PaloAlto Networks PA-7000 Series Application guide

PA-7000 Series Firewall Hardware
Reference
paloaltonetworks.com/documentation

2 PA-7000 SERIES FIREWALL HARDWARE REFERENCE |
Contact Information
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support
About the Documentation
• For the most recent version of this guide or for access to related documentation, visit the Technical
Documentation portal www.paloaltonetworks.com/documentation.
• To search for a specific topic, go to our search page www.paloaltonetworks.com/documentation/
document-search.html.
• Have feedback or questions for us? Leave a comment on any page in the portal, or write to us at
[email protected].
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2018-2019 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
Last Revised
October 10, 2019

TABLE OF CONTENTS iii
Table of Contents
Before You Begin................................................................................................5
Tamper Proof Statement...........................................................................................................................7
Third-Party Component Support.............................................................................................................8
Product Safety Warnings.......................................................................................................................... 9
PA-7000 Series Firewall Overview.............................................................. 13
PA-7050 Front and Back Panel Descriptions.................................................................................... 15
PA-7050 Front Panel (AC).........................................................................................................15
PA-7050 Back Panel (AC).......................................................................................................... 17
PA-7050 Front Panel (DC).........................................................................................................19
PA-7050 Back Panel (DC)..........................................................................................................19
PA-7080 Front and Back Panel Descriptions.................................................................................... 21
PA-7080 Front Panel (AC).........................................................................................................21
PA-7080 Back Panel (AC).......................................................................................................... 24
PA-7080 Front Panel (DC).........................................................................................................26
PA-7080 Back Panel (DC)..........................................................................................................27
PA-7000 Series Firewall Module and Interface Card Information........ 29
PA-7000 Series Firewall Switch Management Cards (SMCs)........................................................ 31
PA-7000 Series Firewall SMC Component Descriptions................................................... 31
PA-7000 Series Firewall SMC-B Component Descriptions............................................... 34
PA-7000 Series Firewall SMC-B Requirements....................................................................37
Interpret the PA-7000 Series Firewall SMC LEDs...............................................................37
PA-7000 Series Firewall Log Cards......................................................................................................42
PA-7000 Series Firewall Log Processing Card (LPC)...........................................................42
PA-7000 Series Firewall Log Forwarding Card (LFC)..........................................................44
PA-7000 Series Firewall Network Processing Cards (NPCs)......................................................... 48
PA-7000 20G NPC...................................................................................................................... 48
PA-7000 20GXM NPC................................................................................................................51
PA-7000 20GQ NPC...................................................................................................................51
PA-7000 20GQXM NPC............................................................................................................ 53
PA-7000 100G NPC....................................................................................................................53
Identify PA-7000 Series NPC Port Activity and Link LEDs............................................... 57
PA-7000 Series Firewall Installation............................................................ 59
PA-7000 Series Firewall Equipment Rack Installation.....................................................................61
PA-7000 Series Firewall Rack Install Safety Information...................................................61
Install the PA-7050 Firewall in the Mid-Mount Position................................................... 61
Install the PA-7050 Firewall in the Front-Mount Position................................................ 63
Install the PA-7080 Firewall in the Mid-Mount Position................................................... 68
Install the PA-7080 Firewall in the Front-Mount Position................................................ 71
Install the Mandatory PA-7000 Series Firewall Front Slot Cards................................................. 75
Install a PA-7000 Series Switch Management Card............................................................75
Install a PA-7000 Series Firewall Log Card........................................................................... 79
Install a PA-7000 Series Firewall Network Processing Card (NPC)................................. 84
Configure Session Distribution on a PA-7000 Series Firewall.......................................... 90
Connect Power to a PA-7000 Series Firewall...................................................................................91

iv TABLE OF CONTENTS
PA-7000 Series Power Configuration Options.....................................................................91
Determine PA-7000 Series Firewall Power Configuration Requirements......................92
Connect AC Power to a PA-7050 Firewall............................................................................93
Connect DC Power to a PA-7050 Firewall........................................................................... 95
Connect AC Power to a PA-7080 Firewall............................................................................97
Connect DC Power to a PA-7080 Firewall........................................................................... 99
View PA-7000 Series Firewall Power Statistics.................................................................102
Connect Cables to a PA-7000 Series Firewall................................................................................ 105
Verify the PA-7000 Series Firewall LPC and NPC Configuration.............................................. 107
Verify the PA-7000 Series Firewall LPC Configuration................................................... 107
Verify the PA-7000 Series Firewall NPC Configuration.................................................. 108
Install the PA-7080 Firewall EMI Filter............................................................................................ 110
Service the PA-7000 Series Firewall Hardware......................................111
Replace a PA-7000 Series Firewall AC or DC Power Supply...................................................... 113
Interpret the PA-7000 Series Firewall Power Supply LEDs............................................113
Replace a PA-7000 Series AC Power Supply..................................................................... 114
Replace a PA-7000 Series DC Power Supply.....................................................................117
Replace a PA-7080 DC PEM..................................................................................................122
Replace a PA-7000 Series Firewall Fan Tray.................................................................................. 124
Replace a PA-7050 Fan Tray..................................................................................................124
Replace a PA-7080 Fan Tray..................................................................................................129
Replace a PA-7000 Series Firewall Air Filter.................................................................................. 132
Replace a PA-7000 Series Firewall Front Slot Card...................................................................... 136
Replace a PA-7000 Series Switch Management Card (SMC)..........................................136
Replace a PA-7000 Series Log Card.....................................................................................139
Replace a PA-7000 Series Network Processing Card (NPC)...........................................143
Replace a PA-7000 Series Firewall LPC Drive................................................................................152
Re-Index the LPC Drives...................................................................................................................... 157
Replace a PA-7050-SMC-B or PA-7080-SMC-B Drive................................................................160
Increase the PA-7000 Series Firewall LPC Log Storage Capacity.............................................. 165
PA-7000 Series Firewall Specifications.................................................... 173
PA-7000 Series Firewall Physical Specifications............................................................................ 175
PA-7000 Series Firewall Electrical Specifications.......................................................................... 178
PA-7000 Series Firewall Component Electrical Specifications....................................... 178
PA-7000 Series Firewall Power Cord Types.......................................................................179
PA-7000 Series Firewall Environmental Specifications................................................................ 181
PA-7000 Series Firewall Hardware Compliance Statements...............183
PA-7000 Series Firewall Compliance Statements.......................................................................... 185

5
Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-generation
firewall or appliance. The following topics apply to all Palo Alto Networks firewalls and
appliances except where noted.
> Tamper Proof Statement
> Third-Party Component Support
> Product Safety Warnings

6 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin
© 2019 Palo Alto Networks, Inc.

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin 7
© 2019 Palo Alto Networks, Inc.
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during shipping, verify
the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the tracking
number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.
(PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and therefore
do not include a warranty label on the firewall.

8 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin
© 2019 Palo Alto Networks, Inc.
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party Component
Support statement.

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin 9
© 2019 Palo Alto Networks, Inc.
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto Networks
hardware, be sure you understand and prepare for the following warnings before you install or service the
hardware. You will also see warning messages throughout the hardware reference where potential hazards
exist.
All Palo Alto Networks products with laser-based optical interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a specific
hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component that has
exposed circuits, ensure that you wear an electrostatic discharge (ESD) strap. Before handling the
component, make sure the metal contact on the wrist strap is touching your skin and that the other end
of the strap is connected to earth ground.
French Translation: Lorsque vous installez ou que vous intervenez sur un composant matériel de
pare-feu ou de dispositif Palo Alto Networks qui présente des circuits exposés, veillez à porter un
bracelet antistatique. Avant de manipuler le composant, vérifiez que le contact métallique du bracelet
antistatique est en contact avec votre peau et que l’autre extrémité du bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnetic
compliance (EMC) regulations.
French Translation: D es câbles Ethernet blindés reliés à la terre doivent être utilisés pour garantir la
conformité de l'organisme aux émissions électromagnétiques (CEM).
• (PA-220 firewalls only) The PA-220 firewall meets the requirements of IEC 61000-4-5 surge immunity
test. To prevent damage from electrical surges on Ethernet ports, we recommend that you use an
Ethernet surge protection device with the following specifications:
• Rated for Gigabit Ethernet up to category 5E and minimum 1Gbps.
• Protection provided on all eight signal leads.
• Both line-to-line and line-to-ground/shield are provided.
• Protection device must be connected to earth ground and use shielded category 5E or higher
Ethernet cable.
Technical Specifications:
• Protective circuit complies with IEC test classifications B2, C1, C2, C3, and D1.
• Normal discharge current (core to earth ground) is 2kA per signal pair.
• Normal discharge current (core to core) is 100A.
• Total discharge current is 10kA.
•French Translation: (PA-220 uniquement) Les pare-feux PA-220 sont conformes aux exigences du test
d’immunité aux surtensions IEC 61000-4-5. Pour éviter les dommages résultant de surtension électrique
sur les ports Ethernet, il est recommandé d’utiliser un dispositif de protection contre les surtensions aux
caractéristiques suivantes:
• Gigabit Ethernet jusqu’à la catégorie 5E, débit 1 Go/s minimum.
• Protection sur les huit câbles signal.
• Le blindage et la mise à la terre “ligne à ligne” et “ligne à la terre” sont fournis.
• Le dispositif de protection doit être raccordé à la terre et un câble Ethernet blindé de catégorie 5E ou
supérieure doit être utilisé.
Caractéristiques techniques:

10 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin
© 2019 Palo Alto Networks, Inc.
• Le circuit de protection est conforme aux classifications de test IEC B2, C1, C2, C3, et D1.
• Le courant de décharge normal (cœur vers terre) est de 2kA par paire de signal.
• Le courant de décharge normal (cœur vers cœur) est de 100 A.
• Le courant de décharge total est de 10kA.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For details
on the electrical range, refer to electrical specifications in the hardware reference for your firewall or
appliance.
French Translation: Veillez à ce que la tension d’alimentation ne dépasse pas la plage d’entrée du
pare-feu ou du dispositif. Pour plus d’informations sur la mesure électrique, consulter la rubrique des
caractéristiques électriques dans la documentation de votre matériel de pare-feu ou votre dispositif.
• Do not replace a battery with an incorrect battery type; doing so can cause the replacement battery to
explode. Dispose of used batteries according to local regulations.
French Translation: Ne remplacez pas la batterie par une batterie de type non adapté, cette dernière
risquerait d’exploser. Mettez au rebut les batteries usagées conformément aux instructions.
• (All firewalls with two or more power supplies) Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.
French Translation: (Tous les pare-feux avec au moins deux sources d’alimentation) Débranchez tous les
cordons d’alimentation (c.a. ou c.c.) des entrées d’alimentation et mettez le matériel hors tension.
• (PA-7000 Series firewalls only) When removing a fan tray from a PA-7000 Series firewall, first pull the
fan tray out about 1 inch (2.5cm) and then wait a minimum of 10 seconds before extracting the entire
fan tray. This allows the fans to stop spinning and helps you avoid serious injury when removing the
fan tray. You can replace a fan tray while the firewall is powered on but you must replace it within 45
seconds and you can only replace one fan tray at a time to prevent the thermal protection circuit from
shutting down the firewall.
French Translation: (Pare-feu PA-7000 uniquement) Lors du retrait d’un tiroir de ventilation d’un pare-
feu PA-7000, retirez tout d’abord le tiroir sur 2,5 cm, puis patientez au moins 10 secondes avant de
retirer complètement le tiroir de ventilation. Cela permet aux ventilateurs d’arrêter de tourner et permet
d’éviter des blessures graves lors du retrait du tiroir. Vous pouvez remplacer un tiroir de ventilation
lors de la mise sous tension du pare-feu. Toutefois, vous devez le faire dans les 45 secondes et vous ne
pouvez remplacer qu’un tiroir à la fois, sinon le circuit de protection thermique arrêtera le pare-feu.
• (All firewalls with two or more power supplies) Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.
French Translation: (Tous les pare-feux avec au moins deux sources d’alimentation) Débranchez tous les
cordons d’alimentation (c.a. ou c.c.) des entrées d’alimentation et mettez le matériel hors tension.
The following applies only to Palo Alto Networks firewalls that support a direct current (DC) power source:
French Translation: Les instructions suivantes s’appliquent uniquement aux pare-feux de Palo Alto
Networks prenant en charge une source d’alimentation en courant continu (c.c.):
• Do not connect or disconnect energized DC wires to the power supply.
French Translation: Ne raccordez ni débranchez de câbles c.c. sous tension à la source d’alimentation.
• The DC system must be earthed at a single (central) location.
French Translation: Le système c.c. doit être mis à la terre à un seul emplacement (central).
• The DC supply source must be located within the same premises as the firewall.
French Translation: La source d’alimentation c.c. doit se trouver dans les mêmes locaux que ce pare-feu.
• The DC battery return wiring on the firewall must be connected as an isolated DC (DC-I) return.
French Translation: Le câblage de retour de batterie c.c. sur le pare-feu doit être raccordé en tant que
retour c.c. isolé (CC-I).

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin 11
© 2019 Palo Alto Networks, Inc.
• The firewall must be connected either directly to the DC supply system earthing electrode conductor
or to a bonding jumper from an earthing terminal bar or bus to which the DC supply system earthing
electrode conductor is connected.
French Translation: Ce pare-feu doit être branché directement sur le conducteur à électrode de mise à
la terre du système d’alimentation c.c. ou sur le connecteur d'une barrette/d'un bus à bornes de mise à la
terre auquel le conducteur à électrode de mise à la terre du système d'alimentation c.c. est raccordé.
• The firewall must be in the same immediate area (such as adjacent cabinets) as any other equipment that
has a connection between the earthing conductor of the DC supply circuit and the earthing of the DC
system.
French Translation: Le pare-feu doit se trouver dans la même zone immédiate (des armoires adjacentes
par exemple) que tout autre équipement doté d’un raccordement entre le conducteur de mise à la terre
du même circuit d’alimentation c.c. et la mise à la terre du système c.c.
• Do not disconnect the firewall in the earthed circuit conductor between the DC source and the point of
connection of the earthing electrode conductor.
French Translation: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre entre la
source d'alimentation c.c. et le point de raccordement du conducteur à électrode de mise à la terre.
• Install all firewalls that use DC power in restricted access areas only. A restricted access area is where
access is granted only to craft (service) personnel using a special tool, lock and key, or other means of
security, and that is controlled by the authority responsible for the location.
French Translation: Tous les pare-feux utilisant une alimentation c.c. sont conçus pour être installés
dans des zones à accès limité uniquement. Une zone à accès limité correspond à une zone dans laquelle
l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un outil spécial, cadenas ou clé, ou autre
dispositif de sécurité, et qui est contrôlée par l'autorité responsable du site.
• Install the firewall DC ground cable only as described in the power connection procedure for the firewall
that you are installing. You must use the American wire gauge (AWG) cable specified and torque all nuts
to the torque value specified in the installation procedure for your firewall.
French Translation: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans la procédure
de raccordement à l’alimentation pour le pare-feu que vous installez. Utilisez le câble American wire
gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la procédure d’installation de votre
pare-feu pare-feu.
• The firewall permits the connection of the earthed conductor of the DC supply circuit to the earthing
conductor at the equipment as described in the installation procedure for your firewall.
French Translation: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit
d’alimentation c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la procédure
d’installation du pare-feu.
• A suitably-rated DC mains disconnect device must be provided as part of the building installation.
French Translation: Un interrupteur d'isolement suffisant doit être fourni pendant l'installation du
bâtiment.

12 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | Before You Begin

13
PA-7000 Series Firewall Overview
The PA-7000 Series firewalls (PA-7050 and PA-7080) are high performance modular firewalls
designed for large enterprise and carrier class environments. These multi-blade chassis can
leverage either AC or DC power and have hot-swappable Network Processing Cards (NPCs)
to allow for expansion as needs grow. You can install up to six NPCs in the PA-7050 firewall
and up to ten NPCs in the PA-7080 firewall. These firewalls also include a dedicated high
availability (HA) control port (HA1), as well as two dedicated 80Gb QSFP HA ports for HA2
(data link) and HA3 (packet forwarding) functions. These dedicated HA ports enable PA-7000
Series firewalls to function with full hardware redundancy in either an active/passive or
active/active configuration. Additionally, to improve logging performance, the firewalls use a
dedicated log card to handle all log processing tasks.
First Supported PAN-OS® Software Release:
>PAN-OS 6.0—PA-7050 firewall
>PAN-OS 7.0—PA-7080 firewall
The minimum supported PAN-OS software also varies based on the installed components. For
example, if you install a PA-7000 20GQXM NPC, the firewall must have PAN-OS 7.1 or later
installed. In the PAN-OS 9.0 release, there are also requirements to install newer components
based on the installed hardware. For example, if you install the PA-7000-100G-NPC in a
PA-7050 firewall, you must also install the PA-7050 second-generation fan trays (PA-7050-
FANTRAY-L-A (left) and PA-7050-FANTRAY-R-A (right)). For more information on these
requirements, see PA-7000 Series Firewall Module and Interface Card Information.
> PA-7050 Front and Back Panel Descriptions
> PA-7080 Front and Back Panel Descriptions

14 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview
© 2019 Palo Alto Networks, Inc.

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview 15
© 2019 Palo Alto Networks, Inc.
PA-7050 Front and Back Panel Descriptions
•PA-7050 Front Panel (AC)
•PA-7050 Back Panel (AC)
•PA-7050 Front Panel (DC)
•PA-7050 Back Panel (DC)
PA-7050 Front Panel (AC)
The following image shows the front panel of the PA-7050 firewall (with AC power supplies installed) and
the table describes each front panel component.
Item Component Description
1 Exhaust and intake fan trays
(first-generation fan tray
shown)
Provides ventilation and cooling for the chassis. While facing
the front of the firewall, air enters from the left and exits to the
right.
There are two PA-7050 fan tray models:
•PA-7050-FAN—First-generation fan tray. These fan trays
are interchangeable, so you can install them in either fan
tray slot.

16 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview
© 2019 Palo Alto Networks, Inc.
Item Component Description
•PA-7050-FANTRAY-L-A (left) and PA-7050-FANTRAY-R-
A (right)—Second-generation fan tray that provides more
cooling capacity than the first-generation fan tray. While
facing the front of the firewall, install PA-7050-FANTRAY-
L-A on the left and the PA-7050-FANTRAY-R-A on the
right. The right fan tray also includes the air intake filter
that slides into the fan tray. This fan tray is required when
installing certain hardware components. For example, you
must install this fan tray if you install a PA-7000 100G NPC.
For more details, see the system and hardware requirements
in PA-7000 Series Firewall Module and Interface Card
Information.
During normal operation, the Power LED on the fan tray is
green and the Fault LED is off. If an individual fan fails on the
fan tray, the Power LED turns off and the Fault LED turns red.
For information on replacing a fan tray, see Replace a PA-7050
Fan Tray.
2 Switch Management Card
(SMC) (first-generation SMC
shown)
Provides management access to the chassis using a serial
console cable connected to the Console port or an RJ-45
cable connected to the management (MGT) port. The SMC
also has high availability (HA) ports and LED indicators that
provide information on various chassis components. The SMC
also stores PAN-OS, the configuration, and management logs
(Alarm, Configuration, and System).
IMPORTANT: The SMC is required to operate the chassis and
on a PA-7050 firewall, it must be installed in slot 4.
The SMC-B is shipped with four copper 1G
transceivers for use in the MGT-A, MGT-B,
HA1-A, and HA1-B ports. You can use these or
replace them with a transceiver of your choice.
There are two PA-7050 SMC models as described in PA-7000
Series Firewall Switch Management Cards (SMCs).
The PAN-OS®software is preinstalled on the
embedded solid-state drive (SSD) on the SMC.
3 Air filter Filters air entering the chassis. Periodically inspect the filter
to ensure it is clean. The filter is not designed to be cleaned
and it is recommended that you replace it every six months
(depending on the environment).
If the firewall has the second-generation fan trays installed
(PA-7050-FANTRAY-L-A on the left and the PA-7050-
FANTRAY-R-A), the air filter is inserted into the right fan tray
(PA-7050-FANTRAY-R-A).
4 Network Processing Card
(NPC)
Provides network connectivity.

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview 17
© 2019 Palo Alto Networks, Inc.
Item Component Description
On a PA-7050 firewall, you can install up to six NPCs (in slots 1,
2, 3, 5, 6, and/or 7). You must have at least one NPC installed
before the firewall can process network traffic.
For more information, see PA-7000 Series Firewall Network
Processing Cards (NPCs).
5 Log card
(LPC shown)
There are two log card models that you can install:
•LFC (PAN-OS 9.0 or later)—High-speed log forwarding card
that forwards all dataplane logs to an external log collection
system, such as Panorama or a syslog server. The only logs
that are stored locally are the Alarm ,Configuration, and
System logs; these logs are stored on the SMC.
•LPC—Manages and stores all dataplane logs generated
by the firewall. The LPC contains four disk drives that
are configured in two separate RAID 1 pairs to provide
redundancy. Each drive is installed in an Advanced
Mezzanine Card (AMC), which physically connects the drive
to the LPC. When replacing a drive, the AMC and drives are
ordered and installed as one unit.
IMPORTANT: You must have an LFC or LPC installed in slot 8
for chassis operation.
For more information, see PA-7000 Series Firewall Log Cards.
6 AC power supplies Provides power to the chassis using an AC power source.
For information on connecting power, see Connect Power to a
PA-7000 Series Firewall.
7 Electrostatic Discharge (ESD)
ports
Provides a grounding point that you use when removing or
installing chassis components. Secure the provided wrist strap
end of the ESD strap around your wrist and plug the other end
into one of the ESD ports.
PA-7050 Back Panel (AC)
The following image shows the back panel of the PA-7050 firewall (with AC power supplies installed) and
the table describes each back panel component.

18 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview
© 2019 Palo Alto Networks, Inc.
Item Component Description
1 Ground stud Two-post stud used to ground the chassis to earth ground.
Use the provided 6 AWG two#post ground lug to connect a
grounded cable (not included) to the two#post stud.
2 Power Entry Module (PEM)
AC power inlets
Connects the power source to the power supplies located on the
front of the chassis. The front power supplies distribute power
to all chassis components.
The AC PEM contains four 20-amp AC power inlets—each
accompanied by a switch—one pair, inlet with switch, for each
power supply.
If you are facing the back of the chassis, the inlet and switch on
the far left side provides power to the power supply on the far
right side when facing the front of the chassis.
For information on connecting power, see Connect Power to a
PA-7000 Series Firewall.
The AC PEMs are not field-serviceable.

PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview 19
© 2019 Palo Alto Networks, Inc.
Item Component Description
3 Power Entry Module (PEM)
AC power switches
Provides switches to power on or off the AC power supplies.
Each switch has a circuit breaker that will trip if the load reaches
25-amps.
PA-7050 Front Panel (DC)
The following image shows the front panel of the PA-7050 firewall (with DC power supplies installed).
The only difference between the front panel of the AC model and the front panel of the DC
model is that the DC model has four front DC power supplies instead of four AC power
supplies. For descriptions of the front panel components, see PA-7050 Front Panel (AC) and
for information on connecting DC power, see Connect Power to a PA-7000 Series Firewall.
PA-7050 Back Panel (DC)
The following image shows the back panel of the PA-7050 firewall (with DC power supplies installed). The
AC inlets and switches are not functional and must remain covered using the provided cover plate.

20 PA-7000 SERIES FIREWALL HARDWARE REFERENCE | PA-7000 Series Firewall Overview
© 2019 Palo Alto Networks, Inc.
The only differences between the back panel of the AC model and the back panel of the DC model is that
the DC model does not have a Power Entry Modules (PEM); the DC power source connects directly to the
front of the power supplies. For descriptions of the back panel components, see PA-7050 Back Panel (AC).