PaloAlto Networks PA-5200 Series Application guide

PA‐5200Series
Next‐GenFirewall
HardwareReference
Service the PA-5200 Series Firewall

2•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ContactInformation
CorporateHeadquarters:
PaloAltoNetworks
3000TanneryWay
SantaClara,CA95054
https://www.paloaltonetworks.com/company/contact‐support
AboutthisGuide
ThisguidedescribesthePA‐5200Seriesnext‐generationfirewallhardware,providesinstructionsoninstallingthe
hardware,describeshowtoperformmaintenanceprocedures,andprovidesproductspecifications.Thisguideis
intendedforsystemadministratorsresponsibleforinstallingandmaintainingaPA‐5200Seriesfirewall.AllPA‐5200
SeriesfirewallsrunPAN‐OS®,apurpose‐builtoperatingsystemwithextensivesecurityandnetworking
functionality.Foradditionalinformation,refertothefollowingresources:
Forinformationontheadditionalcapabilitiesandforinstructionsonconfiguringthefeaturesonthefirewall,
refertohttps://www.paloaltonetworks.com/documentation.
ForcapacityandperformanceinformationforallPaloAltoNetworksfirewalls,referto
https://www.paloaltonetworks.com/products/product‐selection.html.
Forfeature,capacity,andperformanceinformation,referto
https://www.paloaltonetworks.com/resources/datasheets.html.
Foraccesstotheknowledgebase,discussionforums,andvideos,refertohttps://live.paloaltonetworks.com.
Forinformationonsupportprogramsrefertohttps://www.paloaltonetworks.com/services/supportandfor
informationonhowtomanageyouraccountordevices,ortoopenasupportcase,referto
https://www.paloaltonetworks.com/company/contact‐support.
ForthemostcurrentPAN‐OSandPanoramareleasenotes,refertotheTechnicalDocumentationPortaland
selectthereleaseversionthatisinstalledonyourfirewallorPanoramaserver.
ForinformationonthesupportedOSreleasesbymodel,referto
https://www.paloaltonetworks.com/documentation/global/compatibility‐matrix.
FordetailsonthePaloAltoNetworksReturnMaterialAuthorization(RMA)processandpolicy,referto
https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/support/rma‐process‐policy.pdf.
Toprovidefeedbackonthedocumentation,pleasewritetousat:[email protected].
PaloAltoNetworks,Inc.
www.paloaltonetworks.com
©2017–2018PaloAltoNetworks,Inc.PaloAltoNetworksisaregisteredtrademarkofPaloAltoNetworks.Alistofourtrademarkscanbe
foundat https://www.paloaltonetworks.com/company/trademarks.html .Allothermarksmentionedhereinmaybetrademarksof
theirrespectivecompanies.
RevisionDate:May4,2018

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•25
ServicethePA‐5200SeriesFirewall
ThefollowingtopicsdescribehowtointerpretthePA‐5200SeriesfirewallstatusLEDsanddescribeshow
toreplacetheserviceablecomponents.
InterprettheLEDsonaPA‐5200SeriesFirewall
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
ReplaceaFanTrayonaPA‐5200SeriesFirewall
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
ReplaceaDriveonaPA‐5200SeriesFirewall
ToavoidinjurytoyourselfordamagetoyourPaloAltoNetworks®hardwareorthedatathatresidesonthe
hardware,readtheProductSafetyWarnings.
Copyright © 2007-2017 Palo Alto Networks

26•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
InterprettheLEDsonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
InterprettheLEDsonaPA‐5200SeriesFirewall
ThefollowingtabledescribeshowtointerpretthestatusLEDsonaPA‐5200Seriesfirewall.
LED Description
FrontPanelLEDs
PWR(Power) Green—Thefirewallispoweredon.
Off—Thefirewallisnotpoweredonoranerroroccurredwiththeinternalpower
system(forexample,powerisnotwithintolerancelevels).
STS(Status) Green—Thefirewallisoperatingnormally.
Yellow—Thefirewallisbooting.
HA(HighAvailability) Green—Thefirewallistheactivepeerinanactive/passiveconfiguration.
Yellow—Thefirewallisthepassivepeerinanactive/passiveconfiguration.
Off—Highavailability(HA)isnotoperationalonthisfirewall.
Inanactive/activeconfiguration,theHALEDonlyindicatesHAstatusforthe
localfirewallandhastwopossiblestates(greenoroff);itdoesnotindicateHA
connectivityofthepeer.Greenindicatesthatthefirewalliseither
active‐primaryoractive‐secondaryandoffindicatesthatthefirewallisinany
otherstate(Forexample,non‐functionalorsuspended).
TMP(Temperature) Green—Thefirewalltemperatureisnormal.
Yellow—Thefirewalltemperatureisoutsidetolerancelevels.
SeeEnvironmentalSpecificationsforthetemperaturerange.
FANS Green—Thefantraysandallfansareoperatingnormally.
Red—Oneormorefansfailedononeorbothofthefantrays.Todeterminewhichfan
trayhasafailure,checkthesystemlogorchecktheLEDonthefantrays.
PWR1andPWR2(Power) Whilefacingthebackofthefirewall,powersupply1(PWR1)isontheleftandpower
supply 2(PWR2)isontheright.
Green—Thepowersupplyisfunctioningnormally.
Red—Powersupplyispresentbutisnotworking.
ALM(Alarm) Red—Ahardwarecomponentfailed,suchasapowersupplyfailure,afirewallfailure
thatcausedanHAfailover,adrivefailure,orhardwareisoverheatingandthe
temperatureisabovethehightemperaturethreshold.
Off—Thefirewallisoperatingnormally.
EthernetPortLEDs
RJ‐45andAUXLEDs TheseportshavetwoLEDs.
•LeftLED—Solidgreenindicatesanetworklink.
•RightLED—Blinkinggreenindicatesnetworkactivity.
SFP,SFP+,andQSFPLEDs TheseportshaveonegreenLED.
•Solidgreenindicatesanetworklink.
•Blinkinggreenindicatesnetworkactivity.
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•27
ServicethePA‐5200SeriesFirewall InterprettheLEDsonaPA‐5200SeriesFirewall
BackPanelLEDs
Powersupply TheACandDCpowersupplieshaveaFAILandanOKLED.
•FAIL
•Solidyellow—Thepowersupplyfailed.Thiscanalsoindicateafanfailureor
overheatingcondition.
•Blinkingyellow—Thepowersupplyisoutsideoftolerancelevels.
•Off—Powersupplyisoperatingnormally.
•OK
•Solidgreen—Thepowersupplyisoperatingnormally.
•Blinkinggreen—Thepowerinputispresentbutthepowersupplyisdisabled
bythesystem.
•Off—Nopowerinputorthepowersupplyfailed.
Fantray Green—Thefantraysandallfansareoperatingnormally.
Red—Oneormorefansinthefantrayfailed(seeReplaceaFanTrayonaPA‐5200
SeriesFirewall).
LED Description
Copyright © 2007-2017 Palo Alto Networks

28•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Theairintakefiltersareacriticalpartofthefirewallcoolingsystem.Thesefiltersensuresthatairentering
thefirewalldoesnotcontaindebris.Youmustreplacebothfilters(topandbottom)everysixmonthsorless,
dependingontheenvironmentwherethefirewallislocated,topreventascenariowherethereisnotenough
airpassingthroughthefilterstokeepthefirewallfromoverheating.
YoucanpurchasereplacementairfiltersandairfiltercoversfromPaloAltoNetworksoranauthorized
reseller.
Thefollowingprocedurecanbeperformedwiththefirewallpoweredonbutdonotleavethefirewall
withoutthefiltersinstalledforlongerthanittakestoreplacethefilters.
Thefirewalldoesnotgenerateasystemlogindicatingthatanairfilterhasbeenremovedorthatitneedstobe
replaced.Therefore,inadditiontoreplacingthemeverysixmonths,youneedtoscheduleregularinspectionsand
ensurethatthefiltersdonotclogsoonerthanwhentheyareduetobereplaced.Donotattempttocleanand
reuseafilter.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Step1Turnthetwoairfiltercoverthumbscrewscounter‐clockwiseandremovethefiltercoverandfilter(topfilter
shown).
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•29
ServicethePA‐5200SeriesFirewall ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall
Step2Lifteachsideofthefilterupwardtoloosenitfromthefiltercoverandthenslidethefilteroutofthefilter
cover.
Step3Installanewfilterintothefiltercoverensuringthatyouslideitunderthefiltercovercrossbars.Youcan
installthefilterwitheithersidefacingup.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

30•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
Step4Replacethetopfiltercoverandfilterandturnthetwothumbscrewsclockwisetosecurethecovertothe
firewall.
Step5Repeatthisproceduretoreplacethebottomairfilter.
ReplacetheAirIntakeFiltersonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•31
ServicethePA‐5200SeriesFirewall ReplaceaFanTrayonaPA‐5200SeriesFirewall
ReplaceaFanTrayonaPA‐5200SeriesFirewall
PA‐5200Seriesfirewallshavetwofantraysandeachfantraycontainsfourfans.Ifonefanonafantrayfails,
theLEDonthefantrayturnsred.Whenthisoccurs,immediatelyreplacethefantraytoavoidservice
interruption.Iftwoormorefansfailononeorbothfantrays,thefirewallwillshutdownandyoumust
replacethefailedfantray(s)torestorefunctionality.
Youcanreplaceafantraywhilethefirewallispoweredonbutyoumustreplaceitwithin45secondsorthe
thermalprotectioncircuitautomaticallyshutsdownthefirewall.
ReplaceaFanTrayonaPA‐5200Series
Step1Removethereplacementfantrayfromthepackaging.
Step2IdentifythefailedfantraybyviewingtheLEDs.
Duringafailurecondition,thefantrayLEDonthefailedfantrayandtheFANSLEDonthefrontofthe
firewallshowred.
Step3Removethefailedfantray.
1.Turnthefourfantraythumbscrewscounter‐clockwiseuntilthescrewsstop.
2.Graspthefantrayhandleandpullthetrayoutofthefirewall.
Step4Slidethereplacementfantrayintotheemptyfan‐trayslotensuringthatthealignmentgroovesonthefan
trayandthefan‐trayslotarealigned.Pushthetrayinuntilitseatsandthenturnthefourfan‐traythumb
screwsclockwisetosecurethetraytothefirewall.
ThefantrayLEDturnsgreenandiftherearenootherfailedfans,theFANLEDonthefrontofthefirewall
turnsgreen.
Ifthethermalprotectioncircuitpoweredoffthefirewallduetooverheatingorfanfailures,youneedto
disconnectandreconnectpower.OnanACmodel,disconnectbothpowercords,waitfiveseconds,andthen
plugthecordsbackin.OnaDCmodel,shutdowntheDCcircuitthatisprovidingpowertothefirewall,wait
fiveseconds,andthenrestorethepower.
Copyright © 2007-2017 Palo Alto Networks

32•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
PA‐5200SeriesfirewallshaveeithertwoACortwoDCpowersupplies(thesecondpowersupplyisfor
redundancy).Ifonepowersupplyfails,youcanreplaceitwithoutserviceinterruptionasdescribedinthe
followingprocedures.
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
ThefollowingproceduredescribeshowtoreplaceanACpowersupply.
ToavoidinjurytoyourselfordamagetoyourPaloAltoNetworks®hardwareorthedatathatresidesonthe
hardware,readtheProductSafetyWarnings.
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall
Step1IdentifythefailedpowersupplybyviewingthepowersupplyLEDonthebackofthefirewall;whenthereis
afailuretheFAILLEDturnssolidyellow.FordetailsonthepowersupplyLEDS,seeInterprettheLEDsona
PA‐5200SeriesFirewall.
Step2RemovetheVelcrostrapthatsecurestheACpowercordtothepowersupplyandremovethepowercord.
Step3Graspthehandleonthefailedpowersupplyandthensimultaneouslypressthereleaselevertotheleftand
thenpullthepowersupplyoutwardtoremoveit.
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•33
ServicethePA‐5200SeriesFirewall ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
Step4Removethereplacementpowersupplyfromthepackagingandslideitintotheemptypowersupplyslot.Push
thepowersupplyallthewayinuntilthereleaseleverclicksandsecuresthepowersupply.
Step5ConnecttheACpowercordtothepowersupplyinputandsecureittothepowersupplyusingtheVelcro
strap.
Step6ConnecttheotherendofthepowercordtoagroundedACpowersource.Thenewpowersupply
automaticallypowerson,theOKLEDturnsgreen,theFAILLEDturnsoff,andthepowerLED(PWR1orPWR
2)onthefrontofthefirewallturnsgreen.
ReplaceanACPowerSupplyonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

34•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall
ThefollowingproceduredescribeshowtoreplaceaDCpowersupply.
ToavoidinjurytoyourselfordamagetoyourPaloAltoNetworks®hardwareorthedatathatresidesonthe
hardware,readtheProductSafetyWarnings.
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall
Step1IdentifythefailedpowersupplybyviewingthepowersupplyLEDonthebackofthefirewall;whenthereis
afailure,theFAILLEDonthefailedpowersupplyturnssolidyellow.Formoredetailsonthepowersupply
LEDS,seeInterprettheLEDsonaPA‐5200SeriesFirewall.
Step2PowerofftheDCpowersourcethatisconnectedtothefailedDCpowersupply.
Ensurethatthepowerisoffbeforecontinuingtothenextstep.
Step3RemovetheplasticcoverthatprotectstheDCinputterminalsandthenuseaPhillips‐headscrewdriverto
removethescrewsholdingthepositiveandnegativeDCcablestotheDCinputterminals.
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•35
ServicethePA‐5200SeriesFirewall ReplaceaPowerSupplyonaPA‐5200SeriesFirewall
Step4Graspthehandleonthefailedpowersupplyandthensimultaneouslypressthereleaselevertotheleftand
pullthepowersupplyoutwardtoremoveit.
Step5Removethereplacementpowersupplyfromthepackagingandslideitintotheemptypowersupplyslot.Push
thepowersupplyallthewayinuntilthereleaseleverclicksandsecuresthepowersupply.
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

36•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaPowerSupplyonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
Step6ReconnectthepositiveandnegativeDCpowercablestothenewpowersupplyusingtheDCterminalscrews.
Makesureyouestablishthecorrectpolarity:positivetopositiveandnegativetonegative.
Step7WhenallDCpowercablesaresecurelyconnectedandtheplasticguardisproperlyreattached,poweronthe
DCpowersource.
ReplaceaDCPowerSupplyonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•37
ServicethePA‐5200SeriesFirewall ReplaceaDriveonaPA‐5200SeriesFirewall
ReplaceaDriveonaPA‐5200SeriesFirewall
ThePA‐5200Seriesfirewallshavetwosolid‐statedrives(SSDs)usedforsystemfilesandsystemlogsand
twohard‐diskdrives(HDDs)usedfornetworktrafficlogstorage.EachdrivepairisinaRAID1arraysothat
ifadrivefails,youcanreplacethefaileddrive(usingthesamemodeldrive)withoutserviceinterruption.The
systemdrivesarelabeledSYS 1andSYS 2andthelogdrivesarelabeledLOG 1andLOG 2.
Theprocedurestoreplaceasystemdrive(SSD)andalogdrive(HDD)aredifferent.
ReplaceaLogDriveonaPA‐5200SeriesFirewall
ReplaceaSystemDriveonaPA‐5200SeriesFirewall
ReplaceaLogDriveonaPA‐5200SeriesFirewall
Thefollowingproceduredescribeshowtoreplaceafailedlogdrive.Therearetwoscenarios:onewherethe
replacementdriveisthesamemodelasthefaileddriveandonewherethereplacementdriveisnotthesame
model.
WhenorderingareplacementdrivefromPaloAltoNetworksoryourreseller,youreceivetwodrives.This
ensuresthatifthereplacementdriveisnotthesamemodelasthefaileddrive,youcaninstalltwonewmatching
drives.Ifthereplacementdrivemodelisthesameasthefaileddrive,youneedonlyreplaceonefaileddriveand
canstoretheseconddriveasaspare.ForfirewallsinanHApair,thereisnorequirementthatthedrivesizes
matchbetweenthepairedsystems.
Inahighavailability(HA)configuration,ifonelogdrivefails(orifbothlogdrivesfail)intheactivefirewall,the
firewallentersthenon‐functionalHAstateandfailsover.IfthefirewallisnotinanHAconfigurationandonelog
drivefails,thefirewallcontinuestooperate.Ifbothlogdrivesfailinanon‐HAconfiguration,thefirewall
continuestooperatebutitdoesnotlognetworktrafficandyoucannotcommittheconfigurationuntilthereis
atleastonefunctioninglogdrive.
ReplaceaLogDriveonaPA‐5200SeriesFirewall
Step1Identifythefaileddriveanddeterminethedrivemodelbyrunningthefollowingoperationalcommandto
viewthestatusandmodelfields:
admin@PA-5020> show system raid detail
ThefollowingoutputshowsthattheLog1drivefailedandthatthemodelnumberofthatdriveis
ST2000NX0253.Thesystemlogalsoshowsanerrorthatindicateswhichdrivefailed(Log1orLog2).
Disk Pair Log Available
Status clean, degraded
Disk id Log1 Present
model : ST2000NX0253
size : 1907729 MB
status : failed
Disk id Log2 Present
model : ST2000NX0253
size : 1907729 MB
status : active sync
Step2RemovethefaileddrivefromtheRAID1arrayconfiguration.Inthisexample,runthefollowingcommandto
removetheLog1drivefromthearray:
admin@PA-5020> request system raid remove log1
Copyright © 2007-2017 Palo Alto Networks

38•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaDriveonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
Step3Presstheejectorbuttononthedrivecarriertoreleasethecarrierhandleandgentlypullthehandletoward
youtoremovethecarrieranddrive.
Theillustrationshowshowtoremoveasystem(SYS)drive.Theproceduretoremovealogdriveisthesame.
Step4Removethereplacementdrivefromthepackaginganddeterminethedrivemodel.Youwillcomparethis
modelnumberwiththemodelnumberofthefaileddrivetodeterminewhichreplacementproceduretouse
inStep 7.
ReplaceaLogDriveonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•39
ServicethePA‐5200SeriesFirewall ReplaceaDriveonaPA‐5200SeriesFirewall
Step5Installthereplacementdriveinthedrivecarrier.
1.Removethereplacementdrivefromtheantistaticbagandplaceitonanantistaticsurface.Placethefailed
drivenexttothereplacementdrivewiththeconnectorsfacingthesamedirection.
2.Removethefourscrewsthatholdthefaileddriveinthecarrierandremovethedrivefromthecarrier.
3.Installthereplacementdriveinthecarrierandsecureitusingthefourscrewsyouremovedfromthefailed
drive.
TheillustrationshowsanSSDsystemdriveandanHDDlogdrive;theproceduretoswapthedriveisthesame
forboth.
Step6Installthecarrierwiththereplacementdrive:
1.Ensurethatthedrivecarrierleverisintheopenposition;ifitisnot,presstheejectorbuttononthedrive
carriertoreleasetheleverandpullitoutuntilitisfullyopen.
2.Slidethecarrierassemblyintotheemptydrivebayuntilitisabout1/4”(.64cm)frombeingfullyinserted.
3.Beforefullyinsertingthecarrier,ensurethattheleverattachestothelockingmechanismonthefirewall
andthenclosethelevertoseatthecarrier.
Step7ChoosefromthefollowingtwoinstallationproceduresbasedonyourfindingsinStep 4:
•Ifthereplacementdriveisthesamemodelnumberasthefaileddrive,continuetoStep 8.
•If
thereplacementdriveisadifferentmodelnumberthanthefaileddrive,continuetoStep 9.
ReplaceaLogDriveonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

40•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaDriveonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
Step8(Samemodelreplacementdriveonly)Addthereplacementdrive(thatisthesamemodelasthefaileddrive)
totheRAID1array:
1.AddthereplacementdrivetotheRAID1array.Inthisexample,runthefollowingcommandtoaddthe
LOG 1drivetothearray:
admin@PA-5020> request system raid add log1
IfthereplacementdrivewaspreviouslyusedinadifferentPaloAltoNetworksfirewall,includethe
forceoptioninthiscommandtoforcethesystemtoreformatthedriveandaddittothearray.If
yourebootthefirewallafterremovingthefaileddrivefromthearray,theforceoptionisnot
required.Thisisbecausethesystemwillrecognizethatadrivewasmissinganditwillautomatically
reformatthenewlyinserteddriveandwilladdittothearray.
2.PeriodicallyviewtheRAIDstatusuntilyouseethatDisk Pair Log showsAvailable,thestatusshows
clean,andthestatusforeachdriveshowsactive syncstatus.ToviewRAIDstatus,runthefollowing
command:
admin@PA-5020> show system raid detail
Thefollowingoutputshowsthatbothlogdrivesareintheactive syncstate:
Disk Pair Log Available
Status clean
Disk id Log1 Present
model : ST2000NX0253
size : 1907729 MB
status : active sync
Disk id Log2 Present
model : ST2000NX0253
size : 1907729 MB
status : active sync
ReplaceaLogDriveonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

©PaloAltoNetworks,Inc. PA‐5200SeriesNext‐GenFirewallHardwareReference•41
ServicethePA‐5200SeriesFirewall ReplaceaDriveonaPA‐5200SeriesFirewall
Step9(Differentmodelreplacementdriveonly)Addthereplacementdrive(thatisadifferentmodelthanthefailed
drive)totheRAID1array:
Whenyouinitiatethecopycommandasdescribedinthefollowingsteps,loggingstopsandyoucannot
viewlogsuntilthecopyiscompleteandthediskpairshowsAvailable.
1.(Optional)SuspendthefirewallwiththefaileddriveifitistheactivefirewallinanHAconfiguration.
Thefirewallwillfailoverwhenthecopyprocessinthisproceduresstartsbutyoucanchooseto
VerifyFailoverormanuallysuspendthefirewallwiththefaileddrivebeforeyoucontinue.
2.CopythedatafromtheotherdriveintheRAID1arraytothereplacementdrive.Inthisexample,runthe
followingcommandtocopythedatafromtheLog2drivetotheLog1drive:
admin@PA-5020> request system raid copy from log2 to log1
3.RunthefollowingCLIcommandtoviewthestatusofthecopy:
admin@PA-5020> show system raid detail
PeriodicallyrunthiscommanduntilthecopyiscompleteandtheDisk Pair Log showsAvailable.
Atthispoint,theLog2driveshowsnot in usebecausethedrivemodelsarenotthesame.
Disk Pair Log Available
Status clean, degraded
Disk id Log1 Present
model : ST2000NX0999
size : 1907729 MB
status : active sync
Disk id Log2 Present
model : ST2000NX0253
size : 1907729 MB
status : not in use
4.Replacetheotherdriveinthearraysothedrivemodelsinthearrayarethesame.Inthisexample,
physicallyremovetheLog2drive,removeitfromthecarrier,andtheninstallthesecondreplacementdrive
inthecarrier.Step 5showshowtoswapdrivesinacarrier.
5.AddthesecondreplacementdrivetotheRAID1array.Inthisexample,runthefollowingcommandtoadd
theLog2drivetothearray:
admin@PA-5020> request system raid add log2
ThesystemautomaticallystartstoconfigurethenewdrivetomirrortheotherdriveintheRAID1array.
6.PeriodicallyviewtheRAIDstatusuntilyouseethattheDisk Pair LogshowsAvailableandbothdrives
showactive syncstatus.ToviewRAIDstatus,runthefollowingcommand:
admin@PA-5020> show system raid detail
Thefollowingoutputshowsthatbothdrivesareintheactive syncstate:
Disk Pair Log Available
Status clean
Disk id Log1 Present
model : ST2000NX0999
size : 1907729 MB
status : active sync
Disk id Log2 Present
model : ST2000NX0999
size : 1907729 MB
status : active sync
ReplaceaLogDriveonaPA‐5200SeriesFirewall(Continued)
Copyright © 2007-2017 Palo Alto Networks

42•PA‐5200SeriesNext‐GenFirewallHardwareReference ©PaloAltoNetworks,Inc.
ReplaceaDriveonaPA‐5200SeriesFirewall ServicethePA‐5200SeriesFirewall
ReplaceaSystemDriveonaPA‐5200SeriesFirewall
Thefollowingproceduredescribeshowtoreplaceafailedsystemdrive.Therearetwoscenarios:onewhere
thereplacementdriveisthesamemodelasthefaileddriveandonewherethereplacementdriveisnotthe
samemodel.
Ifyoureplaceasystemdrivewithadifferentmodeldrive,youmustbootthefirewallintotheMaintenance
RecoveryTool(MRT)tocopydatabetweendrives.Inahighavailability(HA)configuration,suspendthefirewall
withthefaileddriveasdescribedinthisprocedure.
Inahighavailability(HA)configuration,ifonesystemdrivefails(orifbothsystemdrivesfail)intheactivefirewall,
thefirewallentersthenon‐functionalHAstateandfailsover.IfthefirewallisnotinanHAconfigurationandone
systemdrivefails,thefirewallcontinuestooperate.Ifbothsystemdrivesfailinanon‐HAconfiguration,youwill
needtoreplacethesystemsdrivesandrestorethefirewallconfigurationfromarecentconfigurationbackup.
ReplaceaSystemDriveonaPA‐5200SeriesFirewall
Step1Identifythefaileddriveanddeterminethedrivemodel.
Whenthesystemdrivesarefunctioningnormally,allsystemdrivepartitionsshowbothdriveswiththestatus
clean.Ifasystemdrivefails,theOverall System Drives RAID status showsdegraded,oneormore
failedpartitionarrayshowsclean, degraded,andoneofthedriveswillbemissing(Sys1orSys2).
Inthisexample,theoutputfromtheshow system raid detailcommandshowsthatthedrivemodelis
MICRON_M510DC_MT,thepanlogspartitionshowsthestatus clean, degraded, anddriveSys1ismissing
fromthepanlogsarray;together,theseindicatethatyouneedtoreplacetheSys1drive.
admin@PA-5220> show system raid detail
Overall System Drives RAID status degraded
--------------------------------------------------------------------------------
Drive status
Disk id Sys1 Present (MICRON_M510DC_MT)
Disk id Sys2 Present (MICRON_M510DC_MT)
--------------------------------------------------------------------------------
Partition status
panlogs clean, degraded
Drive id Sys2 active sync
maint clean
Drive id Sys1 active sync
Drive id Sys2 active sync
sysroot0 clean
Drive id Sys1 active sync
Drive id Sys2 active sync
sysroot1 clean
Drive id Sys1 active sync
Drive id Sys2 active sync
pancfg clean
Drive id Sys1 active sync
Drive id Sys2 active sync
panrepo clean
Drive id Sys1 active sync
Drive id Sys2 active sync
swap clean
Drive id Sys1 active sync
Drive id Sys2 active sync
Step2RemovethefaileddrivefromtheRAID1array.Inthisexample,runthefollowingcommandtoremovedrive
Sys1 fromthearray:
admin@PA-5020> request system raid remove sys1
Copyright © 2007-2017 Palo Alto Networks