Fortinet FPM-7620F User manual

FPM-7620F Processing Module Guide
FortiGate-7000F Series

FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET VIDEO GUIDE
https://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com
FORTINET TRAINING & CERTIFICATION PROGRAM
https://www.fortinet.com/support-and-training/training.html
NSE INSTITUTE
https://training.fortinet.com
FORTIGUARD CENTER
https://fortiguard.com/
END USER LICENSE AGREEMENT
https://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [email protected]
April 8, 2021
FPM-7620F Processing Module Guide
01-626-669639-20210408

TABLEOFCONTENTS
Change log 4
FPM-7620F processing module 5
FPM-7620Fmountinghardware 5
Modulelevers 5
Powersliders 6
Securescrews 6
Frontpanelinterfaces 6
PhysicalDescription 7
FrontPanelLEDs 7
Turningthemoduleonandoff 8
NMIswitch 8
NP7networkprocessors-offloadingdatatraffic 9
AcceleratedIPS,SSLVPN,andIPsecVPN(CP9contentprocessors) 9
Hardware installation 11
InstallingQSFP28andSFP28transceivers 11
Toinstalltransceivers 11
FortiGate-7121Fcablebracketkit 12
FPM-7620Fmountinghardware 12
InsertingaFPM-7620Fmoduleintoachassis 13
ShuttingdownandremovingaFPM-7620Fboardfromachassis 19
Troubleshooting 24
FPM-7620Fdoesnotstartup 24
FPM-7620FstatusLEDisflashingduringsystemoperation 25
Cautions and warnings 26
Environmentalspecifications 26
Safety 27
Regulatory notices 28
FederalCommunicationCommission(FCC)–USA 28
IndustryCanadaEquipmentStandardforDigitalEquipment(ICES)–Canada 28
EuropeanConformity(CE)-EU 28
VoluntaryControlCouncilforInterference(VCCI)–Japan 29
ProductSafetyElectricalAppliance&Material(PSE)–Japan 29
BureauofStandardsMetrologyandInspection(BSMI)–Taiwan 29
China 29
FPM-7620F Processing Module Guide 3
Fortinet Technologies Inc.

Change log Fortinet Technologies Inc.
Changelog
Date Change description
April8,2021 Removedinformationabouttheconsoleport,whichisnotsupported.Addedthe
averagepowerconsumption.
March30,2021 Minorfixes.
March16,2021 Initialrelease.

FPM-7620F Processing Module Guide 4

FPM-7620Fprocessingmodule
TheFPM-7620Fprocessormoduleisahigh-performanceworkermodulethatprocessessessionsloadbalancedtoitby
FIMsoverthechassisfabricbackplane.TheFPM-7620Fincludestwo400GbpsdataconnectionstotheFIMsoverthe
chassisfabricbackplaneandtwo50GbpsmanagementconnectionstotheFIMsoverbasebackplane.FPM-7620Fsare
installedinchassisslots3andup.
TheFPM-7620Falsoincludestwofrontpanel100GigEQSFP28fabricchanneldatainterfaces(1and2)andeight
10/25GigESFP28fabricchanneldatainterfaces(3to10).Interfaces1and2canbeconnectedto100Gbpsdata
networks.Interfaces3to10canbeconnectedto25Gbpsdatanetworks.FPMdatanetworkinterfacesincreasethe
numberofdatainterfacessupportedbyFortiGate-7000F.Datatrafficreceivedbytheseinterfacesissentoverthefabric
backplanetotheFIMNP7processorstobeloadbalancedbacktotheFPMs.
TheFPM-7620FprocessessessionsusingadualCPUconfiguration,acceleratesnetworktrafficprocessingwithtwo
NP7processorsandacceleratescontentprocessingwitheightCP9processors.TheNP7networkprocessorsare
connectedbytheFIMswitchfabricsoallsupportedtraffictypescanbefastpathacceleratedbytheNP7processors.
FPM-7620F front panel
Power
Slider
Module
Lever
Secure
Screw
Module
Lever
Power
Slider
Secure
Screw
Status, Alarm,
and Power LEDS
Power
Button
NMI
Button
1 and 2
100/40GigE fabric channel
QSFP28 data network
interfaces
3 to 10
25/10GigE fabric channel
SFP28 data network
interfaces
MGMT
10/100/1000BASE-T
copper management
interface
FPM-7620F mounting hardware
Usethemodulelevers,powersliders,andsecurescrewstoinsert,secureandremovethemodulefromthechassis.
Module levers
Carefullyslidethemoduleallofthewayintothechassisslotandfullyclosethemoduleleverstoseatthemoduleintothe
chassisslotandtoconnectthemoduletothechassisbackplaneconnectors.Whenbothmoduleleversarefullyclosed,
thepowersliderscanbeloweredtotheirbottomposition,lockingthemoduleleversandturningonpowertothemodule.
FPM-7620F Processing Module Guide 5
Fortinet Technologies Inc.

FPM-7620F processing module Fortinet Technologies Inc.
Raisethepowersliderstounlockthemoduleleversandturnoffmodulepower.Thenopenthemoduleleverstoejectthe
modulefromthebackplaneconnectors;allowingthemoduletoberemovedfromthechassis.
Themodulelevermechanismhelpsreducetheengagementforcerequiredtoinsertorejectthemodulefromthe
backplaneconnectors.
Themoduleleversdonotfullysecurethemoduleinthechassis.Thesecurescrewsmustbetightenedtoreliablysecure
themoduleinthechassisandtomakesurethemoduleremainssecurelyconnectedtothebackplaneforpowerand
networkconnectivity.
Power sliders
Closethemoduleleversandmovethepowersliderstotheirbottompositiontolockthemoduleleversandturnthe
modulepowerswitchon.
Movethepowersliderstothetoppositiontounlockthemoduleleversandturnthemodulepowerswitchoff.
Gentlypushthepowerslidersdowntomakesuretheyareintheirbottomposition.IfthemoduleLEDsdonotlightthe
moduleisnotreceivingpower.Ifthishappenscheckthepowersliderstomakesuretheyareintheirbottomposition.
Secure screws
Fullytightenthesecurescrewstolockthemoduleinthechassisprovidingasecureandreliableconnectionwiththe
backplane.
Loosenthesecurescrewsbeforeejectingthemodulefromthechassis.
Front panel interfaces
YouconnecttheFPM-7620Ftoyour100Gbpsnetworksusingthe1and2frontpanelQSFP28fabricchannelinterfaces.
YoucanalsoconnecttheFPM-7620Ftoyour25Gbpsnetworksusingthefrontpanel3to10SFP28fabricchannel
interfaces.Youcancreatelinkaggregationgroups(LAGs)thatcanincludedatainterfacesfrommultipleFIMsandFPMs
inthesamechassis.
Connector Type Speed Protocol Description
1and2 QSFP28 100Gbps
40Gbps
Ethernet Twofrontpanel100GigEQSFP28fabric
channeldatainterfacesthatcanbeconnected
to100Gbpsdatanetworkstodistribute
sessionstotheFPMsinchassisslots3andup.
Theseinterfacescanalsooperateas40GigE
QSFP+interfaces.
FPM-7620F Processing Module Guide 6

FPM-7620F processing module Fortinet Technologies Inc.
Connector Type Speed Protocol Description
3to10 SFP28 25Gbps
10Gbps
Ethernet Eightfrontpanel25GigESFP28fabricchannel
datainterfacesthatcanbeconnectedto
25Gbpsdatanetworkstodistributesessionsto
theFPMsinchassisslots3andup.These
interfacescanalsooperateas10GigESFP+
interfaces.
MGMT RJ-45 10Mbps
100Mbps
1000Mbps
Ethernet 10/100/1000BASE-Tcopperoutofband
managementethernetinterface.
Physical Description
Dimensions 1.69x17.11x18.56in.(43x435x471mm)(HeightxWidthxLength)
Weight 16.19lb.(7.35kg)
Operating Temperature 32to104°F(0to40°C)
Storage Temperature -13to158°F(-25to70°C)
Relative Humidity 20to90%(Non-condensing)
Power consumption Max:716W;Average:675W
Max Current 60A
Heat Dissipation 2577KJ/h(2442BTU/h)
Front Panel LEDs
LED State Description
STATUS Off TheFPM-7620Fispoweredoff.
Green TheFPM-7620Fispoweredonandoperatingnormally.
Flashing
Green
TheFPM-7620Fisstartingup.
ALARM Red Majoralarm.
Amber Minoralarm
Off Noalarms
POWER Green TheFPM-7620Fispoweredonandoperatingnormally.
FPM-7620F Processing Module Guide 7

FPM-7620F processing module Fortinet Technologies Inc.
LED State Description
Off TheFPM-7620Fispoweredoff.
1and2 Green Thecorrectcableisconnectedtotheinterfaceandtheconnectedequipment
haspowerandisconnectedat100Gbps.
Flashing
green
Networkactivityattheinterface.
Off Nolinkisestablished.
3to10

Green Thisinterfaceisconnectedat25Gbpswiththecorrectcableandthe
attachednetworkdevicehaspower.
Flashing
green
Networktrafficonthisinterface.
Off NoLink
MGMT
Link/Act
Solid
green
Indicatesthisinterfaceisconnectedwiththecorrectcableandtheattached
networkdevicehaspower.
Blinking
green
Indicatesnetworktrafficonthisinterface.
Off NoLink
MGMT
Speed
Green Connectionat1Gbps.
Amber Connectionat100Mbps.
Off Connectionat10Mbps.
Turning the module on and off
Youcanusethefrontpanelpowerbuttontoturnthemodulepoweronoroff.Ifthemoduleispoweredon,pressthe
powerswitchtoturnitoff.Ifthemoduleisturnedoffandinstalledinachassisslot,pressthepowerbuttontoturniton.
NMI switch
WhenworkingwithFortinetSupporttotroubleshootproblemswiththeFPM-7620Fyoucanusethefrontpanelnon-
maskableinterrupt(NMI)switchtoassistwithtroubleshooting.Pressingthisswitchcausesthesoftwaretodump
registers/backtracestotheconsole.Afterthedataisdumpedthemodulereboots.Whilethemoduleisrebooting,traffic
istemporarilyblocked.Themoduleshouldrestartnormallyandtrafficcanresumeoncethemoduleisupandrunning.
FPM-7620F Processing Module Guide 8

FPM-7620F processing module Fortinet Technologies Inc.
NP7 network processors - offloading data traffic
ThetwoFPM-7620FNP7networkprocessorsprovidehardwareaccelerationbyoffloadingdatatrafficfromtheFPM-
7620FCPUs.TheresultisenhancednetworkperformanceprovidedbytheNP7processorsplusthenetworkprocessing
loadisremovedfromtheCPU.TheNP7processorcanalsohandlesomeCPUintensivetasks,likeIPsecVPN
encryption/decryption.Becauseoftheintegratedswitchfabric,allsessionsarefast-pathedandaccelerated.
TrafficfromFPM-7620FfrontpaneldatainterfacesissentoverthefabricchannelbackplanetotheFIMswhereNP7
processorsuseSLBCtodistributesessionstoindividualFPMs.TheFPM-7620Fcanbeprocessingtrafficreceivedfrom
FIMdatainterfacesandfromFPMdatainterfaces.
FPM-7620F hardware architecture
Chassis Base Backplane
Chassis Fabric Backplane
Integrated Switch Fabric
2 x 50G
2 x 400G
2 x NP7
(NP#0-1)
C
2 x CPU
8 x CP9
Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors)
TheFPM-7620FincludeseightCP9processorsthatprovidethefollowingperformanceenhancements:
lFlow-basedinspection(IPS,applicationcontroletc.)patternmatchingaccelerationwithover10Gbpsthroughput
lIPSpre-scan
lIPSsignaturecorrelation
lFullmatchprocessors
lHighperformanceVPNbulkdataengine
lIPsecandSSL/TLSprotocolprocessor
lDES/3DES/AES128/192/256inaccordancewithFIPS46-3/FIPS81/FIPS197
lMD5/SHA-1/SHA256/384/512-96/128/192/256withRFC1321andFIPS180
lHMACinaccordancewithRFC2104/2403/2404andFIPS198
lESNmode
lGCMsupportforNSA"SuiteB"(RFC6379/RFC6460)includingGCM-128/256;GMAC-128/256
FPM-7620F Processing Module Guide 9

FPM-7620F processing module Fortinet Technologies Inc.
lKeyExchangeProcessorthatsupportshighperformanceIKEandRSAcomputation
lPublickeyexponentiationenginewithhardwareCRTsupport
lPrimarycheckingforRSAkeygeneration
lHandshakeacceleratorwithautomatickeymaterialgeneration
lTrueRandomNumbergenerator
lEllipticCurvesupportforNSA"SuiteB"
lSubpublickeyengine(PKCE)tosupportupto4096bitoperationdirectly(4kforDHand8kforRSAwithCRT)
lDLPfingerprintsupport
lTTTD(Two-Thresholds-Two-Divisors)contentchunking
lTwothresholdsandtwodivisorsareconfigurable
FPM-7620F Processing Module Guide 10