PaloAlto Networks PA-5400 Series Application guide

PA-5400 Series Next-Gen Firewall
Hardware Reference
paloaltonetworks.com/documentation

2 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE |
Contact Information
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support
About the Documentation
• For the most recent version of this guide or for access to related documentation, visit the Technical
Documentation portal www.paloaltonetworks.com/documentation.
• To search for a specific topic, go to our search page www.paloaltonetworks.com/documentation/
document-search.html.
• Have feedback or questions for us? Leave a comment on any page in the portal, or write to us at
[email protected].
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2020-2021 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
Last Revised
June 3, 2021

TABLE OF CONTENTS iii
Table of Contents
Before You Begin................................................................................................5
Upgrade/Downgrade Considerations for Firewalls and Appliances............................................... 7
Tamper Proof Statement...........................................................................................................................8
Third-Party Component Support.............................................................................................................9
Product Safety Warnings........................................................................................................................10
PA-5400 Series Firewall Overview.............................................................. 15
PA-5450 Front and Back Panel Descriptions.................................................................................... 17
PA-5450 Front Panel.................................................................................................................. 17
PA-5450 Back Panel....................................................................................................................18
PA-5400 Series Firewall Module and Interface Card Information........ 21
PA-5400 Series Firewall Base Card (BC)............................................................................................ 23
PA-5400 BC-A.............................................................................................................................. 23
PA-5400 Series Firewall Management Processor Card (MPC)......................................................24
PA-5400 MPC-A...........................................................................................................................24
PA-5400 Series Firewall Networking Card (NC)...............................................................................28
PA-5400 NC-A..............................................................................................................................28
Identify PA-5400 Series NC Port Activity and Link LEDs..................................................31
PA-5400 Series Firewall Data Processor Card (DPC)......................................................................32
PA-5400 DPC-A........................................................................................................................... 32
PA-5400 Series Firewall Installation............................................................ 35
PA-5400 Series Firewall Equipment Rack Installation.....................................................................37
PA-5400 Series Firewall Rack Install Safety Information...................................................37
Install the PA-5450 Firewall in an Equipment Rack............................................................ 37
Install the Mandatory PA-5400 Series Firewall Front Slot Cards................................................. 44
Install a PA-5400 Series Firewall Management Processor Card (MPC).......................... 44
Install a PA-5400 Series Firewall Networking Card (NC)...................................................45
Configure Session Distribution on a PA-5400 Series Firewall.......................................... 46
Install a PA-5400 Series Firewall Data Processor Card (DPC).......................................... 46
Set Up a Connection to the Firewall................................................................................................... 48
Connect Power to a PA-5400 Series Firewall...................................................................................50
Determine PA-5400 Series Firewall Power Configuration Requirements......................50
Connect AC or DC Power to a PA-5450 Firewall............................................................... 50
View PA-5400 Series Firewall Power Statistics................................................................... 54
Connect Cables to a PA-5400 Series Firewall...................................................................................56
Verify the PA-5400 Series Firewall NC Configuration....................................................................57
Service the PA-5400 Series Firewall Hardware........................................ 59
Replace a PA-5400 Series Firewall AC or DC Power Supply........................................................ 61
Interpret the PA-5400 Series Firewall Power Supply LEDs.............................................. 61
Replace a PA-5450 AC or DC Power Supply....................................................................... 61
Replace a PA-5400 Series Base Card (BC).........................................................................................63
Replace a PA-5450 Base Card (BC).........................................................................................63
Replace a PA-5400 Series Firewall Fan Assembly........................................................................... 65

iv TABLE OF CONTENTS
Replace a PA-5450 Fan Assembly...........................................................................................65
Replace a PA-5400 Series Firewall Front Slot Card.........................................................................68
Replace a PA-5400 Series Management Processor Card (MPC)...................................... 68
Replace a PA-5400 Series Networking Card (NC)...............................................................69
Replace a PA-5400 Series Data Processor Card (DPC)...................................................... 72
PA-5400 Series Front Slot and Card States.......................................................................... 73
PA-5400 Series Logical Card Slots.......................................................................................... 74
Replace a PA-5450 Front Slot Card in a High Availability (HA) Configuration..............77
Install an MPC Logging Drive................................................................................................................79
Replace an MPC System Drive............................................................................................................. 80
PA-5400 Series Firewall Specifications.......................................................83
PA-5400 Series Firewall Physical Specifications...............................................................................85
PA-5400 Series Firewall Electrical Specifications.............................................................................86
PA-5400 Series Firewall Component Electrical Specifications......................................... 86
PA-5400 Series Firewall Power Cord Types.........................................................................86
PA-5400 Series Firewall Environmental Specifications...................................................................88
PA-5400 Series Firewall Hardware Compliance Statements................. 89
PA-5400 Series Firewall Compliance Statements............................................................................ 91

5
Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-generation
firewall or appliance. The following topics apply to all Palo Alto Networks firewalls and
appliances except where noted.
> Upgrade/Downgrade Considerations for Firewalls and Appliances
> Tamper Proof Statement
> Third-Party Component Support
> Product Safety Warnings

6 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 7
© 2021 Palo Alto Networks, Inc.
Upgrade/Downgrade Considerations for
Firewalls and Appliances
The following table lists hardware features that have upgrade or downgrade impact. Make sure you
understand all upgrade/downgrade considerations before you upgrade or downgrade from the specified
version of PAN-OS.
Feature Release Upgrade Considerations Downgrade Considerations
PA-7000 Log Forwarding
Card (LFC)
10.0 If you are using an LFC
with a PA-7000 Series
Firewall, when you
upgrade to PAN-OS 10.0,
you must configure the
management plane or
dataplane interface for
the service route because
the LFC ports do not
support the requirements
for the service route. We
recommend using the
dataplane interface for
the Data Services service
route.
n/a
Upgrading a PA-7000
Series Firewall with a
first generation switch
management card
(PA-7050-SMC or
PA-7080-SMC)
PAN-OS 8.0
and later
Before upgrading the
firewall, run the following
CLI command to check the
flash drive’s status: debug
system disk-smart-
info disk-1.
If the value for
attribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with the
upgrade. If the value is
less than 20, then contact
support for assistance.
Before downgrading the
firewall, run the following
CLI command to check the
flash drive’s status: debug
system disk-smart-
info disk-1.
If the value for
attribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with the
downgrade. If the value is
less than 20, then contact
support for assistance.

8 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during shipping, verify
the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the tracking
number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.
(PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and therefore
do not include a warranty label on the firewall.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 9
© 2021 Palo Alto Networks, Inc.
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party Component
Support statement.

10 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto Networks
hardware, be sure you understand and prepare for the following warnings before you install or service the
hardware. You will also see warning messages throughout the hardware reference where potential hazards
exist.
All Palo Alto Networks products with laser-based optical interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a specific
hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component that has
exposed circuits, ensure that you wear an electrostatic discharge (ESD) strap. Before handling the
component, make sure the metal contact on the wrist strap is touching your skin and that the other end
of the strap is connected to earth ground.
French Translation: Lorsque vous installez ou que vous intervenez sur un composant matériel de
pare-feu ou de dispositif Palo Alto Networks qui présente des circuits exposés, veillez à porter un
bracelet antistatique. Avant de manipuler le composant, vérifiez que le contact métallique du bracelet
antistatique est en contact avec votre peau et que l’autre extrémité du bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnetic
compliance (EMC) regulations.
French Translation: Des câbles Ethernet blindés reliés à la terre doivent être utilisés pour garantir la
conformité de l'organisme aux émissions électromagnétiques (CEM).
• (PA-3200, PA-5200, PA-5400, PA-7050, and PA-7080 firewalls only) At least two people are
recommended for unpacking, handling, and relocating the heavier firewalls.
• () At least two people are recommended for unpacking, handling, and relocating the heavier firewalls.
• (PA-220 firewalls only) The appliance meets the requirements of IEC 61000-4-5 surge immunity test. To
prevent damage from electrical surges on Ethernet ports, we recommend that you use an Ethernet surge
protection device with the following specifications:
• Rated for Gigabit Ethernet up to category 5E and minimum 1Gbps.
• Protection provided on all eight signal leads.
• Both line-to-line and line-to-ground/shield are provided.
• Protection device must be connected to earth ground and use shielded category 5E or higher
Ethernet cable.
Technical Specifications:
• Protective circuit complies with IEC test classifications B2, C1, C2, C3, and D1.
• Normal discharge current (core to earth ground) is 2kA per signal pair.
• Normal discharge current (core to core) is 100A.
• Total discharge current is 10kA.
• (ION 1000 and ION 2000 only) The appliance meets the requirements of IEC 61000-4-5 surge immunity
test. To prevent damage from electrical surges on Ethernet ports, we recommend that you use an
Ethernet surge protection device with the following specifications:
Technical Specifications:
• Protective circuit complies with IEC test classifications B2, C1, C2, C3, and D1.
• Normal discharge current (core to earth ground) is 2kA per signal pair.
• Normal discharge current (core to core) is 100A.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 11
© 2021 Palo Alto Networks, Inc.
• Total discharge current is 10kA.
•French Translation: (PA-220 uniquement) Les appareils sont conformes aux exigences du test
d’immunité aux surtensions IEC 61000-4-5. Pour éviter les dommages résultant de surtension électrique
sur les ports Ethernet, il est recommandé d’utiliser un dispositif de protection contre les surtensions aux
caractéristiques suivantes:
• Gigabit Ethernet jusqu’à la catégorie 5E, débit 1 Go/s minimum.
• Protection sur les huit câbles signal.
• Le blindage et la mise à la terre “ligne à ligne” et “ligne à la terre” sont fournis.
• Le dispositif de protection doit être raccordé à la terre et un câble Ethernet blindé de catégorie 5E ou
supérieure doit être utilisé.
Caractéristiques techniques:
• Le circuit de protection est conforme aux classifications de test IEC B2, C1, C2, C3, et D1.
• Le courant de décharge normal (cœur vers terre) est de 2kA par paire de signal.
• Le courant de décharge normal (cœur vers cœur) est de 100 A.
• Le courant de décharge total est de 10kA.
•French Translation: (ION 1000 et 2000 uniquement) Les appareils sont conformes aux exigences du test
d’immunité aux surtensions IEC 61000-4-5. Pour éviter les dommages résultant de surtension électrique
sur les ports Ethernet, il est recommandé d’utiliser un dispositif de protection contre les surtensions aux
caractéristiques suivantes:
• Gigabit Ethernet jusqu’à la catégorie 5E, débit 1 Go/s minimum.
• Protection sur les huit câbles signal.
• Le blindage et la mise à la terre “ligne à ligne” et “ligne à la terre” sont fournis.
• Le dispositif de protection doit être raccordé à la terre et un câble Ethernet blindé de catégorie 5E ou
supérieure doit être utilisé.
Caractéristiques techniques:
• Le circuit de protection est conforme aux classifications de test IEC B2, C1, C2, C3, et D1.
• Le courant de décharge normal (cœur vers terre) est de 2kA par paire de signal.
• Le courant de décharge normal (cœur vers cœur) est de 100 A.
• Le courant de décharge total est de 10kA.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For details
on the electrical range, refer to electrical specifications in the hardware reference for your firewall or
appliance.
French Translation: Veillez à ce que la tension d’alimentation ne dépasse pas la plage d’entrée du
pare-feu ou du dispositif. Pour plus d’informations sur la mesure électrique, consulter la rubrique des
caractéristiques électriques dans la documentation de votre matériel de pare-feu ou votre dispositif.
• Do not replace a battery with an incorrect battery type; doing so can cause the replacement battery to
explode. Dispose of used batteries according to local regulations.
French Translation: Ne remplacez pas la batterie par une batterie de type non adapté, cette dernière
risquerait d’exploser. Mettez au rebut les batteries usagées conformément aux instructions.
•(All Palo Alto Networks appliances with two or
more power supplies) Disconnect all power cords
(AC or DC) from the power inputs to fully de-
energize the hardware.
French Translation: (Tous les appareils Palo
Alto Networks avec au moins deux sources
d’alimentation) Débranchez tous les cordons

12 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin
© 2021 Palo Alto Networks, Inc.
d’alimentation (c.a. ou c.c.) des entrées
d’alimentation et mettez le matériel hors tension.
•(PA-7000 Series firewalls only)
Caution: High touch current
Connect to earth before connecting to the power
supply.
Ensure that the protective earthing conductor is
connected to the provided ground lug on the rear
side of the firewall.
•(PA-7000 Series firewalls only) When removing a
fan tray from a PA-7000 Series firewall, first pull
the fan tray out about 1 inch (2.5cm) and then wait
a minimum of 10 seconds before extracting the
entire fan tray. This allows the fans to stop spinning
and helps you avoid serious injury when removing
the fan tray. You can replace a fan tray while the
firewall is powered on but you must replace it
within 45 seconds and you can only replace one
fan tray at a time to prevent the thermal protection
circuit from shutting down the firewall.
French Translation: (Pare-feu PA-7000
uniquement) Lors du retrait d’un tiroir de
ventilation d’un pare-feu PA-7000, retirez tout
d’abord le tiroir sur 2,5 cm, puis patientez au moins
10 secondes avant de retirer complètement le
tiroir de ventilation. Cela permet aux ventilateurs
d’arrêter de tourner et permet d’éviter des
blessures graves lors du retrait du tiroir. Vous
pouvez remplacer un tiroir de ventilation lors de
la mise sous tension du pare-feu. Toutefois, vous
devez le faire dans les 45 secondes et vous ne
pouvez remplacer qu’un tiroir à la fois, sinon le
circuit de protection thermique arrêtera le pare-
feu.
The following applies only to Palo Alto Networks firewalls that support a direct current (DC) power source:
French Translation: Les instructions suivantes s’appliquent uniquement aux pare-feux de Palo Alto
Networks prenant en charge une source d’alimentation en courant continu (c.c.):
• Do not connect or disconnect energized DC wires to the power supply.
French Translation: Ne raccordez ni débranchez de câbles c.c. sous tension à la source d’alimentation.
• The DC system must be earthed at a single (central) location.
French Translation: Le système c.c. doit être mis à la terre à un seul emplacement (central).
• The DC supply source must be located within the same premises as the firewall.
French Translation: La source d’alimentation c.c. doit se trouver dans les mêmes locaux que ce pare-feu.
• The DC battery return wiring on the firewall must be connected as an isolated DC (DC-I) return.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 13
© 2021 Palo Alto Networks, Inc.
French Translation: Le câblage de retour de batterie c.c. sur le pare-feu doit être raccordé en tant que
retour c.c. isolé (CC-I).
• The firewall must be connected either directly to the DC supply system earthing electrode conductor
or to a bonding jumper from an earthing terminal bar or bus to which the DC supply system earthing
electrode conductor is connected.
French Translation: Ce pare-feu doit être branché directement sur le conducteur à électrode de mise à
la terre du système d’alimentation c.c. ou sur le connecteur d'une barrette/d'un bus à bornes de mise à la
terre auquel le conducteur à électrode de mise à la terre du système d'alimentation c.c. est raccordé.
• The firewall must be in the same immediate area (such as adjacent cabinets) as any other equipment that
has a connection between the earthing conductor of the DC supply circuit and the earthing of the DC
system.
French Translation: Le pare-feu doit se trouver dans la même zone immédiate (des armoires adjacentes
par exemple) que tout autre équipement doté d’un raccordement entre le conducteur de mise à la terre
du même circuit d’alimentation c.c. et la mise à la terre du système c.c.
• Do not disconnect the firewall in the earthed circuit conductor between the DC source and the point of
connection of the earthing electrode conductor.
French Translation: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre entre la
source d'alimentation c.c. et le point de raccordement du conducteur à électrode de mise à la terre.
• Install all firewalls that use DC power in restricted access areas only. A restricted access area is where
access is granted only to craft (service) personnel using a special tool, lock and key, or other means of
security, and that is controlled by the authority responsible for the location.
French Translation: Tous les pare-feux utilisant une alimentation c.c. sont conçus pour être installés
dans des zones à accès limité uniquement. Une zone à accès limité correspond à une zone dans laquelle
l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un outil spécial, cadenas ou clé, ou autre
dispositif de sécurité, et qui est contrôlée par l'autorité responsable du site.
• Install the firewall DC ground cable only as described in the power connection procedure for the firewall
that you are installing. You must use the American wire gauge (AWG) cable specified and torque all nuts
to the torque value specified in the installation procedure for your firewall.
French Translation: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans la procédure
de raccordement à l’alimentation pour le pare-feu que vous installez. Utilisez le câble American wire
gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la procédure d’installation de votre
pare-feu pare-feu.
• The firewall permits the connection of the earthed conductor of the DC supply circuit to the earthing
conductor at the equipment as described in the installation procedure for your firewall.
French Translation: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit
d’alimentation c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la procédure
d’installation du pare-feu.
• A suitably-rated DC mains disconnect device must be provided as part of the building installation.
French Translation: Un interrupteur d'isolement suffisant doit être fourni pendant l'installation du
bâtiment.

14 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin

15
PA-5400 Series Firewall Overview
The PA-5400 Series firewalls (currently only the PA-5450) are high performance modular
appliances designed for large enterprise environments, data centers, and internet gateway
deployments. The PA-5400 Series can leverage either AC or DC power and utilizes Networking
Cards (NCs) and Data Processor Cards (DPCs) to scale network interfaces and data processing
power as needed. In the PA-5450, you can install up to two NCs and four to five DPCs
depending on your front slot configuration. These firewalls also feature a replaceable Base
Card (BC) that interfaces with the signal connectors of the seven front slots, power supplies,
and fan connections. Integrated with the BC is the Management Processor Card (MPC) that
provides two logging ports, two management ports, and two HA1 ports for high availability
deployments.
First Supported PAN-OS® Software Release: PAN-OS 10.1.0
The following topic describes the hardware features of PA-5400 Series firewalls.
> PA-5450 Front and Back Panel Descriptions

16 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-5400 Series Firewall Overview
© 2021 Palo Alto Networks, Inc.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-5400 Series Firewall Overview 17
© 2021 Palo Alto Networks, Inc.
PA-5450 Front and Back Panel Descriptions
•PA-5450 Front Panel
•PA-5450 Back Panel
PA-5450 Front Panel
The following image shows the front panel of the PA-5450 firewall and the table describes each front panel
component.
Item Component Description
1 Networking Cards (NC) Provides network connectivity. An NC must be installed in slot
1. A second, optional NC can be installed in slot 2 as shown in
the image.
For more information, see PA-5400 Series Firewall Networking
Card (NC).
2 Data Processor Cards (DPC) Provides processing power to the appliance. Up to five DPCs
can be installed in the appliance in slots 2 through 6. If a second
NC is installed in slot 2, then up to four DPCs can be installed in
the appliance instead.
For more information, see PA-5400 Series Firewall Data
Processor Card (DPC)
3 Blank Panel Serves as a cover for empty slots in order to help the appliance
maintain system air flow.

18 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-5400 Series Firewall Overview
© 2021 Palo Alto Networks, Inc.
Item Component Description
4 Management Processor Card
(MPC)
Provides management, logging, and high availability capabilities.
The MPC is a mandatory front card that is installed in slot 7.
For more information, see PA-5400 Series Firewall
Management Processor Card (MPC).
5 Front Mounting Flange The two front mounting flanges are fastened to an equipment
rack when mounting the firewall.
6 Electrostatic Discharge (ESD)
port
Provides a grounding point that you use when removing or
installing appliance components. Secure the provided wrist
strap end of the ESD strap around your wrist and plug the other
end into the ESD port.
To view system firmware versions, use the following CLI command:
admin@PA-5400> show chassis firmware
PA-5450 Back Panel
The following image shows the back panel of the PA-5450 firewall (with two AC power supplies installed)
and the table describes each back panel component.

PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-5400 Series Firewall Overview 19
© 2021 Palo Alto Networks, Inc.
Item Component Description
1 Ground stud Two-post stud used to ground the appliance to earth ground.
Use the provided 6 AWG two#post ground lug to connect a
grounded cable (not included) to the two#post stud.
2 Fan Assemblies Provide the appliance with cooling and ventilation. There are
four dual-rotor fan assemblies that can be individually replaced.
For information on replacing or installing a fan, see Replace a
PA-5450 Fan Assembly.
3 Electrostatic Discharge (ESD)
port
Provides a grounding point that you use when removing or
installing appliance components. Secure the provided wrist strap
end of the ESD strap around your wrist and plug the other end
into the ESD port.
4 Power Supplies Provide AC or DC power to the appliance. A minimum of two
power supplies is required, while additional power supplies can
be used to provide redundancy.
For information on connecting power to the appliance, see
Connect Power to a PA-5400 Series Firewall.
To view system firmware versions, use the following CLI command:
admin@PA-5400> show chassis firmware

20 PA-5400 SERIES NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-5400 Series Firewall Overview