PaloAlto Networks M-300 Hardware Reference Manual
PaloAlto Networks M-300 is a multi-function appliance that can function in Panorama Management mode, Panorama Management-only mode, Panorama Log Collector mode, or PAN-DB Private Cloud mode. It features a 480GB SSD for storing the operating system and logs, plus optional HDDs for log storage. It boasts two 10GbE ports for high-speed network connectivity and a management port for remote access and configuration.
Advertisement
Advertisement
M-300 and M-700 Appliance Hardware Reference docs.paloaltonetworks.com Contact Informaon Corporate Headquarters: Palo Alto Networks 3000 Tannery Way Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-support.html About the Documentaon • For the most recent version of this guide or for access to related documentaon, visit the Technical Documentaon portal docs.paloaltonetworks.com. • To search for a specific topic, go to our search page docs.paloaltonetworks.com/search.html. • Have feedback or quesons for us? Leave a comment on any page in the portal, or write to us at documenta[email protected]. Copyright Palo Alto Networks, Inc. www.paloaltonetworks.com ©2021–2022 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/ trademarks.html. All other marks menoned herein may be trademarks of their respecve companies. Last Revised February 28, 2022 M-300 and M-700 Appliance Hardware Reference 2 ©2022 Palo Alto Networks, Inc. Table of Contents Before You Begin................................................................................................5 Upgrade/Downgrade Consideraons for Firewalls and Appliances................................ 6 Tamper Proof Statement............................................................................................................ 7 Third-Party Component Support............................................................................................. 8 Product Safety Warnings........................................................................................................... 9 M-300 and M-700 Appliance Overview.................................................... 13 M-300 M-300 M-700 M-700 Appliance Appliance Appliance Appliance Front Panel................................................................................................ 14 Back Panel................................................................................................. 16 Front Panel................................................................................................ 18 Back Panel................................................................................................. 20 Install the M-300 and M-700 Appliance....................................................23 Install the M-300 or M-700 Appliance in an Equipment Rack.......................................24 Install the M-300 Appliance in a 19” Equipment Rack......................................... 24 Install the M-700 Appliance in a 19” Equipment Rack......................................... 26 Connect Power to an M-300 or M-700 Appliance...........................................................30 Connect AC Power to an M-300 or M-700 Appliance.........................................30 Service the M-300 or M-700 Appliance.................................................... 31 Replace an M-300 or M-700 Drive...................................................................................... 32 Replace an M-300 or M-700 Appliance System Drive......................................... 32 Replace an M-300 or M-700 Appliance Log Drive................................................35 Replace an M-300 or M-700 Appliance Power Supply................................................... 40 M-300 and M-700 Appliance Port LEDs............................................................................ 41 M-300 and M-700 Appliance Specificaons............................................ 43 M-300 M-300 M-300 M-300 and M-700 Physical Specificaons......................................................................... 44 and M-700 Electrical Specificaons....................................................................... 45 and M-700 Environmental Specificaons............................................................. 46 and M-700 Miscellaneous Specificaons..............................................................47 M-300 and M-700 Appliance Hardware Compliance Statements....... 49 M-300 and M-700 Compliance Statements....................................................................... 50 M-300 and M-700 Appliance Hardware Reference 3 ©2022 Palo Alto Networks, Inc. Table of Contents M-300 and M-700 Appliance Hardware Reference 4 ©2022 Palo Alto Networks, Inc. Before You Begin Read the following topics before you install or service a Palo Alto Networks® nextgeneraon firewall or appliance. The following topics apply to all Palo Alto Networks firewalls and appliances except where noted. > Upgrade/Downgrade Consideraons for Firewalls and Appliances > Tamper Proof Statement > Third-Party Component Support > Product Safety Warnings 5 Before You Begin Upgrade/Downgrade Consideraons for Firewalls and Appliances The following table lists hardware features that have upgrade or downgrade impact. Make sure you understand all upgrade/downgrade consideraons before you upgrade or downgrade from the specified version of PAN-OS. Feature Release Upgrade Consideraons Downgrade Consideraons PA-7000 Log Forwarding Card (LFC) 10.0 If you are using an LFC with a PA-7000 Series Firewall, when you upgrade to PAN-OS 10.0, you must configure the management plane or dataplane interface for the service route because the LFC ports do not support the requirements for the service route. We recommend using the dataplane interface for the Data Services service route. n/a Upgrading a PA-7000 Series Firewall with a first generaon switch management card (PA-7050-SMC or PA-7080-SMC) PAN-OS 8.0 and later Before upgrading the firewall, run the following CLI command to check the flash drive’s status: debug system disk-smart-info disk-1. Before downgrading the firewall, run the following CLI command to check the flash drive’s status: debug system disk-smart-info disk-1. If the value for aribute ID #232, Available_Reservd_Space 0x0000, is greater than 20, then proceed with the upgrade. If the value is less than 20, then contact support for assistance. If the value for aribute ID #232, Available_Reservd_Space 0x0000, is greater than 20, then proceed with the downgrade. If the value is less than 20, then contact support for assistance. M-300 and M-700 Appliance Hardware Reference 6 ©2022 Palo Alto Networks, Inc. Before You Begin Tamper Proof Statement To ensure that products purchased from Palo Alto Networks were not tampered with during shipping, verify the following upon receipt of each product: • The tracking number provided to you electronically when ordering the product matches the tracking number that is physically labeled on the box or crate. • The integrity of the tamper-proof tape used to seal the box or crate is not compromised. • The integrity of the warranty label on the firewall or appliance is not compromised. (PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and therefore do not include a warranty label on the firewall. M-300 and M-700 Appliance Hardware Reference 7 ©2022 Palo Alto Networks, Inc. Before You Begin Third-Party Component Support Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party Component Support statement. M-300 and M-700 Appliance Hardware Reference 8 ©2022 Palo Alto Networks, Inc. Before You Begin Product Safety Warnings To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto Networks hardware, be sure you understand and prepare for the following warnings before you install or service the hardware. You will also see warning messages throughout the hardware reference where potenal hazards exist. All Palo Alto Networks products with laser-based opcal interfaces comply with 21 CFR 1040.10 and 1040.11. The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a specific hardware model is specified. • When installing or servicing a Palo Alto Networks firewall or appliance hardware component that has exposed circuits, ensure that you wear an electrostac discharge (ESD) strap. Before handling the component, make sure the metal contact on the wrist strap is touching your skin and that the other end of the strap is connected to earth ground. French Translaon: Lorsque vous installez ou que vous intervenez sur un composant matériel de pare-feu ou de disposif Palo Alto Networks qui présente des circuits exposés, veillez à porter un bracelet anstaque. Avant de manipuler le composant, vérifiez que le contact métallique du bracelet anstaque est en contact avec votre peau et que l’autre extrémité du bracelet est raccordée à la terre. • Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnec compliance (EMC) regulaons. French Translaon: Des câbles Ethernet blindés reliés à la terre doivent être ulisés pour garanr la conformité de l'organisme aux émissions électromagnéques (CEM). • (PA-3200, PA-5200, PA-5400, PA-7050, and PA-7080 firewalls only) At least two people are recommended for unpacking, handling, and relocang the heavier firewalls. • Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For details on the electrical range, refer to electrical specificaons in the hardware reference for your firewall or appliance. French Translaon: Veillez à ce que la tension d’alimentaon ne dépasse pas la plage d’entrée du pare-feu ou du disposif. Pour plus d’informaons sur la mesure électrique, consulter la rubrique des caractérisques électriques dans la documentaon de votre matériel de pare-feu ou votre disposif. • Do not replace a baery with an incorrect baery type; doing so can cause the replacement baery to explode. Dispose of used baeries according to local regulaons. French Translaon: Ne remplacez pas la baerie par une baerie de type non adapté, cee dernière risquerait d’exploser. Meez au rebut les baeries usagées conformément aux instrucons. • I/O ports are intended for intra-building connecons only and not intended for OSP (Outside Plant) connecons or any network connecons subject to external voltage surge events. M-300 and M-700 Appliance Hardware Reference 9 ©2022 Palo Alto Networks, Inc. Before You Begin • (All Palo Alto Networks appliances with two or more power supplies) Cauon: Shock hazard Disconnect all power cords (AC or DC) from the power inputs to fully de-energize the hardware. French Translaon: (Tous les appareils Palo Alto Networks avec au moins deux sources d’alimentaon) Débranchez tous les cordons d’alimentaon (c.a. ou c.c.) des entrées d’alimentaon et meez le matériel hors tension. • (PA-7000 Series firewalls only) Cauon: High touch current Connect to earth before connecng to the power supply. Ensure that the protecve earthing conductor is connected to the provided ground lug on the rear side of the firewall. • (PA-7000 Series firewalls only) When removing a fan tray from a PA-7000 Series firewall, first pull the fan tray out about 1 inch (2.5cm) and then wait a minimum of 10 seconds before extracng the enre fan tray. This allows the fans to stop spinning and helps you avoid serious injury when removing the fan tray. You can replace a fan tray while the firewall is powered on but you must replace it within 45 seconds and you can only replace one fan tray at a me to prevent the thermal protecon circuit from shung down the firewall. French Translaon: (Pare-feu PA-7000 uniquement) Lors du retrait d’un roir de venlaon d’un parefeu PA-7000, rerez tout d’abord le roir sur 2,5 cm, puis paentez au moins 10 secondes avant de rerer complètement le roir de venlaon. Cela permet aux venlateurs d’arrêter de tourner et permet d’éviter des blessures graves lors du retrait du roir. Vous pouvez remplacer un roir de venlaon lors de la mise sous tension du pare-feu. Toutefois, vous devez le faire dans les 45 secondes et vous ne pouvez remplacer qu’un roir à la fois, sinon le circuit de protecon thermique arrêtera le pare-feu. M-300 and M-700 Appliance Hardware Reference 10 ©2022 Palo Alto Networks, Inc. Before You Begin The following applies only to Palo Alto Networks firewalls that support a direct current (DC) power source: French Translaon: Les instrucons suivantes s’appliquent uniquement aux pare-feux de Palo Alto Networks prenant en charge une source d’alimentaon en courant connu (c.c.): • Do not connect or disconnect energized DC wires to the power supply. French Translaon: Ne raccordez ni débranchez de câbles c.c. sous tension à la source d’alimentaon. • The DC system must be earthed at a single (central) locaon. French Translaon: Le système c.c. doit être mis à la terre à un seul emplacement (central). • The DC supply source must be located within the same premises as the firewall. French Translaon: La source d’alimentaon c.c. doit se trouver dans les mêmes locaux que ce pare-feu. • The DC baery return wiring on the firewall must be connected as an isolated DC (DC-I) return. French Translaon: Le câblage de retour de baerie c.c. sur le pare-feu doit être raccordé en tant que retour c.c. isolé (CC-I). • The firewall must be connected either directly to the DC supply system earthing electrode conductor or to a bonding jumper from an earthing terminal bar or bus to which the DC supply system earthing electrode conductor is connected. French Translaon: Ce pare-feu doit être branché directement sur le conducteur à électrode de mise à la terre du système d’alimentaon c.c. ou sur le connecteur d'une barree/d'un bus à bornes de mise à la terre auquel le conducteur à électrode de mise à la terre du système d'alimentaon c.c. est raccordé. • The firewall must be in the same immediate area (such as adjacent cabinets) as any other equipment that has a connecon between the earthing conductor of the DC supply circuit and the earthing of the DC system. French Translaon: Le pare-feu doit se trouver dans la même zone immédiate (des armoires adjacentes par exemple) que tout autre équipement doté d’un raccordement entre le conducteur de mise à la terre du même circuit d’alimentaon c.c. et la mise à la terre du système c.c. • Do not disconnect the firewall in the earthed circuit conductor between the DC source and the point of connecon of the earthing electrode conductor. French Translaon: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre entre la source d'alimentaon c.c. et le point de raccordement du conducteur à électrode de mise à la terre. • Install all firewalls that use DC power in restricted access areas only. A restricted access area is where access is granted only to cra (service) personnel using a special tool, lock and key, or other means of security, and that is controlled by the authority responsible for the locaon. French Translaon: Tous les pare-feux ulisant une alimentaon c.c. sont conçus pour être installés dans des zones à accès limité uniquement. Une zone à accès limité correspond à une zone dans laquelle l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un oul spécial, cadenas ou clé, ou autre disposif de sécurité, et qui est contrôlée par l'autorité responsable du site. M-300 and M-700 Appliance Hardware Reference 11 ©2022 Palo Alto Networks, Inc. Before You Begin • Install the firewall DC ground cable only as described in the power connecon procedure for the firewall that you are installing. You must use the American wire gauge (AWG) cable specified and torque all nuts to the torque value specified in the installaon procedure for your firewall. French Translaon: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans la procédure de raccordement à l’alimentaon pour le pare-feu que vous installez. Ulisez le câble American wire gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la procédure d’installaon de votre pare-feu pare-feu. • The firewall permits the connecon of the earthed conductor of the DC supply circuit to the earthing conductor at the equipment as described in the installaon procedure for your firewall. French Translaon: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit d’alimentaon c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la procédure d’installaon du pare-feu. • A suitably-rated DC mains disconnect device must be provided as part of the building installaon. French Translaon: Un interrupteur d'isolement suffisant doit être fourni pendant l'installaon du bâment. M-300 and M-700 Appliance Hardware Reference 12 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview The Palo Alto Networks® M-300 and M-700 appliances are mul-funcon appliances that you can configure to funcon in Panorama™ Management mode, Panorama Management-only mode, Panorama Log Collector mode, or PAN-DB Private Cloud mode (M-700 only). First Supported Soware Release: Panorama 10.2 The following topics describe the hardware features of the M-300 and M-700 appliances. > M-300 Appliance Front Panel > M-300 Appliance Back Panel > M-700 Appliance Front Panel > M-700 Appliance Back Panel 13 M-300 and M-700 Appliance Overview M-300 Appliance Front Panel The following image shows the front panel of the M-300 appliance and the table describes each front-panel component. Item Component Descripon 1 System drive 480GB solid-state drive (SSD) used to store the operang system files and system logs. 2 Unique Idenficaon (UID) buon Use the UID feature to help you locate the appliance when you move from the front to the back of the equipment rack where the appliance is installed. When you push the UID buon to enable the UID feature, both the front-panel System informaon LED and the back-panel UID LED illuminate bright blue to help you locate the appliance when you move between opposite sides of the equipment rack. Push the UID buon again to deacvate these LEDs. 3 System informaon (overheat and UID) LED • Solid red—An overheat condion occurred. • Blinking red at the rate of one blink per second (1Hz)—A fan failure occurred. • Blinking red at the rate of one blink every four seconds (.25Hz)—One of the two power supplies is not providing power to the appliance (possibly because a power supply failed or because there is no power source connected to the power supply). • Solid blue—The UID feature is acvated (see the UID buon descripon). M-300 and M-700 Appliance Hardware Reference 14 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview Item Component Descripon 4 Network acvity LEDs Blinking green indicates network acvity. 5 Hard-disk drive (HDD) LED Blinking yellow indicates IDE channel acvity (SAS/ SATA drive) on the front log drives. 6 Power LED Solid green indicates that the appliance is powered on. 7 Reset buon Press this buon to reboot the appliance. 8 Power buon Press this buon to power on or power off the appliance. Powering off the appliance with this buon puts the appliance in standby power mode. To completely power off the appliance, you must disconnect the AC power cords from both power supplies. 9 Hard-disk drives (HDDs) Disk drive bays and HDDs used for log storage. By default, the M-300 ships with four HDDs installed in drive bays A1/A2 and B1/B2. Each pair of drives are in a RAID 1 configuraon (A1-A2 is a RAID 1 pair and B1-B2 is a RAID 1 pair). For details on storage capacity, refer to the Panorama Datasheet. 10 Hard-disk drive (HDD) LEDs Status LEDs—two for each log drive: • Top LED—Flashing blue indicates drive acvity. • Boom LED—Solid red indicates a log drive failure. M-300 and M-700 Appliance Hardware Reference 15 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview M-300 Appliance Back Panel The following image shows the back panel of the M-300 appliance and the table describes each back-panel component. Item Component Descripon 1 Power supplies Use the AC power supply inputs to connect power to the appliance. The second power supply is for redundancy. 2 Ethernet ports Two RJ-45 100Mbps/1Gbps/10Gbps Ethernet ports. While facing the back of the appliance, the ports are labeled as follows: The port labels are located on top of the appliance. • Le—Management (MGT) port used for managing the appliance and for data traffic. • Right—Ethernet1/1 For informaon on configuring these ports, refer to the Panorama™ Administrator’s Guide on the Technical Documentaon Portal for the release version running on your appliance. 3 USB ports Not used. 4 IPMI port Not used. M-300 and M-700 Appliance Hardware Reference 16 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview Item Component Descripon 5 Console port Use this port to connect a management computer to the appliance using a 9-pin serial cable and terminal emulaon soware. The console connecon provides access to appliance boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI). If your management computer does not have a serial port, use a USB-to-serial converter. Use the following sengs to configure your terminal emulaon soware to connect to the console port: • Data rate: 9600 • Data bits: 8 • Parity: None • Stop bits: 1 • Flow control: None 6 Unique Idenficaon (UID) LED UID LED that illuminates bright blue when you push the UID buon on the front of the appliance. For informaon on using the UID feature, see the UID buon descripon for the M-300 Appliance Front Panel. M-300 and M-700 Appliance Hardware Reference 17 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview M-700 Appliance Front Panel The following image shows the front panel of the M-700 appliance and the table describes each front-panel component. Item Component Descripon 1 Power buon Press this buon to power on or power off the appliance. Powering off the appliance with this buon puts the appliance in standby power mode. To completely power off the appliance, you must disconnect the AC power cords from both power supplies. 2 Reset buon Press this buon to reboot the appliance. 3 Power LED Solid green indicates that the appliance is powered on. 4 Power failure LED Solid red indicates that either a power supply failed or that there is no power source connected to a power supply. 5 Hard-disk drive (HDD) LED Blinking yellow indicates IDE channel acvity (SAS/ SATA drive) on the front log drives. M-300 and M-700 Appliance Hardware Reference 18 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview Item Component Descripon 6 System informaon (overheat and UID) LED • Solid red—An overheat condion occurred. • Blinking red at the rate of one blink per second (1Hz)—A fan failure occurred. • Blinking red at the rate of one blink every four seconds (.25Hz)—One of the two power supplies is not providing power to the appliance (possibly because a power supply failed or because there is no power source connected to the power supply). • Solid blue—The UID feature is acvated (see the UID buon descripon for the M-700 Appliance Back Panel.) 7 Hard-disk drives (HDDs) Disk drive bays and HDDs used for log storage. By default, the M-700 ships with four HDDs installed in drive bays A1/A2 and B1/B2. You can install up to eight addional drives (four addional RAID 1 pairs) in the remaining drive bays (C1/C2, D1/D2, E1/E2, and F1-F2) to increase log storage capacity. Each pair of drives are in a RAID 1 configuraon. For example, A1-A2 is a RAID 1 pair and B1-B2 is a RAID 1 pair. For details on storage capacity, refer to the Panorama Datasheet. For details on adding addional storage to the appliance, refer the Panorama Administrator’s Guide on the Technical Documentaon Portal for the release version running on your appliance. 8 Hard-disk drive (HDD) LEDs Status LEDs—two for each log drive: • Top LED—Flashing blue indicates drive acvity. • Boom LED—Solid red indicates a log drive failure. M-300 and M-700 Appliance Hardware Reference 19 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview M-700 Appliance Back Panel The following image shows the back panel of the M-700 appliance and the table describes each back-panel component. Item Component Descripon 1 System drive 480GB solid-state drive (SSD) used to store the operang system files and system logs. 2 Power supplies Use the AC power supply inputs to connect power to the appliance. The second power supply is for redundancy. 3 Ethernet ports Two RJ-45 100Mbps/1Gbps/10Gbps Ethernet ports. While facing the back of the appliance, the ports are labeled as follows: The port labels are located on top of the appliance. • Le—Management (MGT) port used for managing the appliance and for data traffic. • Right—Ethernet1/1 For informaon on configuring these ports, refer to the Panorama™ Administrator’s Guide on the Technical Documentaon Portal for the release version running on your appliance. If the appliance M-300 and M-700 Appliance Hardware Reference 20 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview Item Component Descripon is in PAN-DB mode, refer to the appropriate release-specific PAN-OS® Administrators Guide. 4 USB ports Not used. 5 IPMI port Not used. 6 Console port Use this port to connect a management computer to the appliance using a 9-pin serial cable and terminal emulaon soware. The console connecon provides access to appliance boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI). If your management computer does not have a serial port, use a USB-to-serial converter. Use the following sengs to configure your terminal emulaon soware to connect to the console port: • Data rate: 9600 • Data bits: 8 • Parity: None • Stop bits: 1 • Flow control: None 7 Unique Idenficaon (UID) buon and LED M-300 and M-700 Appliance Hardware Reference Use the UID feature to help you locate the appliance when you move from the back to the front of the equipment rack where the appliance is installed. When you push the UID buon to enable the UID feature, both the front-panel System informaon LED and the back-panel UID LED illuminate bright blue to help you locate the appliance when you move between opposite sides of the equipment rack. The back-panel UID LED is located to the right of the UID buon. Push the UID buon again to deacvate these LEDs. 21 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Overview Item Component Descripon The UID buon is very small and is located to the le of the UID LED. Use a small object, such as a paper clip, to press the buon. 8 SFP+ ports Two SFP+ (10Gbps) ports. While facing the back of the appliance, the le port is labeled Ethernet 1/3 and the right port is labeled Ethernet 1/2. The port labels are located on top of the appliance. For informaon on configuring these ports, refer to the Panorama™ Administrator’s Guide on the Technical Documentaon Portal for the release running on your appliance. If the appliance is in PAN-DB mode, refer to the appropriate releasespecific PAN-OS® Administrators Guide. M-300 and M-700 Appliance Hardware Reference 22 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance The following topics describe how to install the M-300 and M-700 appliances in an equipment rack and how to connect power to them. > Install the M-300 or M-700 Appliance in an Equipment Rack > Connect Power to an M-300 or M-700 Appliance 23 Install the M-300 and M-700 Appliance Install the M-300 or M-700 Appliance in an Equipment Rack The following topics describe how to install the M-300 and M-700 appliances in an equipment rack. • Install the M-300 Appliance in a 19” Equipment Rack • Install the M-700 Appliance in a 19” Equipment Rack Install the M-300 Appliance in a 19” Equipment Rack The following procedure describes how to install the M-300 appliance in a four-post equipment rack (shipped with the appliance). The rack kit includes the hardware required to install the appliance in most equipment racks. Extra screws and washers are included. STEP 1 | Aach the inner rail sets (two each) to each side of the appliance by aligning the square holes on each rail with the rail hooks on the appliance and then sliding the rails toward the front of the appliance to engage the hooks. Secure the back inner-rails using two M4 screws for each rail and secure the front inner-rails using one M4 screw for each rail. The inner-rails also use pressure-lock clips that lock the rails to the appliance. Remove the two M4 screws and pull the metal tab on the clips to remove the rail from the appliance. STEP 2 | Install one outer rack-mount rail assembly (two rails each) on each side of the equipment rack. Push the rail buons in on the ends of the rails, insert the studs in to the square rack M-300 and M-700 Appliance Hardware Reference 24 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance holes, and then release the buons to secure the rails to the rack. The following image shows the right side of the rack if you are facing the front of the rack. To remove the outer rails from the rack, you must pull the release clips located at the front and back end of each rail assembly to release the rails from the rack. STEP 3 | Install the firewall in to the equipment rack by sliding the inner-rails in to the outer rackmount rails unl the appliance stops (about halfway in to the rack). Push the inner-rail release clips on each side of the two rails (push the le clip up and the right clip down) to release M-300 and M-700 Appliance Hardware Reference 25 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance the appliance and then connue to slide the appliance in to the rack unl the front of the appliance is flush with the front of the rack. The inner-rail release clips are shown in step 1. STEP 4 | Secure the front of the appliance to the rack by turning the front thumb screws on each rail clockwise unl ght. Secure the back rail to the rack using one M5 screw (with washer) for each rail. Install the M-700 Appliance in a 19” Equipment Rack The following procedure describes how to install the M-700 appliance in a four-post equipment rack (shipped with the appliance). The rack kit includes the hardware required to install the appliance in most equipment racks. Extra screws and washers are included. STEP 1 | Aach the inner-rails to each side of the appliance by aligning the square holes on each rail with the rail hooks on the appliance and then sliding the rails toward the front of the M-300 and M-700 Appliance Hardware Reference 26 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance appliance to engage the hooks. Secure the back part of each rail to the appliance using one M4 screw for each rail. The inner-rails also use a pressure-lock clip (one on each rail) that locks the rails to the appliance. Remove the M4 screw and pull the metal tab on the clip to remove the rail from the appliance. STEP 2 | Install one outer rack-mount rail to each side of the equipment rack. Push the two rail hooks (on the front and back of each rail) in to the square rack holes and push down to engage the hooks. The release buons located above each rail hook will depress as you push the rail hooks in to the square holes. Secure the back of each rail to the rack using two M5 screws M-300 and M-700 Appliance Hardware Reference 27 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance (with washers) for each rail. The following image shows the right side of the rack if you are facing the front of the rack. STEP 3 | Install the appliance in to the equipment rack by sliding the inner-rails in to the outer rackmount rails unl the appliance stops (about halfway in to the rack). Push the inner-rail release clips on each side of the two rails to release the appliance and then connue to slide the M-300 and M-700 Appliance Hardware Reference 28 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance appliance in to the rack unl the front of the appliance is flush with the front of the rack. The inner-rail release clips are shown in step 1. STEP 4 | Secure the front of the appliance to the rack by turning the front thumb screws on each rail clockwise unl ght. M-300 and M-700 Appliance Hardware Reference 29 ©2022 Palo Alto Networks, Inc. Install the M-300 and M-700 Appliance Connect Power to an M-300 or M-700 Appliance M-300 and M-700 appliances have two AC power supplies (the second power supply is for redundancy). For details on power requirements and power consumpon, see M-300 and M-700 Electrical Specificaons. • Connect AC Power to an M-300 or M-700 Appliance Connect AC Power to an M-300 or M-700 Appliance The following procedure describes how to connect AC power to an M-300 or M-700 appliance. To avoid injury to yourself or damage to your Palo Alto Networks® hardware or the data that resides on the hardware, read the Product Safety Warnings. STEP 1 | Plug two AC power cables (provided) in to grounded wall outlets. Connect the second power cord through a different circuit breaker to provide power redundancy and to allow for electrical circuit maintenance. STEP 2 | Insert one power cord in to each of the two power supplies on the back of the appliance. STEP 3 | Press the power buon on the front of the appliance. If only one power supply is connected, a warning beep will sound. M-300 and M-700 Appliance Hardware Reference 30 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance The following topics describe how to replace serviceable components on an M-300 or M-700 appliance. > Replace an M-300 or M-700 Drive > Replace an M-300 or M-700 Appliance Power Supply For informaon on interpreng the front-panel LEDs, see M-300 and M-700 Appliance Port LEDs. 31 Service the M-300 or M-700 Appliance Replace an M-300 or M-700 Drive M-300 and M-700 appliances store the Panorama™ system files and system logs on a single solidstate drive (SSD) and the logs collected from Palo Alto Networks® firewalls are stored on harddisk drives (HDDs). The HDD log drives are in RAID 1 arrays so that if a drive fails, you can replace the failed drive without service interrupon. • Replace an M-300 or M-700 Appliance System Drive • Replace an M-300 or M-700 Appliance Log Drive Replace an M-300 or M-700 Appliance System Drive If the system drive fails, the appliance aempts to boot the Maintenance Recovery Tool (MRT) where you can view error messages and drive status. If the MRT is not bootable, power down the appliance. For assistance in verifying the status of the drive to determine if it should be replaced, contact Palo Alto Networks Support. The only difference between replacing an M-300 and M-700 appliance system drive is that the system drive on an M-300 appliance is located on the front panel of the appliance (see M-300 Appliance Front Panel) and the system drive on the M-700 appliance is located on the back panel of the appliance (see M-700 Appliance Back Panel). Replacement drives ship with a factory default Panorama image with the default configuraon. Aer you install the new drive, you will need to obtain a backup configuraon that you saved from the failed appliance to restore your configuraon. To avoid injury to yourself or damage to your Palo Alto Networks® hardware or the data that resides on the hardware, read the Product Safety Warnings. STEP 1 | Power off the appliance by pressing the power buon on the front of the appliance and then remove the AC power cords. M-300 and M-700 Appliance Hardware Reference 32 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance STEP 2 | Press the ejector buon on the system drive carrier to release the carrier handle and gently pull the handle toward you to remove the carrier and drive. The following image shows an M-700 system drive; the M-300 system drive is similar. STEP 3 | Remove the replacement drive from the packaging and place it on an anstac surface. M-300 and M-700 Appliance Hardware Reference 33 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance STEP 4 | Install the replacement drive in the drive carrier of the failed drive. 1. Place the failed drive next to the replacement drive with the connectors facing the same direcon. 2. Remove the four screws that hold the failed drive in the carrier and remove the drive from the carrier. 3. Install the replacement drive in the carrier and secure it using the four screws you removed from the failed drive. M-300 and M-700 Appliance Hardware Reference 34 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance STEP 5 | Install the replacement drive in the appliance. 1. Ensure that the drive carrier lever is in the open posion; if it is not, press the ejector buon on the drive carrier to release the lever and pull it out unl it is fully open. 2. Slide the replacement drive and carrier assembly in to the empty drive bay unl it is about 1/4” (.6cm) from being fully inserted. 3. Before fully inserng the drive carrier, ensure that the lever aaches to the locking mechanism on the appliance and then close the lever to seat the carrier. STEP 6 | Power on the appliance and connect a standard RJ-45 Ethernet cable from the RJ-45 port on your computer to the MGT port on the appliance. STEP 7 | Change the IP address on your computer to an address in the 192.168.1.0/24 network, such as 192.168.1.2. STEP 8 | From a web browser, go to hps://192.168.1.1 and when prompted, log in to the web interface using the default username and password (admin/admin). STEP 9 | Perform the following steps to restore the appliance: 1. Configure the appliance to access your management network (Device > Support > Interfaces). 2. Acvate the Support license (Device > Support). 3. Acvate licenses and subscripons (Device > Licenses). 4. Upgrade or downgrade the appliance so that the soware version matches the version that was installed on the failed drive. 5. Import a recent backup configuraon to restore the appliance configuraon (Device > Operaons Configuraon Management). For informaon on configuring management access on an M-Series appliance, refer to Perform Inial Configuraon of the M-Series Appliance in the Panorama™ Administrator’s guide located on the Technical Documentaon portal. For informaon on how to upgrade or downgrade an M-Series appliance, refer to the Install Content and Soware Updates for Panorama in the Panorama Administrator’s guide. Replace an M-300 or M-700 Appliance Log Drive The M-300 and M-700 appliance log drives are located on the front of the appliance. Each drive pair (A1 and A2 for example) is in an independent RAID 1 array. This redundant configuraon helps ensure that there is no service interrupon or loss of log data if a disk drive fails. When requesng a replacement log drive from Palo Alto Networks® or an authorized reseller, you will receive two new drives. The second drive is required if the failed drive is a different model than the replacement drive. In this case, replace both drives in the RAID 1 array that contains the failed drive so both drives in the array are the same model. Do not aempt to replace an M-300 or M-700 log drive with a third-party drive. Also, do not mix drive models within a RAID 1 array—the drive model must be the same for both drives in a RAID 1 array. You can, however, mix drive models in different RAID 1 arrays. For example, the drives in the A1/A2 array can both be model ST91000640NS and the drives in the B1/B2 array can both be model ST1000NX0423. M-300 and M-700 Appliance Hardware Reference 35 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance The following procedure describes how to replace a log drive on an M-300 or M-700 appliance that is in Panorama™ mode or Panorama log collector mode. This procedure does not apply to an appliance in PAN-DB mode (M-700 only) or Panorama Managementonly mode because the front log drives are not used for these modes. STEP 1 | Idenfy the failed drive and record the drive model number by running the following operaonal command and viewing the status and model fields: admin@hostname> show system raid detail For example, the following output shows that disk drive A2 failed and the drive model is ST8000NM0055-1RM. Disk Pair A Available Status clean, degraded Disk id A1 Present model : ST8000NM0055-1RM size : 7630885 MB status : active sync Disk id A2 Present model : ST8000NM0055-1RM size : 7630885 MB status : failed STEP 2 | Remove the failed drive from the RAID 1 array. In this example, run the following command to remove drive A2 from the array: admin@hostname> request system raid remove A2 M-300 and M-700 Appliance Hardware Reference 36 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance STEP 3 | Press the ejector buon on the carrier of the failed drive (A2 in this example) to release the carrier handle and gently pull the handle toward you and slide the carrier out of the appliance. STEP 4 | Remove the replacement drive from the packaging and compare the drive model wrien on the label with the drive model of the failed drive. Proceed as follows based on your findings: • If the replacement drive is the same model number of the failed drive that you removed, then connue to Step 5. • If the replacement drive is a different model number than the drive that you removed, then connue to Step 6. STEP 5 | (Same model replacement drive only) Install a replacement disk drive that is the same model as the other drive in the RAID 1 array. 1. Ensure that the drive carrier lever on the replacement drive is in the open posion; if it is not, press the ejector buon on the drive carrier to release the lever and pull it out unl it is fully open. 2. Slide the drive carrier in to the drive bay on the appliance unl it is about 1/4” from being fully inserted. You can do this by pressing the ejector buon on the carrier, which M-300 and M-700 Appliance Hardware Reference 37 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance will cause the lever to close part way. When the drive carrier is almost fully inserted, close the lever to seat the drive. 3. Add the replacement drive to the RAID 1 array. In this example, run the following command to add drive A2 to the array: admin@hostname> request system raid add A2 The system automacally configures the new drive to mirror contents of the other drive in that RAID 1 array. 4. Connue to view RAID status by periodically re-entering the following command unl you see that the disk pair (Disk Pair A in this example) shows Available and both drives show the status active sync. admin@hostname> show system raid detail The following output shows that the RAID 1 array is funconing properly: Disk Pair A Available Status cleanDisk id A1 Present model : ST8000NM0055-1RM size : 7630885 MB status : active sync Disk id A2 Present model : ST8000NM0055-1RM size : 7630885 MB status : active sync STEP 6 | (Different model replacement drive only) Install a replacement disk drive that is a different model than the other (sll funconing) drive in the RAID 1 array: When you iniate the copy command as described in the following steps, logging and log query will not be available on the disk pair unl the copy is complete and the disk pair shows Available. If the other drive pairs (B1/B2, C1/C2, and so on) are low on disk space during the copy process, older logs are deleted to make room for new logs. 1. Ensure that the drive carrier lever on the replacement drive is in the open posion; if it is not, press the ejector buon on the drive carrier to release the lever and pull it out unl it is fully open. 2. Slide the drive carrier in to the drive bay on the appliance unl it is about 1/4” from being fully inserted. You can do this by pressing the ejector buon on the carrier, which M-300 and M-700 Appliance Hardware Reference 38 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance will cause the lever to close part way. When the drive carrier is almost fully inserted, close the lever to seat the drive. 3. Copy the data from the exisng drive in the RAID 1 array to the replacement drive. In this example, run the following command to copy the data from drive A1 to drive A2: admin@hostname> request system raid copy from A1 to A2 4. Connue to view RAID status by periodically re-entering the following command unl you see that the disk pair (A in this example) shows Available admin@hostname> show system raid detail In this example, the output shows that Disk Pair A is Available. At this point, drive A1 will show notin use because there is a drive model mismatch. 5. Install the second replacement drive. In this example, physically remove the drive from bay A1, install it in the carrier, and then install the second replacement drive in to bay A1 —one that is the same model as the new drive you installed in bay A2. 6. Add the second replacement drive to the RAID 1 array. In this example, run the following command to add drive A1 to the array: admin@hostname> request system raid add A1 The system will automacally configure the new drive to mirror the contents of the other drive (A2 in this example) in that RAID 1 array. 7. Connue to view RAID status by periodically re-entering the following command unl you see that the disk pair (A in this example) shows Available and both drives show the status active sync. admin@hostname> show system raid detail The following output shows that the RAID 1 array is funconing properly: Disk Pair A Available Status clean Disk id A1 Present model : ST8000NM0055-1RM size : 7630885 MB status : active sync Disk id A2 Present model : ST8000NM0055-1RM size : 7630885 MB status : active sync M-300 and M-700 Appliance Hardware Reference 39 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance Replace an M-300 or M-700 Appliance Power Supply M-300 and M-700 appliances have two AC power supplies (the second power supply is for redundancy). If one power supply fails, you can replace it without service interrupon as described in the following procedure. STEP 1 | Idenfy the failed power supply by viewing the power supply LED on the back of the appliance; when there is a failure, the LED turns solid yellow or turns off. The front panel system informaon LED also blinks red. STEP 2 | Disconnect the power cord from the failed power supply. STEP 3 | Grasp the handle on the failed power supply and simultaneously press the release lever to the le and then pull the power supply outward to remove it. STEP 4 | Remove the replacement power supply from the packaging and slide it in to the empty power supply slot. Push the power supply all the way in unl the release lever clicks and secures the power supply. STEP 5 | Connect the AC power cord to the power supply input. The power supply LED turns green and the front system informaon LED stops blinking red. M-300 and M-700 Appliance Hardware Reference 40 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance M-300 and M-700 Appliance Port LEDs The following table describes how to interpret the status of port LEDs on M-300 and M-700 appliances. The only difference between the port LEDs on these appliances is that the M-700 appliance has two addional SFP+ port LEDs. For informaon on interpreng the front-panel system LEDs, see M-300 Appliance Front Panel or M-700 Appliance Front Panel descripons. LED Descripon RJ-45 Ethernet port LEDs LNK (Link) LED • Off—No link • Green—100Mbps link • Yellow—1Gbps link ACT (Acvity) LED Flashing yellow indicates network acvity. SFP+ port LEDs (M-700 appliance only) LNK (Link) LED • Off—No link • Green—1Gbps link • Yellow—10Gbps link ACT (Acvity) LED M-300 and M-700 Appliance Hardware Reference Flashing yellow indicates network acvity. 41 ©2022 Palo Alto Networks, Inc. Service the M-300 or M-700 Appliance M-300 and M-700 Appliance Hardware Reference 42 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Specificaons The following topics describe the M-300 and M-700 appliance hardware specificaons. For feature, capacity, and performance informaon, refer to the Panorama™ Datasheet. > M-300 and M-700 Physical Specificaons > M-300 and M-700 Electrical Specificaons > M-300 and M-700 Environmental Specificaons > M-300 and M-700 Miscellaneous Specificaons 43 M-300 and M-700 Appliance Specificaons M-300 and M-700 Physical Specificaons The following table describes M-300 and M-700 appliance physical specificaons. Specificaon Value Rack units (U) and dimensions • M-300 appliance • Rack unit—1U • Dimensions—1.7” H x 29” D x 17.2” W (4.32cm H x 73.67cm D x 43.69cm W) • M-700 appliance • Rack unit—2U • Dimensions—3.5” H x 28.46” D x 17.2” W (8.89cm H x 72.29cm D x 43.69cm W) • M-300 appliance Weight • Appliance weight—26lbs (11.79Kg) • Shipping weight—41lbs (18.59Kg) • M-700 appliance • Appliance weight—36lbs (16.33Kg) • Shipping weight—72lbs (32.66Kg) M-300 and M-700 Appliance Hardware Reference 44 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Specificaons M-300 and M-700 Electrical Specificaons The following table describes M-300 and M-700 appliance electrical specificaons. Specificaon Value Power Supplies M-300 and M-700 appliances—Two 1200W AC power supplies; the second power supply is for redundancy. Input voltage and frequency M-300 and M-700 appliance—100-240VAC (50-60Hz) Power consumpon • M-300 appliance—330W • M-700 appliance—486W Maximum current consumpon M-300 and M-700 appliance—9.5A@100VAC, 4.5A@240VAC Maximum inrush current (per power supply) • M-300 appliance—35A • M-700 appliance—35A M-300 and M-700 Appliance Hardware Reference 45 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Specificaons M-300 and M-700 Environmental Specificaons The following table describes M-300 and M-700 appliance environmental specificaons. Specificaon Value Operang temperature range M-300 and M-700 appliance—41ºF to 104ºF (5ºC to 40ºC) Non-operang temperature M-300 and M-700 appliance— -40ºF to 140ºF (-40ºC to 60ºC) Humidity tolerance M-300 and M-700 appliance: • Operang relave humidity (noncondensing)—8% to 90% • Non-operang relave humidity (noncondensing)—5% to 95% Airflow M-300 and M-700 appliance—Front-to-back Maximum BTU/hr • M-300 appliance—1,114BTU/hr (127VAC) and 1,090BTU/hr (240VAC) • M-700 appliance—1,803BTU/hr (127VAC) and 1,765BTU/hr (240VAC Electromagnec Interference (EMI) M-300 and M-700 appliance—FCC Part 15, EN 55032, CISPR 32 Maximum operang altude M-300 and M-700 appliance—7,500 (2,286m) M-300 and M-700 Appliance Hardware Reference 46 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Specificaons M-300 and M-700 Miscellaneous Specificaons The following table describes M-300 and M-700 appliance miscellaneous specificaons. Specificaon Value Mean me between failures (MTBF) • M-300 appliance—10 years • M-700 appliance—8 years M-300 and M-700 Appliance Hardware Reference 47 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Specificaons M-300 and M-700 Appliance Hardware Reference 48 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Hardware Compliance Statements Palo Alto Networks® obtains regulatory compliance cerficaons to comply with the laws and regulaons in each country where there are requirements applicable to our products. Our products meet standards for product safety and electromagnec compability when used for their intended purpose. To view compliance statements for the M-300 and M-700 appliances, see M-300 and M-700 Compliance Statements. 49 M-300 and M-700 Appliance Hardware Compliance Statements M-300 and M-700 Compliance Statements • BSMI EMC Statement—User warning: This is a Class A product. When used in a residenal environment it may cause radio interference. In this case, the user will be required to take adequate measures. • Manufacturer—Super Micro Computer, Inc. • Country of Origin—Made in the USA with parts of domesc and foreign origin. • CE (European Union (EU) Electromagnec Compability Direcve)—This device is herewith confirmed to comply with the requirements set out in the Council Direcve on the Approximaon of the Laws of the Member States relang to Electromagnec Compability Direcve (2014/30/EU). The above product conforms with Low Voltage Direcve 2014/35/EU and complies with the requirements relang to electrical equipment designed for use within certain voltage limits. • Federal Communicaons Commission (FCC) statement for a Class A digital device or peripheral—This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protecon against harmful interference in a residenal installaon. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instrucons, may cause harmful interference to radio communicaons. However, there is no guarantee that interference will not occur in a parcular installaon. If this equipment does cause harmful interference to radio or television recepon, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: • Reorient or relocate the receiving antenna. • Increase the separaon between the equipment and receiver. • Connect the equipment to an outlet on a circuit that is different from the one to which the receiver is connected. • Consult the dealer or an experienced radio/TV technician for help. • ICES (Canadian Department Compliance Statement)—This Class A digital apparatus complies with Canadian ICES-003. French translaon: Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada. • Korean Communicaons Commission (KCC) Class A Statement—This equipment is an electromagnec compable device for business purposes (Class A). The provider or user should be aware that the equipment is intended for use outside the home. • Technischer Überwachungsverein (TUV) Risk of explosion if baery is replaced by an incorrect type. Dispose of used baery according to local regulaons. M-300 and M-700 Appliance Hardware Reference 50 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Hardware Compliance Statements • VCCI—This secon provides the compliance statement for the Voluntary Control Council for Interference by Informaon Technology Equipment (VCCI), which governs radio frequency emissions in Japan. The following informaon is in accordance to VCCI Class A requirements: Translaon: This is a Class A product. In a domesc environment this product may cause radio interference, in which case the user may be required to take correcve acons. M-300 and M-700 Appliance Hardware Reference 51 ©2022 Palo Alto Networks, Inc. M-300 and M-700 Appliance Hardware Compliance Statements M-300 and M-700 Appliance Hardware Reference 52 ©2022 Palo Alto Networks, Inc. ">
Download
Advertisement
Key features
Panorama management
Log collection
High-speed networking
Redundant power supplies
Expandable storage
Frequently asked questions
The M-300 appliance comes with four hard drives installed by default. You can add up to four additional hard drives to increase the log storage capacity.
The UID button helps you locate the appliance by illuminating LEDs on the front and back panels when you press it. This allows you to easily find the appliance in a crowded rack.
The console port allows you to connect to the appliance using a serial cable and terminal emulation software. This provides access to boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).