intra-building or unexposed wiring or cabling only. The intrabuilding port(s) of the equipment or subassembly must not be metallically connected to interfaces that connect to the OSP or its wiring. These interfaces are designed for use as intra-building interfaces only (Type 2 or Type 4 ports as described in GR-1089-CORE,
Issue 6) and require isolation from the exposed OSP cabling. The addition of Primary
Protectors is not sufficient protection in order to connect these interfaces metallically to
OSP wiring.
WARNING: The device must be connected to an external Special Protection
Device (SPD) when installed and connected to commercial AC power.
Palo Alto Networks Compliance Statement • 75
VCCI Statement
VCCI Statement
This section provides the compliance statement for the Voluntary Control Council for Interference by
Information Technology Equipment (VCCI), which governs radio frequency emissions in Japan.
The following information is in accordance to VCCI Class A requirements:
Translation: This is a Class A product. In a domestic environment this product may cause radio interference, in which case the user may be required to take corrective actions.
BSMI EMC Statement
User warning: This is a Class A product, when used in a residential environment it may cause radio interference. In this case, the user will be required to take adequate measures.
Manufacturer: Flextronics International
Country of Origin: Made in the USA with parts of domestic and foreign origin.
Input Frequency: 50-60 Hertz (Hz)
Input Voltage (AC): 100 to 240 Volts
BSMI EMC 聲明
警告使用者 :
這是甲類的資訊產品 , 在居住的環境中使用時 , 可能會造成射頻干擾 ,
在這種情況下 , 使用者會被要求採取某些適當的對策
製造商：偉創力國際
原產地：美國 / 部份零組件產地為美國及其它國家。
輸入頻率：50-60 赫茲（Hz）
輸入電壓（AC）：100 〜 240 伏特
76 • Compliance Statement Palo Alto Networks
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
High Performance
Modular Design
Up to 120 Gbps throughput
Hardware Redundancy
Dedicated Log Processing
2 terabytes of log storage
AC or DC Power Options
Frequently asked questions
The minimum cards required to operate the PA-7050 are one Switch Management Card (SMC), one Network Processing Card (NPC), and one Log Processing Card (LPC).
You can install up to six NPCs to expand system capacity.
Refer to https://www.paloaltonetworks.com/documentation for additional capabilities and configuration instructions.
The default URL for the MGT port is https://192.168.1.1.
The default login name and password is admin/admin.
