Fortinet FIM-7920E User manual

FIM-7920E Interface Module Guide
7000

FORTINET DOCUMENTLIBRARY
http://docs.fortinet.com
FORTINETVIDEOGUIDE
http://video.fortinet.com
FORTINETBLOG
https://blog.fortinet.com
CUSTOMERSERVICE&SUPPORT
https://support.fortinet.com
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATECOOKBOOK
http://cookbook.fortinet.com
FORTINETTRAININGSERVICES
http://www.fortinet.com/training
FORTIGUARDCENTER
http://www.fortiguard.com
FORTICAST
http://forticast.fortinet.com
ENDUSER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [e-mail]
Friday, June 23, 2017
FIM-7920E Interface Module Guide
01-540-411351-20170623

TABLEOFCONTENTS
FIM-7920E interface module 5
Physical Description 6
Front panel LEDs 6
Front panel connectors 7
FIM-7920E C1 to C 4 interface combinations 8
Supported transceivers and breakout cables 8
Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces 9
Changing the interface type 9
Splitting the C1 to C4 interfaces 9
Turning the module on and off 10
NMI switch 10
FIM-7920E hardware architecture 10
Hardware installation 12
Installing QSFP28, QSFP+, SFP+, and SFP transceivers 12
To install transceivers 12
FIM-7920E mounting components 13
Inserting a FIM-7920E module into a chassis 14
Shutting down and removing a FIM-7920E board from a chassis 18
Troubleshooting 20
FIM-7920E does not startup 21
FIM-7920E status LED is flashing during system operation 21
Quick FIM-7920E configuration 22
Registering your FortiGate-7000 series products 22
Choosing the configuration tool 22
Changing network settings 22
Cautions and Warnings 24
Environmental Specifications 24
Safety 24
Regulatory Notices 25
Federal Communication Commission (FCC) – USA 25
Industry Canada Equipment Standard for Digital Equipment (ICES) – Canada 25
European Conformity (CE) - EU 25
Voluntary Control Council for Interference (VCCI) – Japan 26
Bureau of Standards Metrology and Inspection (BSMI) – Taiwan 26

China 26

FIM-7920E interface module
FIM-7920E interface module
The FIM-7920E interface module is a hot swappable module that provides data, management and session
sync/heartbeat interfaces, base backplane switching and fabric backplane session-aware load balancing for a
FortiGate-7000 series chassis. The FIM-7920E includes an integrated switch fabric and DP2 processors to load
balance millions of data sessions over the chassis fabric backplane to FPM processor modules.
The FIM-7920E can be installed in any FortiGate-7000 series chassis. Normally you would install two FIM-7920E
modules in chassis hub/switch slots 1 or 2. Two FIM-7920Es provide a total of eight Quad Small Form-factor
Pluggable 28 (QSFP28) 100GigE interfaces for a FortiGate-7000 chassis. Using a 100GBASE-SR4 QSFP28 or
40GBASE-SR4 QSFP+ transceiver, each QSFP28 interface can also be split into four 10GBASE-SR interfaces.
You can also install FIM-7920Es in a second chassis and operate the chassis in HA mode with another set of
processor modules to provide chassis failover protection.
FIM-7920E front panel
FIM-7920E
Sliding
Latch
Handle
Retention
Screw Handle
Sliding
Latch
Retention
Screw
C1 to C4
100GigE Fabric Channel
QSFP28 Network
Interfaces (data)
M1 and M2 10GigE Base
Channel SFP+ Interfaces
(heartbeat and management)
MGMT1 - MGMT4
10/100/1000BASE-T Copper
Management Interface
Status, Alarm
HA and Power
LEDS
USB
Power
Button
NMI
Button
The FIM-7920E includes the following hardware features:
lFour front panel 100GigE QSFP28 fabric channel interfaces (C1 to C4). These interfaces are connected to
100Gbps networks to distribute sessions to the FPM processor modules installed in chassis slots 3 and up. Using a
100GBASE-SR4 QSFP28 or 40GBASE-SR4 QSFP+ transceiver, each QSFP28 interface can also be split into four
10GBASE-SR interfaces. These interfaces also support creating link aggregation groups (LAGs) that can include
interfaces from both FIM-7920Es.
lTwo front panel 10GigE SFP+ interfaces (M1 and M2) that connect to the base backplane channel. These
interfaces are used for heartbeat, session sync, and management communication between FIM-7920Es in different
chassis. These interfaces can also be configured to operate as Gigabit Ethernet interfaces using SFP transceivers,
but should not normally be changed. If you use switches to connect these interfaces, the switch ports should be
able to accept packets with a maximum frame size of at least 1526. The M1 and M2 interfaces need to be on
different broadcast domains. If M1 and M2 are connected to the same switch, Q-in-Q must be enabled on the
switch.
lFour 10/100/1000BASE-T out of band management Ethernet interfaces (MGMT1 to MGMT4).
lOne 80Gbps fabric backplane channel for traffic distribution with each FPM module installed in the same chassis as
the FIM-7920E.
5 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

FIM-7920E interface module Physical Description
lOne 1Gbps base backplane channel for base backplane with each FPM module installed in the same chassis as the
FIM-7920E.
lOne 40Gbps fabric backplane channel for fabric backplane communication with the other FIM-7920E in the chassis.
lOne 1Gbps base backplane channel for base backplane communication with the other FIM-7920E in the chassis.
lOn-board DP2 processors and an integrated switch fabric to provide high-capacity session-aware load balancing.
lOne front panel USB port.
lPower button.
lNMIswitch (for troubleshooting as recommended by Fortinet Support).
lMounting hardware.
lLED status indicators.
Physical Description
Dimensions 1.2 x 11.34 x 14 in. (3.1 x 28.8 x 35.1 cm) (Height x Width x Depth)
Weight 7.2 lb. (3.23 kg)
Operating Temperature 32 to 104°F (0 to 40°C)
Storage Temperature -31 to 158°F (-35 to 70°C)
Relative Humidity 10% to 90% (Non-condensing)
Front panel LEDs
From the FIM-7920E font panel you can view the status of the module LEDs to verify that the module is
functioning normally.
LED State Description
STATUS
Off The FIM-7920E is powered off.
Green The FIM-7920E is powered on and operating normally.
Flashing
Green
The FIM-7920E is starting up.
ALARM
Red Major alarm.
Amber Minor alarm
Off No alarms
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
6

Front panel connectors FIM-7920E interface module
LED State Description
HA
Off The FIM-7920E is operating in normal mode.
Green The FIM-7920E is operating in HA mode.
Red A failover has occurred
POWER
Green The FIM-7920E is powered on and operating normally.
Off The FIM-7920E is powered off.
C1 to C4
Green The correct cable is connected to the interface and the connected equipment has
power and is connected at 100Gbps or 40Gbps. If the port is split the LED will
light as long as at least one of the 10Gbps connections is active.
Flashing
Green Network activity at the interface.
Off No link is established.
M1 and M2
Green The correct cable is connected to the interface and the connected equipment has
power.
Flashing
Green
Network activity at the interface.
Off No link is established.
MGMT1-4
Link/Act
Solid
Green
Indicates this interface is connected with the correct cable and the attached
network device has power.
Blinking
Green Indicates network traffic on this interface.
Off No Link
MGMT1-4
Speed
Green Connection at 1Gbps.
Amber Connection at 100Mbps.
Off Connection at 10Mbps.
Front panel connectors
You connect the FIM-7920E to your 100Gbps networks using the C1 to C4 front panel QSFP28 interfaces. The
front panel also includes M1 and M2 SFP+ interfaces for the base channel, four Ethernet management interfaces
7 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

FIM-7920E interface module FIM-7920E C1 to C 4 interface combinations
(MGMT1 to MGMT4), and a USB port. The USB port can be used with any USB key for backing up and restoring
configuration files.
Connector Type Speed Protocol Description
USB USB 3.0
Type A
USB 3.0
USB 2.0
Standard USB connector.
C1 to C4 QSFP28 100Gbps/40Gbps/10Gbps Ethernet 100GbE/40GbE connections using
100GBASE-SR4 QSFP28 transceivers
or 40GBASE-SR4 QSFP+ transceivers,
or 4X10GbE connections using breakout
cables.
M1 and M2 SFP+ 10Gbps/1Gbps Ethernet 10GbE connection (using SFP
transceiver). For heartbeat and
synchronization between chassis. 1GbE
not recommended.
MGMT1 to
MGMT4
RJ-45 10/100/1000Mbps Ethernet 10/100/1000BASE-T copper connection
for management or system
administration.
FIM-7920E C1 to C 4 interface combinations
The following table shows the different combinations of interface speeds that you can set up with the FIM-7920E
C1 to C4 front panel interfaces.
100GE QSFP28 4 3 3 2 2 2 1 1 1 1 x x x x x
40GE QSFP+ x 1 x 2 1 x 3 2 1 x 4 3 2 1 x
10Ge SFP+ x x 4 x 4 8 x 4 8 12 x 4 8 12 16
Supported transceivers and breakout cables
Transceivers available from Fortinet for the FIM-7920E C1 to C4 QSFP28 interfaces.
Transceiver Description
FG-TRAN-QSFP28-SR4 100 GE QSFP28 transceivers, 4 channel parallel fiber, short range.
FG-TRAN-QSFP28-LR4 100 GE QSFP28 transceivers, 4 channel parallel fiber, long range.
FG-TRAN-QSFP+SR 40GE QSFP+ transceivers, short range.
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
8

Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces FIM-7920E interface module
Transceiver Description
FG-TRAN-QSFP+LR 40GE QSFP+ transceivers, long range.
Breakout cables available from Fortinet for the FIM-7920E C1 to C4 QSFP28 interfaces.
Breakout Description
FG-TRAN-QSFP-4XSFP 40GE QSFP+ Parallel Breakout Active Optical Cable with 1m length.
FG-TRAN-QSFP-4SFP-5 40G QSFP+ Parallel Breakout MPO to 4xLC connectors, 5m reach.
Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces
By default, the FIM-7920E C1 to C4 interfaces are configured as 100GE QSFP28 interfaces. You can use the
following command to convert them to 40GE QSFP+ interfaces. Once converted, you can use the other
command below to split them into four 10GBASE-SR interfaces.
Changing the interface type
For example, to change the interface type of the C1 interface of the FIM-7920E in slot 1 to 40GE QSFP+ connect
to the CLI of your FortiGate-7000 system using the management IP and enter the following command:
config system global
set qsfp28-40g-port 1-C1
end
The FortiGate-7000 system reboots and when it starts up interface C1 of the FIM-7920E in slot 1 is operating as
a 40GE QSFP+ interface .
To change the interface type of the C3 and C4 ports of the FIM-7920E in slot 2 to 40GE QSFP+ enter the
following command:
config system global
set qsfp28-40g-port 2-C3 2-C4
end
The FortiGate-7000 system reboots and when it starts up interfaces C3 and C4 of the FIM-7920E in slot 2 are
operating as a 40GE QSFP+ interfaces.
Splitting the C1 to C4 interfaces
Each 40GE interface (C1 to C4) on the FIM-7920Es in slot 1 and slot 2 of a FortiGate-7000 system can be split
into 4 x 10GBE interfaces. You split these interfaces after the FIM-7920Es are installed in your FortiGate-7000
system and the system us up and running. You can split the interfaces of the FIM-7920Es in slot 1 and slot 2 at
the same time by entering a single CLI command. Splitting the interfaces requires a system reboot so Fortinet
recommends that you split multiple interfaces at the same time according to your requirements to avoid traffic
disruption.
For example, to split the C1 interface of the FIM-7920E in slot 1 (this interface is named 1-C1) and the C1 and C4
interfaces of the FIM-7920E in slot 2 (these interfaces are named 2-C1 and 2-C4) connect to the CLI of your
FortiGate-7000 system using the management IP and enter the following command:
9 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

FIM-7920E interface module Turning the module on and off
config system global
set split-port 1-C1 2-C1 2-C4
end
After you enter the command, the FortiGate-7000 reboots and when it comes up:
lThe 1-C1 interface will no longer be available. Instead the 1-C1/1, 1-C1/2, 1-C1/3, and 1-C1/4 interfaces will be
available.
lThe 2-C1 interface will no longer be available. Instead the 2-C1/1, 2-C1/2, 2-C1/3, and 2-C1/4 interfaces will be
available.
lThe 2-C4 interface will no longer be available. Instead the 2-C4/1, 2-C4/2, 2-C4/3, and 2-C4/4 interfaces will be
available.
You can now connect breakout cables to these interfaces and configure traffic between them just like any other
FortiGate interface.
Turning the module on and off
You can use the front panel power button to turn the module power on or off. If the module is powered on, press
the power switch to turn it off. If the module is turned off and installed in a chassis slot, press the power button to
turn it on.
NMI switch
When working with Fortinet Support to troubleshoot problems with the FIM-7920E, you can use the front panel
non-maskable interrupt (NMI) switch to assist with troubleshooting. Pressing this switch causes the software to
dump registers/backtraces to the console. After the data is dumped the board reboots. While the board is
rebooting, traffic is temporarily blocked. The board should restart normally and traffic can resume once its up and
running.
FIM-7920E hardware architecture
The FIM-7920E includes an integrated switch fabric (ISF) that connects the front panel interfaces to the DP2
session-aware load balancers and to the chassis backplanes. The ISFalso allows the DP2 processors to
distribute sessions among all NP6 processors on the FPMmodules in the same chassis.
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
10

FIM-7920E hardware architecture FIM-7920E interface module
FIM-7920E hardware architecture
FIM-7920E
Chassis Base Backplane
Chassis Fabric Backplane
CPU Integrated Switch Fabric
Management
(MGMT1-4)
Heartbeat
(M1 M2)
Data
(C1 - C4)
DP2 DP2 DP2
1G 80G
40G
11 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Installing QSFP28, QSFP+, SFP+, and SFP transceivers
Hardware installation
This chapter describes installing a FIM-7920E interface module into a FortiGate-7000 chassis.
Installing QSFP28, QSFP+, SFP+, and SFP transceivers
You must install QSFP28 or QSFP+, transceivers into the FIM-7920E front panel C1 to C4 fabric channel
interfaces before connecting them to 100Gbps or 40Gbps networks (10Gbps networks if splitting interface into
four 10GBASE-SR interfaces). You can install the transceivers before or after inserting the FIM-7920E module
into a chassis.
You must install SFP+ transceivers into the FIM-7920E M1 and M2 interfaces before connecting them to 10Gbps
networks. The FIM-7920E ships with two 10GBASE-SR SFP+ transceivers. You can also configure the M1 and
M2 interfaces to operate at 1Gbps and install SFP transceivers. You can install these transceivers before or after
inserting the FIM-7920E board into a chassis.
You can install the following types of transceivers for connectors M1 and M2:
l10GBASE-SR SFP+ (10Gbps)
l10GBASE-LR SFP+ (10Gbps)
l1000BASE SFP (1Gbps)
The M1 and M2 interfaces are used for heartbeat, session sync, and management
communication between FIM-7920Es in different chassis. This communication
requires 10 Gbps connections so, even though it supported, the M1 and M2 interfaces
should not changed to 1000Base SFP 1Gbps interfaces.
To install transceivers
To complete this procedure, you need:
lA FIM-7920E
lTransceivers to install
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7920Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7920Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7920Es.
Handling the transceivers by holding the release latch can damage the connector. Do
not force transceivers into their cage slots. If the transceiver does not easily slide in
and click into place, it may not be aligned correctly. If this happens, remove the
transceiver, realign it and slide it in again.
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
12

FIM-7920E mounting components Hardware installation
1. Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap terminal.
2. Remove the caps from the cage sockets on the FIM-7920E front panel.
3. Hold the sides of the transceiver and slide it into the cage socket until it clicks into place.
FIM-7920E mounting components
To install a FIM-7920E you slide the module into a hub/switch slot in the front of an FortiGate-7000 series chassis
(either slot 1 or 2) and then use the mounting components to lock the module into place in the slot. When locked
into place and positioned correctly the module front panel is flush with the chassis front panel. The module is also
connected to the chassis backplane.
To position the module correctly you must use the mounting components shown below for the right of the FIM-
7920E front panel. The mounting components on the left of the front panel are the same but reversed. The FIM-
7920E mounting components align the module in the chassis slot and are used to insert and eject the module
from the slot.
On some FIM modules there may be very little clearance between the front panel
interfaces and the handle on the right side of the FIM-7920E. In fact you may have to
remove network connectors from some front panel interfaces to open the handle. In
most cases you should remove all network connectors from the front panel before
opening the handles to remove a FIM module from a chassis slot.
Closed
Retention Screw
Handle
Latch
Latch
Alignment Pin Handle
Retention Screw
Alignment Pin
Open
(when open the latch slides up about 2 mm)
The FIM-7920E handles align the module in the chassis slot and are used to insert and eject the module from the
slot. The latches activate micro switches that turn on or turn off power to the module. When both latches are
13 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Inserting a FIM-7920E module into a chassis
raised the module cannot receive power. When the latches are fully closed if the module is fully inserted into a
chassis slot the module can receive power.
Inserting a FIM-7920E module into a chassis
This section describes how to install a FIM-7920E module into a FortiGate-7000 series chassis hub/switch slot
(slot 1 or 2).
You must carefully slide the module all the way into the chassis slot, close the handles
to seat the module into the slot, and tighten the retention screws to make sure the
module is fully engaged with the backplane and secured. You must also make sure
that the sliding latches are fully closed by gently pushing them down. The handles
must be closed, the retention screws tightened and the latches fully closed for the
module to get power and start up. If the module is not receiving power all LEDs remain
off.
FIM-7920Es are hot swappable. The procedure for inserting a FIM-7920E into a chassis slot is the same whether
or not the chassis is powered on.
To insert a FIM-7920E into a chassis slot
Do not carry the FIM-7920E by holding the handles or retention screws. When
inserting or removing the FIM-7920E from a chassis slot, handle the module by the
front panel. The handles are not designed for carrying the board. If the handles
become bent or damaged the FIM-7920E may not align correctly in the chassis slot.
To complete this procedure, you need:
lA FIM-7920E
lA FortiGate-7000 chassis with an empty hub/switch slot
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7920Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7920Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7920Es.
Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal
surface on the chassis or frame. (An ESD wrist strap is not visible in the photographs
below because they were taken in an ESD safe lab environment.)
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
14

Inserting a FIM-7920E module into a chassis Hardware installation
1. Remove the FIM-7920E module from its packaging. Align the module with the chassis slot
and slide the module part way into the slot.
In the photograph an example module is being installed into chassis slot 1 of a FortiGate-7040E chassis.
2. Unlock the left and right handles by pushing the handle latches up about 2 mm until the
handles pop open.
Fully open both handles before sliding the module into the chassis to avoid damaging the handle mechanism.
Damaging the handles may prevent the module from connecting to power.
15 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Inserting a FIM-7920E module into a chassis
3. Carefully slide the module into the slot until the handles engage with the sides of the
chassis slot, partially closing them.
Insert the module by applying moderate force to the front faceplate (not the handles) to slide the module into the
slot. The module should glide smoothly into the chassis slot. If you encounter any resistance while sliding the
module in, the module could be aligned incorrectly. Pull the module back out and try inserting it again.
4. Push both handles closed and close the latches.
Closing the handles draws the module into place in the chassis slot and into full contact with the chassis
backplane. The module front panel should be in contact with the chassis front panel and the latches should drop
down and lock into place. You should gently push the latches down to make sure they lock. The module will not
receive power until the latches are fully locked.
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
16

Inserting a FIM-7920E module into a chassis Hardware installation
5. Tighten both retention screws to secure the module in the chassis.
You can tighten the retention screws by hand with a Phillips screwdriver. If you use a power screwdriver the
tightening torque needs to be adjusted between 3 In-lb to 4 In-lb (0.4 N-m to 0.48 N-m).
As the latches are locked, power is supplied to the module. If the chassis is powered on during insertion the status
LED flashes green as the module starts up. Once the board has started up and is operating correctly, the front
panel LEDs are lit for normal operation.
Normal LED operation
LED State
Status Green
Alarm Off
HA Off
Power Green
17 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Shutting down and removing a FIM-7920E board from a chassis
Shutting down and removing a FIM-7920E board from a chassis
To avoid potential hardware problems, always shut down the FIM-7920E operating system properly before
removing the FIM-7920E from a chassis slot or before powering down the chassis.
Disconnect all cables from the FIM-7920E module, including all network cables and USB cables or keys.
FIM-7920Es are hot swappable. The procedure for removing a FIM-7920E from a chassis slot is the same
whether or not the chassis is powered on.
To remove a FIM-7920E board from a chassis slot
Do not carry the FIM-7920E by holding the handles or retention screws. When
inserting or removing the FIM-7920E from a chassis slot, handle the module by the
front panel. The handles are not designed for carrying the board. If the handles
become bent or damaged theFIM-7920E may not align correctly in the chassis slot.
To complete this procedure, you need:
lA FortiGate-7000 chassis with a FIM-7920E module installed
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7920Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7920Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7920Es. (An
ESD wrist strap is not visible in the photographs below because they were taken in an
ESD safe lab environment.)
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
18

Shutting down and removing a FIM-7920E board from a chassis Hardware installation
1. Fully loosen the retention screws.
You must fully loosen the screws or the handles may be damaged when used to eject the board from the chassis
slot.
2. Unlock the left and right handles by pushing the latches up about 2 mm until the handles
pop open.
Pushing the latches up turns off the module's power.
3. Fully open the handles to eject the module from the chassis.
You need to open the handles with moderate force to eject the module from the chassis.
19 FIM-7920E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Troubleshooting
4. Hold the module front panel sides and slide it part way out of the slot. Then grasp the
module by the sides and carefully slide it out of the slot.
Troubleshooting
This section describes some common troubleshooting topics:
FIM-7920E Interface Module Guide
Fortinet Technologies Inc.
20