Fortinet FIM-7901E User manual

FIM-7901E Interface Module Guide
7000

FORTINET DOCUMENTLIBRARY
http://docs.fortinet.com
FORTINETVIDEOGUIDE
http://video.fortinet.com
FORTINETBLOG
https://blog.fortinet.com
CUSTOMERSERVICE&SUPPORT
https://support.fortinet.com
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATECOOKBOOK
http://cookbook.fortinet.com
FORTINETTRAININGSERVICES
http://www.fortinet.com/training
FORTIGUARDCENTER
http://www.fortiguard.com
FORTICAST
http://forticast.fortinet.com
ENDUSER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [e-mail]
Friday, June 23, 2017
FIM-7901E Interface Module Guide
01-540-374567-20170623

TABLEOFCONTENTS
FIM-7901E interface module 4
Physical Description 5
Front panel LEDs 5
Front panel connectors 6
Supported transceivers 7
Turning the module on and off 7
NMI switch 7
FIM-7901E hardware architecture 8
Hardware installation 9
Installing SFP+ and SFP transceivers 9
To install transceivers 9
FIM-7901E mounting components 10
Inserting a FIM-7901E module into a chassis 11
Shutting down and removing a FIM-7901E board from a chassis 16
Troubleshooting 19
FIM-7901E does not startup 19
FIM-7901E status LED is flashing during system operation 19
Quick FIM-7901E configuration 20
Registering your FortiGate-7000 series products 20
Choosing the configuration tool 20
Changing network settings 20
Cautions and Warnings 22
Environmental Specifications 22
Safety 23
Regulatory Notices 25
Federal Communication Commission (FCC) – USA 25
Industry Canada Equipment Standard for Digital Equipment (ICES) – Canada 25
European Conformity (CE) - EU 25
Voluntary Control Council for Interference (VCCI) – Japan 26
Product Safety Electrical Appliance & Material (PSE) – Japan 26
Bureau of Standards Metrology and Inspection (BSMI) – Taiwan 26
China 26

FIM-7901E interface module
FIM-7901E interface module
The FIM-7901E interface module is a hot swappable module that provides data, management and session
sync/heartbeat interfaces, base backplane switching and fabric backplane session-aware load balancing for a
FortiGate-7000 series chassis. The FIM-7901E includes an integrated switch fabric and DP2 processors to load
balance millions of data sessions over the chassis fabric backplane to FPM processor modules.
The FIM-7901E can be installed in any FortiGate-7000 series chassis. Normally you would install two FIM-7901E
modules in chassis hub/switch slots 1 and 2. Two FIM-7901Es provide a total of 32 10GigE small form-factor
pluggable plus (SPF+) interfaces for a FortiGate-7000 chassis.
You can also install FIM-7901Es in a second chassis and operate the chassis in HA mode with another set of
processor modules to provide chassis failover protection.
FIM-7901E front panel
Sliding
Latch
Handle
Retention
Screw Handle
Sliding
Latch
Retention
Screw
A1 to A32
10GigE Fabric Channel
SPF+ Network
Interfaces (data)
M1 and M2 10GigE Base
Channel SFP+ Interfaces
(heartbeat and management)
MGMT1 - MGMT4
10/100/1000BASE-T Copper
Management Interface
Status, Alarm
HA and Power
LEDS
USB
Power
Button
NMI
Button
The FIM-7901E includes the following hardware features:
lThirty-two front panel 10GigE SFP+ fabric channel interfaces (A1 to A32). These interfaces are connected to
10Gbps networks to distribute sessions to the FPM processor modules installed in chassis slots 3 and up. These
interfaces can also be configured to operate as Gigabit Ethernet interfaces using SFP transceivers. These
interfaces also support creating link aggregation groups (LAGs) that can include interfaces from both FIM-7901Es.
lTwo front panel 10GigE SFP+ interfaces (M1 and M2) that connect to the base backplane channel. These
interfaces are used for heartbeat, session sync, and management communication between FIM-7901Es in different
chassis. These interfaces can also be configured to operate as Gigabit Ethernet interfaces using SFP transceivers,
but should not normally be changed. If you use switches to connect these interfaces, the switch ports should be
able to accept packets with a maximum frame size of at least 1526. The M1 and M2 interfaces need to be on
different broadcast domains. If M1 and M2 are connected to the same switch, Q-in-Q must be enabled on the
switch.
lFour 10/100/1000BASE-T out of band management Ethernet interfaces (MGMT1 to MGMT4).
lOne 80Gbps fabric backplane channel for traffic distribution with each FPM module installed in the same chassis as
the FIM-7901E.
lOne 1Gbps base backplane channel for base backplane with each FPM module installed in the same chassis as the
FIM-7901E.
4 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

FIM-7901E interface module Physical Description
lOne 40Gbps fabric backplane channel for fabric backplane communication with the other FIM-7901E in the chassis.
lOne 1Gbps base backplane channel for base backplane communication with the other FIM-7901E in the chassis.
lOn-board DP2 processors and an integrated switch fabric to provide high-capacity session-aware load balancing.
lOne front panel USB port.
lPower button.
lNMIswitch (for troubleshooting as recommended by Fortinet Support).
lMounting hardware.
lLED status indicators.
Physical Description
Dimensions 1.2 x 11.34 x 14 in. (3.1 x 28.8 x 35.1 cm) (Height x Width x Depth)
Weight 7.2 lb. (3.23 kg)
Operating Temperature 32 to 104°F (0 to 40°C)
Storage Temperature -31 to 158°F (-35 to 70°C)
Relative Humidity 10% to 90% (Non-condensing)
Front panel LEDs
From the FIM-7901E font panel you can view the status of the module LEDs to verify that the module is
functioning normally.
LED State Description
STATUS
Off The FIM-7901E is powered off.
Green The FIM-7901E is powered on and operating normally.
Flashing
Green
The FIM-7901E is starting up.
ALARM
Red Major alarm.
Amber Minor alarm
Off No alarms
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
5

Front panel connectors FIM-7901E interface module
LED State Description
HA
Off The FIM-7901E is operating in normal mode.
Green The FIM-7901E is operating in HA mode.
Red A failover has occurred
POWER
Green The FIM-7901E is powered on and operating normally.
Off The FIM-7901E is powered off.
A1 to A32
M1 and M2
Green The correct cable is connected to the interface and the connected equipment
has power.
Flashing
Green Network activity at the interface.
Off No link is established.
MGMT1-4
Link/Act
Solid
Green
Indicates this interface is connected with the correct cable and the attached
network device has power.
Blinking
Green
Indicates network traffic on this interface.
Off No Link
MGMT1-4
Speed
Green Connection at 1Gbps.
Amber Connection at 100Mbps.
Off Connection at 10Mbps.
Front panel connectors
You connect the FIM-7901E to your 100Gbps networks using the C1 to C4 front panel CFP2 interfaces. The front
panel also includes M1 and M2 SFP+ interfaces for the base channel, four Ethernet management interfaces
(MGMT1 to MGMT4), and a USB port. The USB port can be used with any USB key for backing up and restoring
configuration files.
Connector Type Speed Protocol Description
USB USB 3.0
Type A
USB 3.0
USB 2.0
Standard USB connector.
6 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

FIM-7901E interface module Supported transceivers
Connector Type Speed Protocol Description
A1 to A32 SFP+ 10Gbps/1Gbps Ethernet 10GbE connection or 1GbE connection
(using SFP transceiver).
M1 and M2 10GbE connection using SFP transceiver.
For heartbeat and synchronization between
chassis. 1GbE not recommended.
MGMT1 to
MGMT4
RJ-45 10/100/1000Mbps Ethernet 10/100/1000BASE-T copper connection for
management or system administration.
Supported transceivers
Transceivers available from Fortinet for the FIM-7901E A1 to A32 SFP+ interfaces.
Transceiver Description
FG-TRAN-SFP+SR 10GE SFP+ transceiver module, short range.
FG-TRAN-SFP+LR 10GE SFP+ transceiver module, long range.
FG-TRAN-SFP-LX 1 GE SFP LX transceiver module.
FG-TRAN-SFP-SX 1 GE SFP SX transceiver module.
Turning the module on and off
You can use the front panel power button to turn the module power on or off. If the module is powered on, press
the power switch to turn it off. If the module is turned off and installed in a chassis slot, press the power button to
turn it on.
NMI switch
When working with Fortinet Support to troubleshoot problems with the FIM-7901E you can use the front panel
non-maskable interrupt (NMI) switch to assist with troubleshooting. Pressing this switch causes the software to
dump registers/backtraces to the console. After the data is dumped the board reboots. While the board is
rebooting, traffic is temporarily blocked. The board should restart normally and traffic can resume once its up and
running.
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
7

FIM-7901E hardware architecture FIM-7901E interface module
FIM-7901E hardware architecture
The FIM-7901E includes an integrated switch fabric (ISF) that connects the front panel interfaces to the DP2
session-aware load balancers and to the chassis backplanes. The ISFalso allows the DP2 processors to
distribute sessions amoung all NP6 processors on the FPMmodules in the same chassis.
FIM-7901E hardware architecture
DP2 DP2 DP2
Chassis Base Backplane
Chassis Fabric Backplane
CPU Integrated Switch Fabric
1G 80G
40G
Management
(MGMT1-4)
Heartbeat
(M1 M2)
Data
(A1 - A32)
8 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Installing SFP+ and SFP transceivers
Hardware installation
This chapter describes installing a FIM-7901E interface module into a FortiGate-7000 chassis.
Installing SFP+ and SFP transceivers
You must install SPF+ transceivers into the FIM-7901E front panel A1 to A32 interfaces before connecting them
to 10Gbps networks. The FIM-7901E ships with two 10GBASE-SR SFP+ transceivers. See FIM-7901E front
panel on page 4 for the locations of the A1 to A32 interfaces. You can also configure the A1 to A32 interfaces to
operate at 1Gbps and install SFP transceivers. You can install the transceivers before or after inserting the FIM-
7901E module into a chassis.
You must install SFP+ transceivers into the FIM-7901E M1 and M2 interfaces before connecting them to 10Gbps
networks. You can also configure the M1 and M2 interfaces to operate at 1Gbps and install SFP transceivers. You
can install these transceivers before or after inserting the FIM-7901E board into a chassis.
You can install the following types of transceivers for connectors M1 and M2:
l10GBASE-SR SFP+ (10Gbps)
l10GBASE-LR SFP+ (10Gbps)
l1000BASE SFP (1Gbps)
The M1 and M2 interfaces are used for heartbeat, session sync, and management
communication between FIM-7901Es in different chassis. This communication
requires 10 Gbps connections so, even though it supported, the M1 and M2 interfaces
should not changed to 1000Base SFP 1Gbps interfaces.
To install transceivers
To complete this procedure, you need:
lA FIM-7901E
lTransceivers to install
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7901Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7901Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7901Es.
Handling the transceivers by holding the release latch can damage the connector. Do
not force transceivers into their cage slots. If the transceiver does not easily slide in
and click into place, it may not be aligned correctly. If this happens, remove the
transceiver, realign it and slide it in again.
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
9

FIM-7901E mounting components Hardware installation
1. Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap terminal.
2. Remove the caps from the cage sockets on the FIM-7901E front panel.
3. Hold the sides of the transceiver and slide it into the cage socket until it clicks into place.
FIM-7901E mounting components
To install an FIM-7901E you slide the module into a hub/switch slot in the front of an FortiGate-7000 series
chassis (slot 1 or 2) and then use the mounting components to lock the module into place in the slot. When locked
into place and positioned correctly the module front panel is flush with the chassis front panel. The module is also
connected to the chassis backplane.
To position the module correctly you must use the mounting components shown below for the right of the FIM-
7901E front panel. The mounting components on the left of the front panel are the same but reversed. The FIM-
7901E mounting components align the module in the chassis slot and are used to insert and eject the module
from the slot.
On some FIM modules there may be very little clearance between the front panel
interfaces and the handle on the right side of the FIM-7901E. In fact you may have to
remove network connectors from some front panel interfaces to open the handle. In
most cases you should remove all network connectors from the front panel before
opening the handles to remove a FIM module from a chassis slot.
Closed
Retention Screw
Handle
Latch
Latch
Alignment Pin Handle
Retention Screw
Alignment Pin
Open
(when open the latch slides up about 2 mm)
The FIM-7901E handles align the module in the chassis slot and are used to insert and eject the module from the
slot. The latches activate micro switches that turn on or turn off power to the module. When both latches are
10 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Inserting a FIM-7901E module into a chassis
raised the module cannot receive power. When the latches are fully closed the if the module is fully inserted into a
chassis slot the module can receive power.
Inserting a FIM-7901E module into a chassis
This section describes how to install a FIM-7901E module into a FortiGate-7000 series chassis hub/switch slot
(slot 1 or 2).
You must carefully slide the module all the way into the chassis slot, close the handles
to seat the module into the slot, and tighten the retention screws to make sure the
module is fully engaged with the backplane and secured. You must also make sure
that the sliding latches are fully closed by gently pushing them down. The handles
must be closed, the retention screws tightened and the latches fully closed for the
module to get power and start up. If the module is not receiving power all LEDs remain
off.
FIM-7901Es are hot swappable. The procedure for inserting a FIM-7901E into a chassis slot is the same whether
or not the chassis is powered on.
To insert a FIM-7901E into a chassis slot
Do not carry the FIM-7901E by holding the handles or retention screws. When
inserting or removing the FIM-7901E from a chassis slot, handle the module by the
front panel. The handles are not designed for carrying the board. If the handles
become bent or damaged the FIM-7901E may not align correctly in the chassis slot.
To complete this procedure, you need:
lA FIM-7901E
lA FortiGate-7000 chassis with an empty hub/switch slot
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7901Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7901Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7901Es.
Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal
surface on the chassis or frame. (An ESD wrist strap is not visible in the photographs
below because they were taken in an ESD safe lab environment.)
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
11

Inserting a FIM-7901E module into a chassis Hardware installation
1. Remove the FIM-7901E module from its packaging. Align the module with the chassis slot
and slide the module part way into the slot.
In the photograph an example FIM-7901E is being installed into chassis slot 1 of a FortiGate-7040E chassis.
2. Unlock the left and right handles by pushing the handle latches up about 2 mm until the
handles pop open.
Fully open both handles before sliding the module into the chassis to avoid damaging the handle mechanism.
Damaging the handles may prevent the module from connecting to power.
12 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Inserting a FIM-7901E module into a chassis
3. Carefully slide the module into the slot until the handles engage with the sides of the
chassis slot, partially closing them.
Insert the module by applying moderate force to the front faceplate (not the handles) to slide the module into the
slot. The module should glide smoothly into the chassis slot. If you encounter any resistance while sliding the
module in, the module could be aligned incorrectly. Pull the module back out and try inserting it again.
4. Push both handles closed and close the latches.
Closing the handles draws the module into place in the chassis slot and into full contact with the chassis
backplane. The module front panel should be in contact with the chassis front panel and the latches should drop
down and lock into place. You should gently push the latches down to make sure they lock. The module will not
receive power until the latches are fully locked.
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
13

Inserting a FIM-7901E module into a chassis Hardware installation
5. Tighten both retention screws to secure the module in the chassis.
You can tighten the retention screws by hand with a Phillips screwdriver. If you use a power screwdriver the
tightening torque needs to be adjusted between 3 In-lb to 4 In-lb (0.4 N-m to 0.48 N-m).
14 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Inserting a FIM-7901E module into a chassis
As the latches are locked, power is supplied to the module. If the chassis is powered on during insertion the status
LED flashes green as the module starts up. Once the module has started up and is operating correctly, the front
panel LEDs are lit for normal operation.
Normal LED operation
LED State
Status Green
Alarm Off
HA Off
Power Green
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
15

Shutting down and removing a FIM-7901E board from a chassis Hardware installation
Shutting down and removing a FIM-7901E board from a chassis
To avoid potential hardware problems, always shut down the FIM-7901E operating system properly before
removing the FIM-7901E from a chassis slot or before powering down the chassis.
Disconnect all cables from the FIM-7901E module, including all network cables and USB cables or keys.
FIM-7901Es are hot swappable. The procedure for removing a FIM-7901E from a chassis slot is the same
whether or not the chassis is powered on.
To remove a FIM-7901E board from a chassis slot
Do not carry the FIM-7901E by holding the handles or retention screws. When
inserting or removing the FIM-7901E from a chassis slot, handle the module by the
front panel. The handles are not designed for carrying the board. If the handles
become bent or damaged theFIM-7901E may not align correctly in the chassis slot.
To complete this procedure, you need:
lA FortiGate-7000 chassis with a FIM-7901E module installed
lAn electrostatic discharge (ESD) preventive wrist strap with connection cord
FIM-7901Es must be protected from static discharge and physical shock. Only handle
or work with FIM-7901Es at a static-free workstation. Always wear a grounded
electrostatic discharge (ESD) preventive wrist strap when handling FIM-7901Es. (An
ESD wrist strap is not visible in the photographs below because they were taken in an
ESD safe lab environment.)
16 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Shutting down and removing a FIM-7901E board from a chassis
1. Fully loosen the retention screws.
You must fully loosen the screws or the handles may be damaged when used to eject the board from the chassis
slot.
2. Unlock the left and right handles by pushing the latches up about 2 mm until the handles
pop open.
Pushing the latches up turns off the module's power.
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
17

Shutting down and removing a FIM-7901E board from a chassis Hardware installation
3. Fully open the handles to eject the module from the chassis.
You need to open the handles with moderate force to eject the module from the chassis.
4. Hold the module front panel sides and slide it part way out of the slot. Then grasp the
module by the sides and carefully slide it out of the slot.
18 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.

Hardware installation Troubleshooting
Troubleshooting
This section describes some common troubleshooting topics:
FIM-7901E does not startup
Positioning of FIM-7901E mounting components and a few other causes may prevent a FIM-7901E from starting
up correctly.
Latches and handles not fully closed
If the latches or handles are damaged or positioned incorrectly the FIM-7901E may not start up. Make sure the
latches are fully closed and the handles are correctly aligned, fully inserted and locked and the retention screws
are tightened.
Firmware problem
If the FIM-7901E is receiving power and the latches are handles are fully closed, and you have restarted the
chassis and the FIM-7901E still does not start up, the problem could be with FortiOS. Connect to the FIM-7901E
console and try cycling the power to the board. If the BIOS starts up, interrupt the BIOS startup and install a new
firmware image.
If this does not solve the problem, contact Fortinet Technical Support.
FIM-7901E status LED is flashing during system operation
Normally, the FIM-7901E Status LED is off when the FIM-7901E is operating normally. If this LED starts flashing
while the module is operating, a fault condition may exist. At the same time the FIM-7901E may stop processing
traffic.
To resolve the problem you can try removing and reinserting the FIM-7901E in the chassis slot. Reloading the
firmware may also help.
If this does not solve the problem there may have been a hardware failure or other problem. Contact Fortinet
Technical Support for assistance.
FIM-7901E Interface Module Guide
Fortinet Technologies Inc.
19

Registering your FortiGate-7000 series products Quick FIM-7901E configuration
Quick FIM-7901E configuration
This section is a quick start guide to connecting and configuring a FIM-7901E for your network.
Before using this chapter, your FortiGate chassis should be mounted and connected to your power system. In
addition, your FIM-7901Es should be inserted into the chassis in slots 1 or 2 and one or more processor modules
should be installed in chassis slots 3 and up. The chassis and the modules should also be powered up and the
front panel LEDs should indicate that the modules are functioning normally. As well the FIM-7901E and the
processor modules should be running the same FortiOS firmware version.
Registering your FortiGate-7000 series products
FortiGate-7000 series products are registered according to the chassis serial number. You need to register your
chassis to receive Fortinet customer services such as product updates and customer support. You must also
register your product for FortiGuard services. Register your product by visiting https://support.fortinet.com. To
register, enter your contact information and the serial numbers of the Fortinet products that you or your
organization have purchased.
Choosing the configuration tool
You can use either the GUI or the Command Line Interface (CLI) to configure the FIM-7901E. Some basic
configuration settings can only be done from the CLI. You can connect to the GUI using HTTP or HTTPS, You
can connect to the CLIusing SSH or Telent or by a direct console connection to the FIM-7901E Console port. Use
a terminal emulator with the following settings to connect to the console port: bits per second: 9600, data bits: 8,
parity: none, stop bits: 1, flow control: none.
Changing network settings
The FIM-7901E ships with the following factory default configuration.
Option Default Configuration
Administrator Account User
Name
admin
Password (none)
MGMT1 to MGMT 4
IP/Netmask
192.168.1.99/24
MGMT 1 to MGMT 4 of each FIM-7901E are configured as a static aggregate interface called mgmt and all have
the same IP address. If you have two FIM modules installed in your chassis, then MGMT 1 to MGMT 4 of both
modules are all in the same static aggregate interface.
20 FIM-7901E Interface Module Guide
Fortinet Technologies Inc.