PaloAlto Networks PA-7000 Series Operating and maintenance manual

Palo Alto Networks
PA-7000 Series Hardware Reference Guide

2• PA-7000 Series Hardware Reference Guide Palo Alto Networks
Contact Information
Corporate Headquarters:
Palo Alto Networks
4401 Great America Parkway
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-us
About this Guide
This guide describes the PA-7050 and PA-7080 firewall hardware, provides instructions on installing the hardware,
describes how to perform maintenance procedures, and provides product specifications. This guide is intended for
system administrators responsible for installing and maintaining a PA-7000 Series firewall.
All PA-7000 Series firewalls run PAN-OS®, a purpose-built operating system with extensive security and networking
functionality. For additional information, refer to the following resources:
For information on the additional capabilities and for instructions on configuring the features on the firewall, refer
to https://www.paloaltonetworks.com/documentation.
For access to the knowledge base, discussion forums, and videos, refer to
https://live.paloaltonetworks.com.
To contact support for information on support programs, or to manage your account and devices, refer to
https://support.paloaltonetworks.com.
For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates.
For capacity and performance information for all Palo Alto Networks firewalls, refer to
https://www.paloaltonetworks.com/products/product-selection.html.
To view the product specsheet, refer to
https://www.paloaltonetworks.com/resources/datasheets.html.
To provide feedback on the documentation, please write to us at: [e-mail].
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2007–2016 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be
found at http://www.paloaltonetworks.com/company/trademarks.html . All other marks mentioned herein may be trademarks of their
respective companies.
Revision Date: September 1, 2016

Palo Alto Networks Table of Contents • 3
Chapter 1
PA-7000 Series Firewall Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
PA-7050 Front and Back Panel Descriptions . . . . . . . . . . . . . . . . . . . . . . . . 5
PA-7050 Front Panel (AC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
PA-7050 Back Panel (AC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
PA-7050 Front Panel (DC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
PA-7050 Back Panel (DC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
PA-7080 Front and Back Panel Descriptions . . . . . . . . . . . . . . . . . . . . . . . . 12
PA-7080 Front Panel (AC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
PA-7080 Back Panel (AC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
PA-7080 Front Panel (DC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
PA-7080 Back Panel (DC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Chapter 2
PA-7000 Series Module and Interface Card Information . . . . . . . . . . . . 23
Switch Management Card (SMC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Interpreting the SMC LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Log Processing Card (LPC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
LPC and AMC Component Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Interpreting the AMC LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Network Processing Cards (NPCs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
PA-7000 20G NPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
PA-7000 20GXM NPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
PA-7000 20GQ NPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
PA-7000 20GQXM NPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Identify NPC Port Activity and Link LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Chapter 3
Install the PA-7000 Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Tamper Proof Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Rack Install Safety Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Rack Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Rack Mount a PA-7050 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Rack Mount a PA-7080 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Install the Mandatory Front Slot Cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Install the Switch Management Card (SMC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Install the Log Processing Card (LPC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Install a Network Processing Card (NPC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Connect Power to a PA-7000 Series Firewall . . . . . . . . . . . . . . . . . . . . . . . 68
Power Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Determine Power Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Connect AC Power to a PA-7050 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Connect DC Power to a PA-7050 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Connect AC Power to a PA-7080 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Connect DC Power to a PA-7080 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
View Firewall Power Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Table of Contents

4• Table of Contents Palo Alto Networks
Connect Cables to a PA-7000 Series Firewall . . . . . . . . . . . . . . . . . . . . . . . 82
Verify the PA-7000 Series LPC and NPC Configuration . . . . . . . . . . . . . . . 85
Verify the LPC Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Verify the NPC Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Chapter 4
Service the PA-7000 Series Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Cautions and Warnings Related to Working with the Hardware . . . . . . . . 89
Hardware Cautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Hardware Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Replace a PA-7000 Series AC or DC Power Supply . . . . . . . . . . . . . . . . . . 93
Interpret the PA-7000 Series Firewall Power Supply LEDs . . . . . . . . . . . . . . . . . . 93
Replace a PA-7000 Series AC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Replace a PA-7000 Series DC Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Replace a PA-7080 DC PEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Replace a PA-7000 Series LPC Drive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Increase Log Capacity on a PA-7000 Series Firewall . . . . . . . . . . . . . . . . 109
Replace a PA-7000 Series Fan Tray . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Replace a PA-7050 Fan Tray . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Replace a PA-7080 Fan Tray . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Replace a PA-7000 Series Air Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Replace a PA-7000 Series Front Slot Card . . . . . . . . . . . . . . . . . . . . . . . . 124
Replace a PA-7000 Series Switch Management Card (SMC) . . . . . . . . . . . . . . 124
Replace a PA-7000 Series Log Processing Card (LPC) . . . . . . . . . . . . . . . . . . . . 127
Replace a PA-7000 Series Network Processing Card (NPC) . . . . . . . . . . . . . . . 133
Chapter 5
Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Physical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Component Electrical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Power Cord Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Chapter 6
Compliance Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
NEBS Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
VCCI Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
BSMI EMC Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Palo Alto Networks PA-7000 Series Firewall Overview • 5
PA-7050 Front and Back Panel Descriptions
Chapter 1
PA-7000 Series Firewall Overview
The PA-7000 Series firewalls (PA-7050 and PA-7080) are high performance modular firewalls designed for large
enterprise and carrier class environments. These multi-blade chassis can leverage either AC or DC power and have
hot-swappable Network Processing Cards (NPCs) to allow for expansion as needs grow. You can install up to six
NPCs in the PA-7050 firewall and up to ten NPCs in the PA-7080 firewall. These firewalls also include a dedicated
high availability (HA) control port (HA1), as well as two dedicated 80Gb QSFP HA ports for HA2 (data link) and
HA3 (packet forwarding) functions. These dedicated HA ports enable PA-7000 Series firewalls to function with full
hardware redundancy in either an active/passive or active/active configuration. Additionally, to improve logging
performance, the firewalls use a dedicated log card to handle all log processing tasks.
•“PA-7050 Front and Back Panel Descriptions” on page 5
•“PA-7080 Front and Back Panel Descriptions” on page 12
PA-7050 Front and Back Panel Descriptions
•“PA-7050 Front Panel (AC)” on page 6
•“PA-7050 Back Panel (AC)” on page 8
•“PA-7050 Front Panel (DC)” on page 10
•“PA-7050 Back Panel (DC)” on page 11
Note: The minimum software version that you can install on a PA-7050 firewall is PAN-OS 6.0 and
the minimum software version for the PA-7080 firewall is PAN-OS 7.0.

PA-7050 Front and Back Panel Descriptions
6• PA-7000 Series Firewall Overview Palo Alto Networks
PA-7050 Front Panel (AC)
Figure 1 shows the front panel of the PA-7050 firewall with AC power supplies installed and Table 1 describes the
front panel features.
Figure 1. PA-7050 Front Panel (AC)
1
2
3
5
6
7
8
1
2
3
5
6
7
8
ACTIVITY
FAULT
PA-7000-20G-NPC
PA-7000-BLANK
PA-7000-BLANK
PA-7000-BLANK
PA-7050-SMC
PA-7000-BLANK
PA-7000-BLANK
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
1 3 5 7 9 11
2 4 6 8 10 12 14 16 18 20 22 24
13 15 17 19 21 23
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PWR
STS
ALM
TMP
PWR
STS
HA
TMP
HA1-A HA1-B MGT
CONSOLE HSCI-A HSCI-B
USB
ALM
FAN
PS
LOG
POWER
PA-7050-FAN
FAULT
POWER
PA-7050-FAN
FAULT
PA-7000-AMC-1TB
POWER
PA-7050
4
SMC
4
SMC
1
2
3
5
6
7
4
8

Palo Alto Networks PA-7000 Series Firewall Overview • 7
PA-7050 Front and Back Panel Descriptions
Table 1. PA-7050 Front Panel Features (AC)
Item Description
1. Exhaust fan tray Provides ventilation and cooling for the chassis. The fan tray is
interchangeable, so you can install it in either fan tray slot.
During normal operation, the Power LED is green and the Fault LED is
off. If an individual fan fails on the fan tray, the Power LED turns off and
the red Fault LED illuminates.
For information on replacing a fan tray, see “Replace a PA-7050 Fan Tray”
on page 116.
2. Air intake fan tray Provides ventilation and cooling for the chassis. The fan tray is
interchangeable, so you can install it in either fan tray slot.
During normal operation, the Power LED is green and the Fault LED is
off. If an individual fan fails on the fan tray, the Power LED turns off and
the red Fault LED illuminates.
For information on replacing a fan tray, see “Replace a PA-7050 Fan Tray”
on page 116.
3. Switch Management
Card (SMC)
Provides management access to the chassis using a serial console cable
connected to the Console port or an RJ-45 cable connected to the
management (MGT) port. The SMC also contains high availability (HA)
ports and the LED indicators provide information on various chassis
components.
IMPORTANT: The SMC is required to operate the chassis and on a
PA-7050 firewall, it must be installed in slot 4.
For more information, see “Switch Management Card (SMC)” on page 24.
The PAN-OS® software is preinstalled on the embedded solid-
state drive (SSD) on the SMC; the SSD is not serviceable.
4. Air filter Filters air entering the chassis. Periodically inspect the filter to ensure it is
clean. The filter is not designed to be cleaned and it is recommended that
you replace it every six months.
5. Network Processing
Card (NPC)
Provides network connectivity.
IMPORTANT: On a PA-7050 firewall, you can install up to six NPCs (in
slots 1, 2, 3, 5, 6, and/or 7). You must have at least one NPC installed
before the firewall can process network traffic.
For more information, see “Network Processing Cards (NPCs)” on
page 32.
6. Log Processing Card
(LPC)
Manages and stores all logs generated by the firewall. The LPC contains
four disk drives that are configured in two separate RAID 1 pairs to
provide redundancy. Each drive is installed in an Advanced Mezzanine
Card (AMC), which physically connects the drive to the LPC. When
replacing a drive, the AMC and drives are ordered and installed as one
unit.
IMPORTANT: The LPC is required and must be installed in slot 8 for
chassis operation.
For more information, see “Log Processing Card (LPC)” on page 30.

PA-7050 Front and Back Panel Descriptions
8• PA-7000 Series Firewall Overview Palo Alto Networks
PA-7050 Back Panel (AC)
Figure 2 shows the back panel of the PA-7050 firewall and Table 2 describes the back panel features.
Figure 2. PA-7050 Back Panel (AC)
7. AC power supplies Provides power to the chassis using an AC power source.
For information on connecting power, see “Connect Power to a PA-7000
Series Firewall” on page 68.
8. Electrostatic Discharge
(ESD) ports
Provides a grounding point that you use when removing or installing
chassis components. Secure the provided wrist strap end of the ESD strap
around your wrist and plug the other end into one of the ESD ports.
Table 1. PA-7050 Front Panel Features (AC) (Continued)
Item Description
1
2
3

Palo Alto Networks PA-7000 Series Firewall Overview • 9
PA-7050 Front and Back Panel Descriptions
Table 2. PA-7050 Back Panel Features (AC)
Item Description
1. Ground stud Two-post stud used to ground the chassis to earth ground. Use the provided
6 AWG two-post ground lug to connect a grounded cable (not included) to
the two-post stud.
2. Power Entry Module
(PEM) AC power inlets
Connects the power source to the power supplies located on the front of the
chassis. The front power supplies then distributes power to all chassis
components.
The AC PEM contains four 20-amp AC power inlets—each accompanied
by a switch—one pair, inlet with switch, for each power supply.
If you are facing the back of the chassis, the inlet and switch on the far left
side provides power to the power supply on the far right side when facing
the front of the chassis.
For information on connecting power, see “Connect Power to a PA-7000
Series Firewall” on page 68.
The AC PEMs are not field-serviceable.
3. Power Entry Module
(PEM) AC power
switches
Provides switches to power on or off the AC power supplies. Each switch
has a circuit breaker that will trip if the load reaches 25-amps.

PA-7050 Front and Back Panel Descriptions
10 • PA-7000 Series Firewall Overview Palo Alto Networks
PA-7050 Front Panel (DC)
Figure 3 shows the front panel of the PA-7050 firewall with DC power supplies.
Figure 3. PA-7050 Front Panel (DC)
Note: The only difference between the front panel of the AC platform and the front panel of the DC
platform is that the DC platform has four front DC power supplies instead of four AC power supplies.
For descriptions of the front panel components, see “PA-7050 Front Panel (AC)” on page 6 and for
information on connecting DC power, see “Connect Power to a PA-7000 Series Firewall” on page 68.
1
2
3
5
6
7
8
1
2
3
5
6
7
8
ACTIVITY
FAULT
PA-7000-20G-NPC
PA-7000-BLANK
PA-7000-BLANK
PA-7000-BLANK
PA-7050-SMC
PA-7000-BLANK
PA-7000-BLANK
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
1 3 5 7 9 11
2 4 6 8 10 12 14 16 18 20 22 24
13 15 17 19 21 23
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PA-7000-AMC-1TB
POWER ACTIVITY
FAULT
PWR
STS
ALM
TMP
PWR
STS
HA
TMP
HA1-A HA1-B MGT
CONSOLE HSCI-A HSCI-B
USB
ALM
FAN
PS
LOG
POWER
PA-7050-FAN
FAULT
POWER
PA-7050-FAN
FAULT
PA-7000-AMC-1TB
POWER
PA-7050
4
SMC
4
SMC
Four DC Power Supplies