PaloAlto Networks PA-5000 Series Operating and maintenance manual

PA-5000 Series
Hardware Reference Guide

Contact Information
http://www.paloaltonetworks.com/contact/contact/
About this Guide
This guide describes the PA-5000 Series firewall hardware, provides instructions on installing the
hardware, describes how to perform maintenance procedures, and provides product specifications. This
guide is intended for system administrators responsible for installing and maintaining the PA-5000
Series firewall.
All PA-5000 Series devices run PAN-OS, a purpose-built operating system with extensive
functionality. For additional information, refer to the following resources:
•For information on the additional capabilities and for instructions on configuring the features on
the firewall, refer to https://www.paloaltonetworks.com/documentation.
•For access to the knowledge base, complete documentation set, discussion forums, and videos,
refer to https://live.paloaltonetworks.com.
•For contacting support, for information on the support programs, or to manage your account or
devices, refer to https://support.paloaltonetworks.com.
•For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates.
•For capacity and performance information for all Palo Alto Networks firewalls, refer to 
https://www.paloaltonetworks.com/products/product-selection.html.
To provide feedback on the documentation, please write to us at:
[e-mail].
Palo Alto Networks, Inc.
www.paloaltonetworks.com 
© 2007–2015 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of
our trademarks can be found at
http://www.paloaltonetworks.com/company/trademarks.html . All other marks
mentioned herein may be trademarks of their respective companies.
Revision Date: May 29, 2015
Part number: 810-000056-00G

Palo Alto Networks Table of Contents •
May 29, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 1 
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Front Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Back Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 2 
Installing the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Tamper Proof Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Equipment Rack Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Connecting Cables to the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Connecting Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Connecting a DC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Chapter 3 
Maintaining the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Cautions and Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
General Cautions/Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
DC Power Related Cautions/Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Interpreting Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Interpreting the Device LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Interpreting the Port LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Interpreting the Power Supply LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Replacing a Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Replacing an AC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Replacing a DC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Replacing a Hard Disk or Solid State Drive . . . . . . . . . . . . . . . . . . . . . . . . . 22
Choosing System Options for the Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Replacing the Fan Tray and Air Filter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Replacing the Air Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Table of Contents

• Table of Contents Palo Alto Networks
Chapter 4 
Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Physical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Interface Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Chapter 5 
Compliance Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
NEBS Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
VCCI Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
BSMI EMC Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Palo Alto Networks Overview • 5
May 29, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 1 
Overview
This chapter describes the features of the front and back panel of the PA-5000 Series firewall. For more
information, refer to the following topics:
•“Front Panel” on page 6
•“Back Panel” on page 8

Front Panel
6• Overview Palo Alto Networks
Front Panel
Figure 1 shows the front panel of the PA-5060 and PA-5050 and Table 1 describes the front panel
features.
Figure 1. PA-5060 and PA-5050 Front Panel
Table 1. PA-5060 and PA-5050 Front Panel Features
Item Description
Ethernet ports 12 RJ-45 10/100/1000 ports for network traffic.
SFP ports Eight Small Form-Factor Pluggable (SFP) ports for network traffic.
SFP+ ports Four SFP+ ports for network traffic.
Management port One RJ-45 port to access the device management interfaces through an
Ethernet interface.
Management console port One RJ-45 port for connecting a serial console.
High-availability (HA) ports Two RJ-45 ports for high-availability (HA) control and synchronization.
USB ports Two USB ports for future use.
LED dashboard Eight LEDs indicating system status. Refer to “Interpreting the Device
LEDs” on page 18 for LED definitions.
1357
2468
911
10 12
13 15 17 19
14 16 18 20
21 23
22 24 HA2
PWR
STS
HA
TEMP
ALARM
FANS
PWR 1
PWR 2
HA1MGT CONSOLE
USB
PA-5060
Ethernet
ports
Management
console port
Management
port
SFP
ports
HA
port 2
HA
port 1
LEDs
USB
ports
SFP+
ports

Palo Alto Networks Overview • 7
Front Panel
Figure 2 shows the front panel of the PA-5020 Series and Table 2 describes the front panel features.
Figure 2. PA-5020 Front Panel
Table 2. PA-5020 Front Panel Features
Item Description
Ethernet ports 12 RJ-45 10/100/1000 ports for network traffic.
SFP ports Eight Small Form-Factor Pluggable (SFP) ports for network traffic.
Management ports One RJ-45 port to access the device management interfaces through an
Ethernet interface.
Management console port One RJ-45 port for connecting a serial console.
High-availability (HA) ports Two RJ-45 ports for high-availability (HA) control and synchronization.
USB ports Two USB ports for future use.
LED dashboard Eight LEDs indicating system status. Refer to “Interpreting the Device
LEDs” on page 18 for LED definitions.
1357
2468
911
10 12
13 15 17 19
14 16 18 20 HA2
PWR
STS
HA
TEMP
ALARM
FANS
PWR 1
PWR 2
HA1MGT CONSOLE
USB
PA-5060
Ethernet
ports
Management
console port
Management
port
SFP
ports
HA
port 2
HA
port 1
LEDs
USB
ports

Back Panel
8• Overview Palo Alto Networks
Back Panel
Figure 3 shows the back panel of the PA-5000 Series and Table 3 describes the back panel features.
Figure 3. Back Panel
The PA-5000 Series does not have a power button. The device is powered by plugging power cords into
the power supplies. Refer to “Replacing a Power Supply” on page 20 for instructions on replacing the
power supplies.
Table 3. Back Panel Features
Item Description
Power supplies 2 redundant, hot-swappable power supplies.
Fan tray Removable fan tray and filter.
Hard disk drive bay Hard drive bay for 2 x 2.5-inch hard disk drives.
Power
supplies
Hard drive bayFan tray

Palo Alto Networks Installing the Hardware • 9
May 29, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 2 
Installing the Hardware
This chapter describes how to install the PA-5000 Series firewall. For more information, refer to the
following topics:
•“Tamper Proof Statement” on page 9
•“Before You Begin” in the next section
•“Equipment Rack Installation” on page 10
•“Connecting Cables to the Device” on page 11
•“Connecting Power” on page 12
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks have not been tampered with
during shipping, verify the following upon receipt of each product:
•The tracking number provided to you electronically when ordering the product matches
the tracking number that is physically labelled on the box or crate.
•The integrity of the tamper-proof tape used to seal the box or crate has not been
compromised.
•The warranty seals on the device itself do not show evidence of tampering. Being a
modular system, please note that the PA-7050 does not have a warranty seal.
Before You Begin
•It is recommended that two people be available to mount the PA-5000 Series in a 19-inch rack.
•Have a Phillips head screwdriver available.
•Verify that the intended location has adequate air circulation and meets the temperature
requirements. Refer to “Environmental Specifications” on page 31.
•Allow clear space on both sides of the device.

Equipment Rack Installation
10 • Installing the Hardware Palo Alto Networks
•Unpack the device.
•Verify that power is not connected to the device.
Equipment Rack Installation
Before installing the hardware, read the information in “Cautions and Warnings” on page 15.
Figure 4 illustrates how rack mounting brackets are attached to the PA-5000 Series. You can attach the
brackets using the holes at the front or the midpoint of the unit.
Figure 4. Attaching Rack Mounting Brackets
The following safety guidelines apply to rack installation:
•Elevated ambient operating temperature—If the PA-5000 Series is installed in a closed or
multi-unit rack assembly, the ambient operating temperature of the rack environment may be
greater than the ambient room temperature. Verify that the ambient temperature of the rack
assembly meets the maximum rated ambient temperature requirements listed in “Environmental
Specifications” on page 31.
•Reduced air flow—Ensure that the airflow required for safe device operation is not compromised
by the rack installation.
•Mechanical loading—Ensure that the rack-mounted device does not cause hazardous conditions
due to uneven mechanical loading.
•Circuit overloading—Ensure that the circuit that supplies power to the device is sufficiently rated
to avoid circuit overloading or excess load on supply wiring. Refer to “Electrical Specifications”
on page 30.
To install the PA-5000 Series in a grounded 19-inch rack:
1. Screw the rack mounting brackets onto the front or midpoint of the unit using a Phillips head
screwdriver.
1 3 5 7 9 11
2 4 6 8 10 12
13 15 17 19 21 23
14 16 18 20 22 24

Palo Alto Networks Installing the Hardware • 11
Connecting Cables to the Device
2. Lift the device and position it in the rack. It is recommended that two people perform this function.
3. Align the mounting holes on the side of the device with holes in the rack rail. Make sure that rack
rail holes are selected so that the PA-5000 Series is level.
4. Insert mounting screws into the aligned holes. Tighten with a Phillips head screwdriver.
Connecting Cables to the Device
Figure 5 shows the cable connections of the PA-5060 and PA-5050. Refer to Table 1 for descriptions of
the front panel interfaces.
Before working with fiber optic cabling, read the information in “Cautions and Warnings” on page 15
related to laser radiation.
Figure 5. Cable Connections for the PA-5060 and PA-5050
1 3 5 7 9 11 13 15 17 19 21 23
2 4 6 8 10 12 14 16 18 20 22 24
USB
SFP
HA2
HA1 Console
Management
Network

Connecting Power
12 • Installing the Hardware Palo Alto Networks
Figure 6 shows the cable connections of the PA-5020. Refer to Table 2 for descriptions of the front
panel interfaces.
Figure 6. Cable Connections for the PA-5020
Connecting Power
Figure 7 shows the AC power connections for the PA-5000 Series.
Figure 7. Power Connection for the PA-5000 Series
To power up the PA-5000 Series, attach a power cable to each of the power supplies and plug each into
a grounded wall outlet. The device has no power switch and is automatically powered when one or more
power cables are connected to the device and to an AC power source.
1 3 5 7 9 11 13 15 17 19
2 4 6 8 10 12 14 16 18 20
USB
SFP
HA2
HA1 Console
Management
Network

Palo Alto Networks Installing the Hardware • 13
Connecting Power
Connecting a DC Power Supply
Before connecting power, read the “Cautions and Warnings” on page 15.
Figure 8 shows the DC power connections for the PA-5000 Series.
Wind the power wires around the screws and tighten to secure. The -48VDC connection is on the left
and the 0VDC connection is on the right, as labeled when facing the power supply. Turn on the electric
current to the DC feed.
Figure 8. DC Power Supply - Attachment
DC Power Safety
WARNING: You must shut off the electric current to the DC feed wires before
connecting or disconnecting the wires to the power supplies.

Connecting Power
14 • Installing the Hardware Palo Alto Networks

Palo Alto Networks Maintaining the Hardware • 15
May 29, 2015 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 3 
Maintaining the Hardware
This chapter describes how to replace power supplies, interpret LEDs, and troubleshoot hardware
problems. Before continuing, read “Cautions and Warnings” on page 15.
For information on servicing the hardware, refer to the following topics:
•“Cautions and Warnings” on page 15
•“Interpreting Status LEDs” on page 18
•“Replacing a Power Supply” on page 20
•“Replacing a Hard Disk or Solid State Drive” on page 22
•“Replacing the Fan Tray and Air Filter” on page 25
Cautions and Warnings
The following lists cautions and warnings that must be observed before working with the hardware.
THIS PRODUCT COMPLIES WITH 21 CFR 1040.10 and 1040.11
French Translation: CE PRODUIT EST CONFORME AUX NORMES 21 CFR 1040.10 ET 1040.11
•“General Cautions/Warnings” on page 15
•“DC Power Related Cautions/Warnings” on page 16
General Cautions/Warnings
This section describes general cautions and warnings related to working with the hardware:

Cautions and Warnings
16 • Maintaining the Hardware Palo Alto Networks
DC Power Related Cautions/Warnings
This section lists cautions and warnings for the hardware when DC power supplies are installed:
CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN
INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE
INSTRUCTIONS" (Cl. 1.7.15)
French Translation:
ATTENTION: RISQUE D'EXPLOSION SI LA BATTERIE EST REMPLACÉE
PAR UN MODÈLE DE TYPE INCORRECT. METTEZ AU REBUT LES
BATTERIES USAGÉES CONFORMÉMENT AUX INSTRUCTIONS (CL.
1.7.15)
CAUTION: Equipment may be affected by electrostatic discharge. ESD reduction
procedures (wearing a wrist strap) must be implemented during the installation and
maintenance of equipment.
CAUTION: Shielded interface cables which are grounded must be used to ensure
agency compliance with electromagnetic emissions (EMC).
WARNING: Laser radiation exposure should be avoided. Cover any unused fiber
optical ports. Do not look directly at exposed fiber optical transmitters or cables.
WARNING: To reduce the risk of electric shock, disconnect all power supply
cords before servicing the switch (the switch might have more than one).
French Translation:
Pour réduire le risque de choc électrique, débranchez tous les câbles d'alimentation
avant d'intervenir sur le commutateur (il peut en comporter plusieurs).
WARNING: You must shut off the electric current to the DC feed wires before
connecting or disconnecting the wires from the DC power supply.

Palo Alto Networks Maintaining the Hardware • 17
Cautions and Warnings
Important notes on connecting DC power:
•If a DC connection is used, all of the following conditions must be met:
– This equipment must be connected directly to the DC supply system earthing electrode
conductor or to a bonding jumper from an earthing terminal bar or bus to which the DC supply
system earthing electrode conductor is connected.
– This equipment must be located in the same immediate area (such as adjacent cabinets) as any
other equipment that has a connection between the earthed conductor of the same DC supply
circuit and the earthing conductor, and also the point of earthing of the DC system.
– The DC system must not be earthed elsewhere.
– The DC supply source must be located within the same premises as this equipment.
Switching or disconnecting devices must not be in the earthed circuit conductor between the DC source
and the point of connection of the earthing electrode conductor.
CAUTION: All devices that use DC power are intended for installation in
restricted access areas only. A restricted access area is where access can be gained
only by service personnel through the use of a special tool, lock and key, or other
means of security, and is controlled by the authority responsible for the location.
CAUTION: For the DC input circuit, make sure there is a 15 amp circuit
breaker, minimum 48VDC, and double pole on the input to the DC power.
CAUTION: For a DC system, use a grounding wire of at least 14 American Wire
Gauge (AWG). The 14 AWG wire should be attached to an agency-approved crimp
connector (Tyco 34120 or certified Lug), crimped with the proper crimping tool and
attached to the protective grounding lug, using a size #8-32 nut and a star washer
(supplied), on the chassis with the other end connected to the building ground.
Torque the nut to 15 in.-lbs. Do not over tighten.
CAUTION: This equipment is designed to permit the connection of the earthed
conductor of the DC supply circuit to the earthing conductor at the equipment. See
installation instructions.
French Translation:
CAUTION: ATTENTION : Cet équipement est conçu pour permettre de
connecter le conducteur de terre du circuit d'alimentation CC au conducteur de terre
de l'équipement. Reportez-vous aux instructions d'installation.

Interpreting Status LEDs
18 • Maintaining the Hardware Palo Alto Networks
Interpreting Status LEDs
This sections describes the device, port, and power supply LEDs that will enable you to determine the
status of these components.
•“Interpreting the Device LEDs” on page 18
•“Interpreting the Port LEDs” on page 19
•“Interpreting the Power Supply LED” on page 20
Interpreting the Device LEDs
Figure 9 shows the LED dashboard on the front panel of the PA-5000 Series, and Table 4 describes the
LED functions and states.
Figure 9. Front Panel LEDs
Table 4. Functions and States of the LED Dashboard
LED State Description
PWR
(POWER) Green The device is powered.
Off Power is off.
STS
(STATUS) Green The device is operating normally.
Yellow The device is booting up.
HA Green This device is the current active device.
Yellow This device is the current passive device.
Off High availability (HA) is not enabled on this device.
TEMP Green The temperature is normal.
Yellow The temperature is outside the normal tolerance.
ALARM Red There is a hardware failure, which may include power supply detected
but not working, fan failure, Hard drive failure, HA failover, or
temperature above high temperature threshold.
Off The device is operating normally.
FANS Green All fans are operating normally.
Red One or more fans have failed.
PWR
STS
HA
TEMP
ALARM
FANS
PWR 1
PWR 2

Palo Alto Networks Maintaining the Hardware • 19
Interpreting Status LEDs
Interpreting the Port LEDs
Table 5 describes the LEDs for the PA-5000 Series Ethernet ports. Refer to Figure 1.
Table 6 describes the LEDs for the PA-5060/PA-5050 Gigabit Small Form-Factor Pluggable (SFP+)
ports. Refer to Figure 2.
Table 7 describes the LEDs for the PA-5000 Series Management port. Refer to Figure 1 and Figure 2.
PWR 1 Green The left power supply (facing the back of the firewall) is powered and
active, or is not installed.
Red The left power supply (facing the back of the firewall) is detected but not
working.
The power supplies also have an LED that indicates the status, see
“Interpreting the Power Supply LED” on page 20.
PWR 2 Green The right power supply (facing the back of the firewall) is powered and
active, or is not installed.
Red The right power supply (facing the back of the firewall) is detected but
not working.
The power supplies also have an LED that indicates the status, see
“Interpreting the Power Supply LED” on page 20.
Table 4. Functions and States of the LED Dashboard (Continued)
LED State Description
Table 5. Ethernet and SFP Port LEDs
LED Description
Left Shows green if there is a network link.
Right Blinks green if there is network activity.
Table 6. SFP+ Port LEDs
LED Description
Left Shows green if there is a network link.
Right Blinks green if there is transmit (TX) network activity.
Table 7. PA-5000 Series Management and HA1 Port LEDs
LED Description
Left Shows solid amber if there is a network link and blinks amber if there is
network activity.
Right
• Shows green if link is 100 Mbps
• Shows amber if link is 1 Gbps
• Shows the off state if link is 10 Mbps

Replacing a Power Supply
20 • Maintaining the Hardware Palo Alto Networks
Interpreting the Power Supply LED
The PA-5000 Series firewall has two power supplies and each power supply has an LED located above
the power cord to indicate status. Table 8 describes the LEDs located on the back of each power supply.
Replacing a Power Supply
The PA-5000 Series firewall has two hot-swappable AC or DC power supplies. Both power supplies
should be connected during normal operations. If the system detects a loss of power, either due to loss
of power connection, failure of the power supply, or incorrect input voltage being supplied, the power
supply LED located above the power plug will go off and the front panel PWR LED and ALARM LED
turn red. If enabled, an audible alert will be sound until both power supplies are operational. The audible
alert is disabled by default and can be enabled by running set system setting power-
supply audible-alarm enable yes.
Replacing an AC Power Supply
Before servicing the hardware, read the information in “Cautions and Warnings” on page 15.
To replace the AC PWR1 or PWR2 power supply:
1. While the PA-5000 Series is running, unplug the power cord from the power supply that you need
to replace.
2. Push the lever to the right and use the handle to slide the power supply out of the device, as shown
in Figure 10.
3. Slide a replacement power supply into the device.
4. Connect the power cable to the power supply and to an AC power source.
Table 8. Power Supply LED
LED State Description
Power Supply Green The power supply is operating normally.
Off The system detected a loss of power, either due to loss of power
connection, failure of the power supply, or incorrect input voltage being
supplied. The power supply LED located above the power plug will go off
and the front panel PWR LED and ALARM LED turn red.