PaloAlto Networks PA-3020 Operating and maintenance manual

PA-3000 Series
Hardware Reference Guide

Contact Information
http://www.paloaltonetworks.com/contact/contact/
About this Guide
This guide describes the PA-3000 Series (PA-3020, PA-3050, and PA-3060) firewall hardware,
provides instructions on installing the hardware, describes how to perform maintenance procedures, and
provides product specifications. This guide is intended for system administrators responsible for
installing and maintaining the PA-3000 Series firewall.
All PA-3000 Series devices run PAN-OS, a purpose-built operating system with extensive
functionality. For additional information, refer to the following resources:
•For information on the additional capabilities and for instructions on configuring the features on
the firewall, refer to https://www.paloaltonetworks.com/documentation.
•For access to the knowledge base, complete documentation set, discussion forums, and videos,
refer to https://live.paloaltonetworks.com.
•For contacting support, for information on the support programs, or to manage your account or
devices, refer to https://support.paloaltonetworks.com.
•For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates.
•For capacity and performance information for all Palo Alto Networks firewalls, refer to 
https://www.paloaltonetworks.com/products/product-selection.html.
To provide feedback on the documentation, please write to us at:
[e-mail].
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2013 Palo Alto Networks. All rights reserved.
Palo Alto Networks and PAN-OS are trademarks of Palo Alto Networks, Inc.
Part number: 810-000112-00D

Palo Alto Networks Table of Contents • 3
March 17, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 1 
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
PA-3020 and PA-3050 Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
PA-3060 Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Back Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
PA-3020 and PA-3050 Back Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
PA-3060 Back Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Chapter 2 
Install the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Tamper Proof Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Equipment Rack Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Connect Cables to the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Connect Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Chapter 3 
Maintaining the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Cautions and Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Interpret the Device LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Interpret the Port LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Replace a PA-3060 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 4 
Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Physical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Interface Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table of Contents

4• Table of Contents Palo Alto Networks
Chapter 5 
Compliance Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
VCCI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
BSMI EMC Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Palo Alto Networks Overview • 5
March 17, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 1 
Overview
This section describes the front and back panels of the PA-3000 Series (PA-3020, PA-3050, and
PA-3060) firewalls:
•“Front Panel” on page 6
•“Back Panel” on page 8
Note: The port configuration on the PA-3020 and PA-3050 firewalls is
identical; the differences between the devices are based on performance and
capacity. The PA-3060 firewall differs from other devices in the series in
port configuration, power supply configuration, and airflow.

Front Panel
6• Overview Palo Alto Networks
Front Panel
This section describes the front panel of the PA-3000 Series firewalls.
•“PA-3020 and PA-3050 Front Panel” on page 6
•“PA-3060 Front Panel” on page 7
PA-3020 and PA-3050 Front Panel
Figure 1 shows the front panel of the PA-3020 and PA-3050 firewalls and Table 1 describes the
front-panel features.
Figure 1. PA-3020 and PA-3050 Front Panel
Table 1. PA-3020 and PA-3050 Front-Panel Features
Item Description
Ethernet ports Twelve RJ-45 10/100/1000 ports for network traffic.
SFP ports Eight Small Form-Factor Pluggable (SFP) 1 Gbit/s ports for network
traffic.
High-availability (HA) ports Two RJ-45 ports for high-availability (HA) control and
synchronization.
Management port One RJ-45 port to access the device management interfaces through
an Ethernet interface.
Console port One RJ-45 port for connecting a serial console.
USB port One USB port for future use.
Status LEDs Six LEDs indicating system status. Refer to “Interpret the Device
LEDs” on page 18 for LED definitions.
MGT
HA1 HA2
Status
LEDs
Ethernet
ports
SFP
ports
USB
port
Management
port
Console
port
HA
ports
PA-3050

Palo Alto Networks Overview • 7
Front Panel
PA-3060 Front Panel
This section describes the front panel of the PA-3000 Series firewalls.
Figure 2 shows the front panel of the PA-3060 firewall and Table 2 describes the front-panel
features.
Figure 2. PA-3060 Font Panel
Table 2. PA-3060 Front-Panel Features
Item Description
Ethernet ports Eight RJ-45 10/100/1000 ports for network traffic.
SFP ports Eight Small Form-Factor Pluggable (SFP) 1 Gbit/s ports for
network traffic.
SFP+ ports Two Enhanced Small Form-Factor Pluggable Plus (SFP+)
10 Gbit/s ports for network traffic.
High-availability (HA) ports Two RJ-45 ports for high-availability (HA) control and
synchronization.
Management port One RJ-45 port to access the device management interfaces through
an Ethernet interface.
Console port One RJ-45 port for connecting a serial console.
USB port One USB port for future use.
Status LEDs Six LEDs indicating system status. Refer to “Interpret the Device
LEDs” on page 18 for LED definitions.
Ethernet
ports
SFP
ports
HA
ports
Management
port
Console
port
USB
port
Status
LEDs
SFP+
ports

Back Panel
8• Overview Palo Alto Networks
Back Panel
This section describes the back panel of the PA-3000 Series firewalls.
•“PA-3020 and PA-3050 Front Panel” on page 6
•“PA-3060 Front Panel” on page 7
PA-3020 and PA-3050 Back Panel
Figure 3 shows the back panel of the PA-3020 and PA-3050 firewalls and Table 3 describes the
back-panel features.
Figure 3. PA-3020 and PA-3050 Back Panel
Table 3. PA-3020 and PA-3050 Back-Panel Features
Item Description
AC power inlet and power
supply
Power inlet for device power. 
Note: The power supply is not customer serviceable.
Grounding lug To ground the system, use a grounding wire of at least 14 American
Wire Gauge (AWG). Attach the 14 AWG wire to an agency-
approved crimp connector (Tyco 34120 or certified Lug), crimped
with the proper crimping tool and attached to the protective
grounding lug. Use a size #8-32 nut and a star washer (supplied) to
secure the grounding lug to the chassis and connect he other end to
the building ground. Toque the nut to 15 in-lbs. Do not over tighten.
AC Power
Inlet
Grounding
Lug
Power Supply
Exhaust

Palo Alto Networks Overview • 9
Back Panel
PA-3060 Back Panel
Figure 4 shows the back panel of the PA-3060 firewall and Table 4 describes the back-panel
features.
Figure 4. PA-3060 Back Panel
Table 4. PA-3060 Back-Panel Features
Item Description
Power supplies Two redundant, hot-swappable power supplies.
Grounding lug To ground the system, use a grounding wire of at least 14 American
Wire Gauge (AWG). Attach the 14 AWG wire to an agency-
approved crimp connector (Tyco 34120 or certified Lug), crimped
with the proper crimping tool and attached to the protective
grounding lug. Use a size #8-32 nut and a star washer (supplied) to
secure the grounding lug to the chassis and connect he other end to
the building ground. Toque the nut to 15 in-lbs. Do not over tighten.
Exhaust fans Four exhaust fans that provide front-to-back ventilation and cooling
for the device.
Power Supplies
Grounding Lug
Exhaust Fans

Back Panel
10 • Overview Palo Alto Networks

Palo Alto Networks Install the Hardware • 11
March 17, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 2 
Install the Hardware
This chapter describes how to install the PA-3000 Series firewalls.
•“Tamper Proof Statement” on page 11
•“Before You Begin” on page 11
•“Equipment Rack Installation” on page 13
•“Connect Cables to the Device” on page 15
•“Connect Power” on page 16
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks have not been tampered with
during shipping, verify the following upon receipt of each product:
•The tracking number provided to you electronically when ordering the product matches
the tracking number that is physically labelled on the box or crate.
•The integrity of the tamper-proof tape used to seal the box or crate has not been
compromised.
•The warranty seals on the device itself do not show evidence of tampering.
Before You Begin
•It is recommended that two people be available to mount the PA-3000 Series firewall in a
19-inch rack.
•Have a Phillips-head screwdriver available.
•Verify that the intended location has adequate air circulation and meets the temperature
requirements. Refer to the “Environmental Specifications” on page 24.
•Unpack the device.

Before You Begin
12 • Install the Hardware Palo Alto Networks
•Verify that power is not connected to the firewall.
•On the PA-3020 and PA-3050 firewalls, allow clear space on both sides of the firewall for
side-to-side airflow. On the PA-3060 firewall, leave clear space on the front and back of the
firewall for front-to-back airflow.

Palo Alto Networks Install the Hardware • 13
Equipment Rack Installation
Equipment Rack Installation
The following safety guidelines apply to rack installation:
•Elevated ambient operating temperature—If the PA-3000 Series firewall is installed in a
closed or multi-unit rack assembly, the ambient operating temperature of the rack
environment may be greater than the ambient room temperature. Verify that the ambient
temperature of the rack assembly meets the maximum rated ambient temperature
requirements listed in the “Environmental Specifications” on page 24.
•Reduced airflow—Ensure that the airflow required for safe device operation is not
compromised by the rack installation.
•Mechanical loading—Ensure that the rack mounted device does not cause hazardous
conditions due to uneven mechanical loading.
•Circuit overloading—Ensure that the circuit that supplies power to the device is
sufficiently rated to avoid circuit overloading or excess load on supply wiring. Refer to
the “Electrical Specifications” on page 23.
•Reliable earthing—Maintain reliable earthing of rack mounted equipment. Pay special
attention to supply connections other than direct connections to the branch circuit (such
as the use of power strips).
To install the PA-3000 Series firewall in a grounded 19-inch rack:
1. Screw the rack mounting brackets onto the front of the device using a Phillips-head
screwdriver. Figure 5 shows how the rack mounting brackets attach to the PA-3020 and
PA-3050 firewalls and Figure 6 shows how the brackets attach to the PA-3060 firewall.
2. Using two people, lift the device and position it in the rack.
3. Align the mounting holes on the attached rack mounting brackets with holes in the rack
rail. Ensure that the bracket and rack holes align, so the device is level.
4. Insert mounting screws into the aligned holes. Tighten with a Phillips screwdriver.
Note: The brackets on the PA-3000 Series firewalls can be installed in a front-
mount position or a mid-mount position.
Note: When installing the rack brackets on the PA-3060 firewall, first insert all
four screws (per bracket) and partially tighten. After all screws are inserted, then
torque each screw to 7 in. lbs to fully tighten.

Equipment Rack Installation
14 • Install the Hardware Palo Alto Networks
Figure 5. PA-3020 and PA-3050 Rack-Mount Brackets
Figure 6. PA-3060 Rack-Mount Brackets
Mid-mount
position
Front-mount
position
3
HA1 HA2
Mid-mount
position Front-mount
position

Palo Alto Networks Install the Hardware • 15
Connect Cables to the Device
Connect Cables to the Device
Figure 7 shows the PA-3050 firewall cable connections. The PA-3020 and PA-3050 firewalls
each have eight SFP ports and twelve copper Ethernet ports. The PA-3060 firewall has eight
SFP+ ports and eight copper Ethernet ports. Refer to “Front Panel” on page 6 for descriptions
of the front-panel interfaces.
Figure 7. PA-3020 and PA-3050 Cable Connections
CAUTION: Shielded interface cables that are grounded shall be used to ensure
agency compliance with electromagnetic emissions (EMC).
CAUTION: Fiber transceivers that are installed by the user shall be Class I and
CDRH certified.
MGT
HA1 HA2
Console
SFP
Management
Network
PA-3050
HA1 HA2

Connect Power
16 • Install the Hardware Palo Alto Networks
Connect Power
To power the PA-3020 and PA-3050 firewalls, attach a power cable to the device AC power
inlet and plug the other end into a grounded wall outlet and the device will power on. For the
PA-3060, do the same, but use two power cables on different circuits for redundancy. Figure 8
shows the power connection for a PA-3060.
Figure 8. PA-3060 Power Connection
Circuit A Circuit B

Palo Alto Networks Maintaining the Hardware • 17
March 17, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 3 
Maintaining the Hardware
This chapter describes how to interpret LEDs and troubleshoot hardware problems.
•“Cautions and Warnings” in the next section
•“Interpret the Port LEDs” on page 19
•“Replace a PA-3060 Power Supply” on page 19
Cautions and Warnings
CAUTION: Disconnect all power cords before servicing the PA-3000 Series firewalls.
CAUTION: This product complies with 21 CFR 1040.10 and 1040.11.
French Translation:
CE PRODUIT EST CONFORME AUX NORMES 21 CFR 1040.10 ET 1040.11.
CAUTION: Laser radiation exposure should be avoided. Cover any unused fiber optical ports. Do not
look directly at exposed fiber optical transmitters or cables.
WARNING: Risk of explosion if battery is replaced by an incorrect type. Dispose of used batteries
according to the instructions (Cl. 1.7.15).
French Translation:
ATTENTION: RISQUE D'EXPLOSION SI LA BATTERIE EST REMPLACÉE PAR UN
MODÈLE DE TYPE INCORRECT. METTEZ AU REBUT LES BATTERIES USAGÉES
CONFORMÉMENT AUX INSTRUCTIONS (CL.1.7.15)
WARNING: Removal of equipment top cover is to be done only by Palo Alto Networks trained
service person(s).
WARNING: To reduce the risk of electric shock, disconnect all power supply cords before servicing
the unit (the unit may have more than one).
French Translation:
Pour réduire le risque de choc électrique, débranchez tous les cordons d'alimentation avant
d'intervenir sur l'appareil (l'appareil peut avoir plus d'un).

Interpret the Device LEDs
18 • Maintaining the Hardware Palo Alto Networks
Interpret the Device LEDs
Figure 9 shows the status LEDs on the front panel of the PA-3000 Series firewalls and Table 5
describes the LED functions and states.
Figure 9. Front-Panel LEDs
Table 5. Status LED Functions and States
Interface State Description
PWR
(Power)
Green The device is powered.
Off The device is not powered or an error has occurred with the
internal power complex (not within tolerance levels).
STS
(Status)
Green The device is operating normally.
Yellow The device is booting up.
FAN Green All fans are operating normally.
Red One or more fans have failed.
HA Green The device is active in an active/passive configuration, or is the
active-primary or active-secondary in an active/active
configuration.
Yellow The device is currently in the passive state.
Off High availability is not enabled on this device, the status is
unknown, or the device is suspended or non-functional.
If the device is in a non-functional or tentative state, the ALM
(Alarm) LED will change to red.
ALM
(Alarm)
Red There is a hardware failure, which may include fan failure, power
supply failure, HA failover, or temperature above the high
temperature threshold.
Off The device is operating normally.
TEMP Green The temperature is normal.
Yellow The temperature is outside the normal tolerance.

Palo Alto Networks Maintaining the Hardware • 19
Interpret the Port LEDs
Interpret the Port LEDs
Table 6 describes the Ethernet port LEDs for the PA-3000 Series firewalls.
Table 7 describes the HA and Management port LEDs for the PA-3000 Series firewalls.
Replace a PA-3060 Power Supply
Before servicing the hardware, read the information in “Cautions and Warnings” on page 17.
To replace a PA-3060 AC power supply:
1. While the PA-3060 is running, unplug the power cord from the failed power supply.
2. Grasp the handle on the failed power supply. Simultaneously push down on the release lever and
then pull the power supply outward to remove the power supply. Figure 10 show how to remove
and install a power supply.
3. Slide a replacement power supply into the device and ensure that the release lever clicks into place.
4. Connect one end of the AC power cable to the power supply and connect the other end to a
grounded AC power source.
Table 6. PA-3000 Series Ethernet Port LEDs
LED Position Description
Left Shows solid green if there is a network link.
Right Blinks green if there is network activity.
Table 7. PA-3000 Series Management and HA Port LEDs
LED Position Description
Left Shows solid green if there is a network link.
Right Blinks green if there is network activity.

Replace a PA-3060 Power Supply
20 • Maintaining the Hardware Palo Alto Networks
Figure 10. PA-3060 Power Supply Replacement