PaloAlto Networks PA-400 Series User manual

PA-400 Series
docs.paloaltonetworks.com
1
2
Before You Begin
Use this document to install and begin setting up your Palo Alto Networks PA-400 Series next-generation firewall.
Refer to the PA-400 Series Next-Gen Firewall Hardware Reference at https://docs.paloaltonetworks.com/hardware
for safety information, specifications, and more detailed procedures for installing the firewall.
◼Verify that the installation site has adequate air circulation and AC power.
◼Have a #1 Phillips-head screwdriver available.
◼Unpack the equipment and verify that you received the following items:
Page 1 of 2
Quick Start Guide
Qty Description
1PA-400 Series next-generation firewall. (PA-440, PA-450, or PA-460)
1Power adapter.
1Power Cord, AC, North America, 10A/125V, 75C, 1.8M, St., SVT, NEMA-5-15P (YP-12) to IEC-C13 (YC-12).
1Standard Type-A USB to micro USB console cable.
1Shielded RJ-45 CAT6 Ethernet cable for management (MGT) port access.
6Wood screws (.75”) to mount the firewall and power adapter bracket to wood studs or plywood.
6Drywall anchors and screws (1.25”) to mount the firewall and power adapter bracket to a drywall or similar material that cannot
securely accommodate wood screws.
1Power adapter wall-mount kit (includes one (1) each of the following: a power adapter bracket, a Velcro strap, and a plastic
cable tie).
1Sheet, Limited Warranty.
1China RoHS declaration.
Install the Firewall
There are three ways to install the PA-400 Series firewall:
◼On a flat surface
◼On a wall
◼In a 19” equipment rack
Install the Firewall on a Flat Surface
The PA-400 Series firewalls ship with rubber “feet” attached to each corner of the device. The PA-440, PA-450, and PA-460 can
be set both horizontally and vertically upon a flat surface. See Figure 1 and Figure 2.
Figure 1
Figure 2
11.3 cm
7.5 cm
Wall Mount Template
Install the Firewall on a Wall
1 Temporarily secure the Wall Mount Template (on this sheet) to the wall where you intend to mount the
firewall and use it to mark the location for each of the three wall-mount screws (Figure 3). Use a pointed
object to punch through the paper and visibly mark the wall; then remove the template and verify
measurements.
Ensure there are no building services (water, gas, or wiring) behind the wall where you intend to install
the firewall.
2 Use a Phillips-head screwdriver to install the appropriate screws into each of the three marked
locations:
◼Drywall—First press a drywall anchor slightly into the center of a template mark. Then use your
screwdriver to apply pressure while turning the anchor clockwise until the surface of the anchor is
flush with the wall. After the drywall anchor is secure, install a 1.25” anchor screw into the anchor
until the bottom of the screw head protrudes ¼” from the wall. Repeat this step for the other two
screw locations. If any screw location is located over wood, use a .75” wood screw instead of a
drywall anchor and screw.
◼Plywood wall—Use your screwdriver to insert a .75” wood screw into the center of each template
mark that is located over wood until the bottom of the screw heads protrude ¼” from the wall.
3 Align the three holes on the bottom of the firewall with the three screws on the wall and hang the
firewall on the screws (Figure 3).
4 Install the power adapter in the power adapter wall-mount bracket using the Velcro strap and cable tie
(Figure 4). Make sure to align the cable tie with the notches in the bracket to prevent the power cord
from falling out.
5 Mount the power adapter wall-mount bracket next to the firewall (Figure 5) using wood or drywall
screws as appropriate. You can install an optional second power adapter next to the first power adapter
for power redundancy.
Figure 3


docs.paloaltonetworks.com
3
4
(Optional) If you are not able to connect to the management web interface, you can check the status of the firewall
by connecting to the console port using the DB-9 to RJ-45 serial cable (provided) and terminal emulation
software, or by using the micro USB port if you have PA-7050-SMC-B (refer to https://docs.paloaltonetworks.
com/resources/micro-usb-console-port). The console connection provides access to firewall boot messages,
maintenance mode, and the command line interface (CLI).
Page 2 of 2
Where To Go Next
To learn more about the firewall, refer to the PA-400 Series Next-Gen Firewall Hardware Reference Guide:
https://docs.paloaltonetworks.com/hardware.
To learn how to configure Palo Alto Networks firewalls, go to the Technical Documentation portal:
https://docs.paloaltonetworks.com.
(Use the Getting Started information in the PAN-OS Administrator’s Guide for initial configuration tasks.)
Start here to Register and Set Up your firewall and access all resources and support tools:
https://go.paloaltonetworks.com/CustomerLaunchPad
Figure 4
Figure 5
Install the Firewall in a 19” Equipment Rack
Refer to the PA-400 Series Next-Gen Firewall Hardware Reference at https://docs.paloaltonetworks.com/hardware.
Power On the Firewall
1 Connect the DC connector from the power adapter into the PWR 1 port on the firewall and tighten the thumb screw to secure the cable to the
firewall (Figure 6).
2 Plug the AC connector from the power adapter into your AC power source. After power is connected, the firewall powers on as indicated by the
green power LED next to the PWR 1 port. The front PWR LED shows green when a functioning power adapter is connected.
3 (Optional) Connect the DC connector from a second power adapter (purchased separately) into the PWR 2 port and plug the AC connector into
a second AC power source.
Figure 6
Connect the second PA-400 power adapter through a different circuit breaker to provide power redundancy and allow for electrical circuit
maintenance.
Connect in ZTP Mode
1 Unbox the firewall.
2 Connect the ZTP port (Ethernet port 1) on the firewall to an active network switch.
3 Power on the firewall.
4 Follow the instructions provided by your Panorama administrator to register your ZTP firewall. You will have to enter the serial number
(12-digit number identified as S/N) and claim key (8-digit number). These numbers are on stickers attached to the back of the device.
5 Contact your Panorama administrator if you require further assistance.
Cable
Tie
Velcro Strap
Cable Tie
Notches
Connect to the Management Interface
Connect in Standard Mode
1 Connect the standard RJ-45 Ethernet cable from the RJ-45 port on your computer to the
MGT port on the firewall.
2 Ensure that you have access to a terminal emulator such as PuTTY.
3 Power on the firewall.
4 Access the firewall CLI using your terminal emulator. Watch for the following prompt:
Do you want to exit ZTP mode and configure your firewall in standard mode (yes/no)[no]?
Enter “yes.” The system will then ask you to confirm. Enter “yes” again to boot the firewall in standard mode
5 Stand by as the firewall boots up.
6 Change the IP address on your computer to an address in the 192.168.1.0/24 network, such as 192.168.1.2.
7 From a web browser, go to https://192.168.1.1.
8 When prompted, log in to the web interface using the default username and password (admin/admin).
If you miss the above CLI prompt, you can also change your boot mode using the web interface. Go to the firewall login
screen at any point before or during the startup process. A prompt will ask if you wish to continue booting in ZTP mode or if
you would like to switch to standard mode. Select Standard Mode and the firewall will begin rebooting in standard mode.