PaloAlto Networks PA-5200 Series Application guide

PA‐5200Series
Next‐GenFirewall
HardwareReference
Service the PA-5200 Series Firewall

2•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ContactInformation
CorporateHeadquarters:
PaloAltoNetworks
3000TanneryWay
SantaClara,CA95054
https://www.paloaltonetworks.com/company/contact‐support
AboutthisGuide
ThisguidedescribesthePA‐5200Seriesnext‐generationfirewallhardware,providesinstructionsoninstallingthe
hardware,describeshowtoperformmaintenanceprocedures,andprovidesproductspecifications.Thisguideis
intendedforsystemadministratorsresponsibleforinstallingandmaintainingaPA‐5200Seriesfirewall.AllPA‐5200
SeriesfirewallsrunPAN‐OS®,apurpose‐builtoperatingsystemwithextensivesecurityandnetworking
functionality.Foradditionalinformation,refertothefollowingresources:
Forinformationontheadditionalcapabilitiesandforinstructionsonconfiguringthefeaturesonthefirewall,
refertohttps://www.paloaltonetworks.com/documentation.
ForcapacityandperformanceinformationforallPaloAltoNetworksfirewalls,referto
https://www.paloaltonetworks.com/products/product‐selection.html.
Forfeature,capacity,andperformanceinformation,referto
https://www.paloaltonetworks.com/resources/datasheets.html.
Foraccesstotheknowledgebase,discussionforums,andvideos,refertohttps://live.paloaltonetworks.com.
Forinformationonsupportprogramsrefertohttps://www.paloaltonetworks.com/services/supportandfor
informationonhowtomanageyouraccountordevices,ortoopenasupportcase,referto
https://www.paloaltonetworks.com/company/contact‐support.
ForthemostcurrentPAN‐OSandPanoramareleasenotes,refertotheTechnicalDocumentationPortaland
selectthereleaseversionthatisinstalledonyourfirewallorPanoramaserver.
ForinformationonthesupportedOSreleasesbymodel,referto
https://www.paloaltonetworks.com/documentation/global/compatibility‐matrix.
FordetailsonthePaloAltoNetworksReturnMaterialAuthorization(RMA)processandpolicy,referto
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/support/rma‐process‐policy.pdf.
Toprovidefeedbackonthedocumentation,pleasewritetousat:[email protected].
PaloAltoNetworks,Inc.
www.paloaltonetworks.com
©2017–2018PaloAltoNetworks,Inc.PaloAltoNetworksisaregisteredtrademarkofPaloAltoNetworks.Alistofourtrademarkscanbe
foundat https://www.paloaltonetworks.com/company/trademarks.html .Allothermarksmentionedhereinmaybetrademarksof
theirrespectivecompanies.
RevisionDate:May4,2018

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•25
ServicethePA‐5200SeriesFirewall
ThefollowingtopicsdescribehowtointerpretthePA‐5200SeriesfirewallstatusLEDsanddescribeshow
toreplacetheserviceablecomponents.
InterprettheLEDsonaPA‐5200SeriesFirewall
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
ReplaceaFanTrayonaPA‐5200SeriesFirewall
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
ReplaceaDriveonaPA‐5200SeriesFirewall
ToavoidinjurytoyourselfordamagetoyourPaloAltoNetworks®hardwareorthedatathatresidesonthe
hardware,readtheProductSafetyWarnings.
Copyright © 2007-2017 Palo Alto Networks

26•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
InterprettheLEDsonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
InterprettheLEDsonaPA‐5200SeriesFirewall
ThefollowingtabledescribeshowtointerpretthestatusLEDsonaPA‐5200Seriesfirewall.
LED Description
FrontPanelLEDs
PWR(Power) Green—Thefirewallispoweredon.
Off—Thefirewallisnotpoweredonoranerroroccurredwiththeinternalpower
system(forexample,powerisnotwithintolerancelevels).
STS(Status) Green—Thefirewallisoperatingnormally.
Yellow—Thefirewallisbooting.
HA(HighAvailability) Green—Thefirewallistheactivepeerinanactive/passiveconfiguration.
Yellow—Thefirewallisthepassivepeerinanactive/passiveconfiguration.
Off—Highavailability(HA)isnotoperationalonthisfirewall.
Inanactive/activeconfiguration,theHALEDonlyindicatesHAstatusforthe
localfirewallandhastwopossiblestates(greenoroff);itdoesnotindicateHA
connectivityofthepeer.Greenindicatesthatthefirewalliseither
active‐primaryoractive‐secondaryandoffindicatesthatthefirewallisinany
otherstate(Forexample,non‐functionalorsuspended).
TMP(Temperature) Green—Thefirewalltemperatureisnormal.
Yellow—Thefirewalltemperatureisoutsidetolerancelevels.
SeeEnvironmentalSpecificationsforthetemperaturerange.
FANS Green—Thefantraysandallfansareoperatingnormally.
Red—Oneormorefansfailedononeorbothofthefantrays.Todeterminewhichfan
trayhasafailure,checkthesystemlogorchecktheLEDonthefantrays.
PWR1andPWR2(Power) Whilefacingthebackofthefirewall,powersupply1(PWR1)isontheleftandpower
supply 2(PWR2)isontheright.
Green—Thepowersupplyisfunctioningnormally.
Red—Powersupplyispresentbutisnotworking.
ALM(Alarm) Red—Ahardwarecomponentfailed,suchasapowersupplyfailure,afirewallfailure
thatcausedanHAfailover,adrivefailure,orhardwareisoverheatingandthe
temperatureisabovethehightemperaturethreshold.
Off—Thefirewallisoperatingnormally.
EthernetPortLEDs
RJ‐45andAUXLEDs TheseportshavetwoLEDs.
•LeftLED—Solidgreenindicatesanetworklink.
•RightLED—Blinkinggreenindicatesnetworkactivity.
SFP,SFP+,andQSFPLEDs TheseportshaveonegreenLED.
•Solidgreenindicatesanetworklink.
•Blinkinggreenindicatesnetworkactivity.
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•27
ServicethePA‐5200SeriesFirewall InterprettheLEDsonaPA‐5200SeriesFirewall
BackPanelLEDs
Powersupply TheACandDCpowersupplieshaveaFAILandanOKLED.
•FAIL
•Solidyellow—Thepowersupplyfailed.Thiscanalsoindicateafanfailureor
overheatingcondition.
•Blinkingyellow—Thepowersupplyisoutsideoftolerancelevels.
•Off—Powersupplyisoperatingnormally.
•OK
•Solidgreen—Thepowersupplyisoperatingnormally.
•Blinkinggreen—Thepowerinputispresentbutthepowersupplyisdisabled
bythesystem.
•Off—Nopowerinputorthepowersupplyfailed.
Fantray Green—Thefantraysandallfansareoperatingnormally.
Red—Oneormorefansinthefantrayfailed(seeReplaceaFanTrayonaPA‐5200
SeriesFirewall).
LED Description
Copyright © 2007-2017 Palo Alto Networks

28•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Theairintakefiltersareacriticalpartofthefirewallcoolingsystem.Thesefiltersensuresthatairentering
thefirewalldoesnotcontaindebris.Youmustreplacebothfilters(topandbottom)everysixmonthsorless,
dependingontheenvironmentwherethefirewallislocated,topreventascenariowherethereisnotenough
airpassingthroughthefilterstokeepthefirewallfromoverheating.
YoucanpurchasereplacementairfiltersandairfiltercoversfromPaloAltoNetworksoranauthorized
reseller.
Thefollowingprocedurecanbeperformedwiththefirewallpoweredonbutdonotleavethefirewall
withoutthefiltersinstalledforlongerthanittakestoreplacethefilters.
Thefirewalldoesnotgenerateasystemlogindicatingthatanairfilterhasbeenremovedorthatitneedstobe
replaced.Therefore,inadditiontoreplacingthemeverysixmonths,youneedtoscheduleregularinspectionsand
ensurethatthefiltersdonotclogsoonerthanwhentheyareduetobereplaced.Donotattempttocleanand
reuseafilter.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Step1Turnthetwoairfiltercoverthumbscrewscounter‐clockwiseandremovethefiltercoverandfilter(topfilter
shown).
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•29
ServicethePA‐5200SeriesFirewall ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Step2Lifteachsideofthefilterupwardtoloosenitfromthefiltercoverandthenslidethefilteroutofthefilter
cover.
Step3Installanewfilterintothefiltercoverensuringthatyouslideitunderthefiltercovercrossbars.Youcan
installthefilterwitheithersidefacingup.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

30•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
Step4Replacethetopfiltercoverandfilterandturnthetwothumbscrewsclockwisetosecurethecovertothe
firewall.
Step5Repeatthisproceduretoreplacethebottomairfilter.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•31
ServicethePA‐5200SeriesFirewall ReplaceaFanTrayonaPA‐5200SeriesFirewall
ReplaceaFanTrayonaPA‐5200SeriesFirewall
PA‐5200Seriesfirewallshavetwofantraysandeachfantraycontainsfourfans.Ifonefanonafantrayfails,
theLEDonthefantrayturnsred.Whenthisoccurs,immediatelyreplacethefantraytoavoidservice
interruption.Iftwoormorefansfailononeorbothfantrays,thefirewallwillshutdownandyoumust
replacethefailedfantray(s)torestorefunctionality.
Youcanreplaceafantraywhilethefirewallispoweredonbutyoumustreplaceitwithin45secondsorthe
thermalprotectioncircuitautomaticallyshutsdownthefirewall.
ReplaceaFanTrayonaPA‐5200Series
Step1Removethereplacementfantrayfromthepackaging.
Step2IdentifythefailedfantraybyviewingtheLEDs.
Duringafailurecondition,thefantrayLEDonthefailedfantrayandtheFANSLEDonthefrontofthe
firewallshowred.
Step3Removethefailedfantray.
1.Turnthefourfantraythumbscrewscounter‐clockwiseuntilthescrewsstop.
2.Graspthefantrayhandleandpullthetrayoutofthefirewall.
Step4Slidethereplacementfantrayintotheemptyfan‐trayslotensuringthatthealignmentgroovesonthefan
trayandthefan‐trayslotarealigned.Pushthetrayinuntilitseatsandthenturnthefourfan‐traythumb
screwsclockwisetosecurethetraytothefirewall.
ThefantrayLEDturnsgreenandiftherearenootherfailedfans,theFANLEDonthefrontofthefirewall
turnsgreen.
Ifthethermalprotectioncircuitpoweredoffthefirewallduetooverheatingorfanfailures,youneedto
disconnectandreconnectpower.OnanACmodel,disconnectbothpowercords,waitfiveseconds,andthen
plugthecordsbackin.OnaDCmodel,shutdowntheDCcircuitthatisprovidingpowertothefirewall,wait
fiveseconds,andthenrestorethepower.
Copyright © 2007-2017 Palo Alto Networks

32•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
PA‐5200SeriesfirewallshaveeithertwoACortwoDCpowersupplies(thesecondpowersupplyisfor
redundancy).Ifonepowersupplyfails,youcanreplaceitwithoutserviceinterruptionasdescribedinthe
followingprocedures.
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
ThefollowingproceduredescribeshowtoreplaceanACpowersupply.
ToavoidinjurytoyourselfordamagetoyourPaloAltoNetworks®hardwareorthedatathatresidesonthe
hardware,readtheProductSafetyWarnings.
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
Step1IdentifythefailedpowersupplybyviewingthepowersupplyLEDonthebackofthefirewall;whenthereis
afailuretheFAILLEDturnssolidyellow.FordetailsonthepowersupplyLEDS,seeInterprettheLEDsona
PA‐5200SeriesFirewall.
Step2RemovetheVelcrostrapthatsecurestheACpowercordtothepowersupplyandremovethepowercord.
Step3Graspthehandleonthefailedpowersupplyandthensimultaneouslypressthereleaselevertotheleftand
thenpullthepowersupplyoutwardtoremoveit.
Copyright © 2007-2017 Palo Alto Networks