PaloAlto Networks PA-7500 Application guide

PA-7500 Next-Gen Firewall Hardware
Reference
docs.paloaltonetworks.com

Contact Information
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support
About the Documentation
• For the most recent version of this guide or for access to related documentation, visit the Technical
Documentation portal docs.paloaltonetworks.com.
• To search for a specific topic, go to our search page docs.paloaltonetworks.com/search.html.
• Have feedback or questions for us? Leave a comment on any page in the portal, or write to us at
[email protected].
Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2023-2023 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
Last Revised
May 2, 2023
PA-7500 Next-Gen Firewall Hardware Reference 2©2023 Palo Alto Networks, Inc.

Table of Contents
Before You Begin............................................................................................... 5
Upgrade/Downgrade Considerations for Firewalls and Appliances................................6
Tamper Proof Statement........................................................................................................... 7
Third-Party Component Support............................................................................................. 8
Product Safety Warnings...........................................................................................................9
PA-7500 Series Firewall Overview............................................................. 13
PA-7500 Series Firewall Front and Back Panel Descriptions.........................................14
PA-7500 Series Front Panel....................................................................................... 14
PA-7500 Series Back Panel.........................................................................................15
PA-7500 Series Module and Interface Card Descriptions.............................................. 18
PA-7500 Series Firewall Management Processing Card (MPC)......................... 18
PA-7500 Series Firewall Network Processing Card (NPC).................................. 20
PA-7500 Series Firewall Data Processing Card (DPC)......................................... 21
PA-7500 Series Firewall Switch Fabric Card (SFC)............................................... 22
PA-7500 Series Firewall Installation...........................................................25
Install the PA-7500 Series Firewall in an Equipment Rack............................................. 26
Install a PA-7500 Series Firewall Interface Card...............................................................34
Connect Power to the PA-7500 Series Firewall............................................................... 40
Determine Power Requirements of the PA-7500 Series Firewalls....................40
Connect AC Power to the PA-7500 Series Firewall............................................. 41
Connect DC Power to the PA-7500 Series Firewall.............................................43
View Power Statistics of the PA-7500 Series Firewalls.......................................46
Connect Cables to the PA-7500 Series Firewall............................................................... 48
PA-7500 Series Firewall LED Definitions..................................................49
Interpret the PA-7500 Series Firewall LEDs...................................................................... 50
Interpret the PA-7500 Series Firewall Interface Card LEDs...........................................51
PA-7500 Series Firewall MPC LEDs......................................................................... 51
PA-7500 Series Firewall NPC LEDs..........................................................................54
PA-7500 Series Firewall DPC LEDs..........................................................................55
PA-7500 Series Firewall SFC LEDs...........................................................................57
PA-7500 Series Firewall Maintenance....................................................... 59
Replace a PA-7500 Series Firewall AC or DC Power Supply.........................................60
Replace a PA-7500 Series Firewall Interface Card........................................................... 62
Replace a PA-7500 Series Firewall Fan Assembly............................................................67
Replace a PA-7500 Series Firewall System Drive.............................................................70
PA-7500 Next-Gen Firewall Hardware Reference 3©2023 Palo Alto Networks, Inc.

Table of Contents
Replace a PA-7500 Series Firewall Logging Drive............................................................73
PA-7500 Series Firewall Specifications......................................................75
PA-7500 Series Firewall Physical Specifications............................................................... 76
PA-7500 Series Firewall Electrical Specifications............................................................. 77
PA-7500 Series Firewall Component Electrical Specifications...........................77
PA-7500 Series Firewall Power Cord Types...........................................................77
PA-7500 Series Firewall Environmental Specifications................................................... 79
PA-7500 Series Firewall Compliance Statements................................... 81
Compliance Statements........................................................................................................... 82
PA-7500 Next-Gen Firewall Hardware Reference 4©2023 Palo Alto Networks, Inc.

Before You Begin
Read the following topics before you install or service a Palo Alto Networks® next-generation
firewall or appliance.The following topics apply to all Palo Alto Networks firewalls and appliances
except where noted.
•Upgrade/Downgrade Considerations for Firewalls and Appliances
•Tamper Proof Statement
•Third-Party Component Support
•Product Safety Warnings
5

Before You Begin
Upgrade/Downgrade Considerations for Firewalls and
Appliances
The following table lists all hardware features that have upgrade or downgrade impact. Make
sure you understand all upgrade/downgrade considerations before you upgrade or downgrade
from the specified version of PAN-OS.
Feature Release Upgrade Considerations Downgrade
Considerations
PA-7000 Log
Forwarding Card (LFC)
10.0 If you are using an LFC
with a PA-7000 Series
Firewall, when you
upgrade to PAN-OS
10.0, you must configure
the management plane
or dataplane interface
for the service route
because the LFC ports
do not support the
requirements for the
service route. We
recommend using the
dataplane interface for
the Data Services service
route.
n/a
Upgrading a PA-7000
Series Firewall with a
first generation switch
management card
(PA-7050-SMC or
PA-7080-SMC)
PAN-OS 8.0
and later
Before upgrading
the firewall, run the
following CLI command
to check the flash drive’s
status: debug system
disk-smart-info
disk-1.
If the value for
attribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with
the upgrade. If the value
is less than 20, then
contact support for
assistance.
Before downgrading
the firewall, run the
following CLI command
to check the flash drive’s
status: debug system
disk-smart-info
disk-1.
If the value for
attribute ID #232,
Available_Reservd_Space
0x0000, is greater than
20, then proceed with
the downgrade. If the
value is less than 20,
then contact support for
assistance.
PA-7500 Next-Gen Firewall Hardware Reference 6©2023 Palo Alto Networks, Inc.

Before You Begin
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks were not tampered with during
shipping, verify the following upon receipt of each product:
• The tracking number provided to you electronically when ordering the product matches the
tracking number that is physically labeled on the box or crate.
• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.
• The integrity of the warranty label on the firewall or appliance is not compromised.
(PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and
therefore do not include a warranty label on the firewall.
PA-7500 Next-Gen Firewall Hardware Reference 7©2023 Palo Alto Networks, Inc.

Before You Begin
Third-Party Component Support
Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party
Component Support statement.
PA-7500 Next-Gen Firewall Hardware Reference 8©2023 Palo Alto Networks, Inc.

Before You Begin
Product Safety Warnings
To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto
Networks hardware, be sure you understand and prepare for the following warnings before you
install or service the hardware. You will also see warning messages throughout the hardware
reference where potential hazards exist.
All Palo Alto Networks products with laser-based optical interfaces comply with 21 CFR
1040.10 and 1040.11.
The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a
specific hardware model is specified.
• When installing or servicing a Palo Alto Networks firewall or appliance hardware component
that has exposed circuits, ensure that you wear an electrostatic discharge (ESD) strap. Before
handling the component, make sure the metal contact on the wrist strap is touching your skin
and that the other end of the strap is connected to earth ground.
French Translation: Lorsque vous installez ou que vous intervenez sur un composant matériel
de pare-feu ou de dispositif Palo Alto Networks qui présente des circuits exposés, veillez
à porter un bracelet antistatique. Avant de manipuler le composant, vérifiez que le contact
métallique du bracelet antistatique est en contact avec votre peau et que l’autre extrémité du
bracelet est raccordée à la terre.
• Use grounded and shielded Ethernet cables (when applicable) to ensure agency compliance
with electromagnetic compliance (EMC) regulations.
French Translation: Des câbles Ethernet blindés reliés à la terre doivent être utilisés pour
garantir la conformité de l'organisme aux émissions électromagnétiques (CEM).
• (PA-3200, PA-5200, PA-5400, PA-7050, and PA-7080 firewalls only) At least two people are
recommended for unpacking, handling, and relocating the heavier firewalls.
• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For
details on the electrical range, refer to electrical specifications in the hardware reference for
your firewall or appliance.
French Translation: Veillez à ce que la tension d’alimentation ne dépasse pas la plage d’entrée
du pare-feu ou du dispositif. Pour plus d’informations sur la mesure électrique, consulter la
rubrique des caractéristiques électriques dans la documentation de votre matériel de pare-feu
ou votre dispositif.
• (Devices with serviceable batteries only) Do not replace a battery with an incorrect battery
type; doing so can cause the replacement battery to explode. Dispose of used batteries
according to local regulations.
French Translation: Ne remplacez pas la batterie par une batterie de type non adapté, cette
dernière risquerait d’exploser. Mettez au rebut les batteries usagées conformément aux
instructions.
• I/O ports are intended for intra-building connections only and not intended for OSP (Outside
Plant) connections or any network connections subject to external voltage surge events.
PA-7500 Next-Gen Firewall Hardware Reference 9©2023 Palo Alto Networks, Inc.

Before You Begin
•(All Palo Alto Networks appliances with two or more
power supplies)
Caution: Shock hazard
Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.
French Translation: (Tous les appareils Palo Alto
Networks avec au moins deux sources d’alimentation)
Débranchez tous les cordons d’alimentation (c.a. ou
c.c.) des entrées d’alimentation et mettez le matériel
hors tension.
•(PA-7000 Series firewalls only)
Caution: High touch current
Connect to earth before connecting to the power
supply.
Ensure that the protective earthing conductor is
connected to the provided ground lug on the rear side
of the firewall.
•(PA-7000 Series firewalls only) When removing a fan
tray from a PA-7000 Series firewall, first pull the fan
tray out about 1 inch (2.5cm) and then wait a minimum
of 10 seconds before extracting the entire fan tray.
This allows the fans to stop spinning and helps you
avoid serious injury when removing the fan tray. You
can replace a fan tray while the firewall is powered
on but you must replace it within 45 seconds and you
can only replace one fan tray at a time to prevent the
thermal protection circuit from shutting down the
firewall.
French Translation: (Pare-feu PA-7000 uniquement)
Lors du retrait d’un tiroir de ventilation d’un pare-
feu PA-7000, retirez tout d’abord le tiroir sur 2,5 cm,
puis patientez au moins 10 secondes avant de retirer
complètement le tiroir de ventilation. Cela permet aux
ventilateurs d’arrêter de tourner et permet d’éviter des
blessures graves lors du retrait du tiroir. Vous pouvez
remplacer un tiroir de ventilation lors de la mise sous
tension du pare-feu. Toutefois, vous devez le faire dans
les 45 secondes et vous ne pouvez remplacer qu’un
tiroir à la fois, sinon le circuit de protection thermique
arrêtera le pare-feu.
PA-7500 Next-Gen Firewall Hardware Reference 10 ©2023 Palo Alto Networks, Inc.

Before You Begin
The following applies only to Palo Alto Networks firewalls that support a direct current (DC)
power source:
French Translation: Les instructions suivantes s’appliquent uniquement aux pare-feux de Palo
Alto Networks prenant en charge une source d’alimentation en courant continu (c.c.):
• Do not connect or disconnect energized DC wires to the power supply.
French Translation: Ne raccordez ni débranchez de câbles c.c. sous tension à la source
d’alimentation.
• The DC system must be earthed at a single (central) location.
French Translation: Le système c.c. doit être mis à la terre à un seul emplacement (central).
• The DC supply source must be located within the same premises as the firewall.
French Translation: La source d’alimentation c.c. doit se trouver dans les mêmes locaux que ce
pare-feu.
• The DC battery return wiring on the firewall must be connected as an isolated DC (DC-I)
return.
French Translation: Le câblage de retour de batterie c.c. sur le pare-feu doit être raccordé en
tant que retour c.c. isolé (CC-I).
• The firewall must be connected either directly to the DC supply system earthing electrode
conductor or to a bonding jumper from an earthing terminal bar or bus to which the DC supply
system earthing electrode conductor is connected.
French Translation: Ce pare-feu doit être branché directement sur le conducteur à électrode
de mise à la terre du système d’alimentation c.c. ou sur le connecteur d'une barrette/d'un bus
à bornes de mise à la terre auquel le conducteur à électrode de mise à la terre du système
d'alimentation c.c. est raccordé.
• The firewall must be in the same immediate area (such as adjacent cabinets) as any other
equipment that has a connection between the earthing conductor of the DC supply circuit and
the earthing of the DC system.
French Translation: Le pare-feu doit se trouver dans la même zone immédiate (des armoires
adjacentes par exemple) que tout autre équipement doté d’un raccordement entre le
conducteur de mise à la terre du même circuit d’alimentation c.c. et la mise à la terre du
système c.c.
• Do not disconnect the firewall in the earthed circuit conductor between the DC source and the
point of connection of the earthing electrode conductor.
French Translation: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre
entre la source d'alimentation c.c. et le point de raccordement du conducteur à électrode de
mise à la terre.
• Install all firewalls that use DC power in restricted access areas only. A restricted access area
is where access is granted only to craft (service) personnel using a special tool, lock and key, or
other means of security, and that is controlled by the authority responsible for the location.
French Translation: Tous les pare-feux utilisant une alimentation c.c. sont conçus pour être
installés dans des zones à accès limité uniquement. Une zone à accès limité correspond à une
zone dans laquelle l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un outil spécial,
PA-7500 Next-Gen Firewall Hardware Reference 11 ©2023 Palo Alto Networks, Inc.

Before You Begin
cadenas ou clé, ou autre dispositif de sécurité, et qui est contrôlée par l'autorité responsable du
site.
• Install the firewall DC ground cable only as described in the power connection procedure
for the firewall that you are installing. You must use the American wire gauge (AWG) cable
specified and torque all nuts to the torque value specified in the installation procedure for your
firewall.
French Translation: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans
la procédure de raccordement à l’alimentation pour le pare-feu que vous installez. Utilisez
le câble American wire gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la
procédure d’installation de votre pare-feu pare-feu.
• The firewall permits the connection of the earthed conductor of the DC supply circuit to
the earthing conductor at the equipment as described in the installation procedure for your
firewall.
French Translation: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit
d’alimentation c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la
procédure d’installation du pare-feu.
• A suitably-rated DC mains disconnect device must be provided as part of the building
installation.
French Translation: Un interrupteur d'isolement suffisant doit être fourni pendant l'installation
du bâtiment.
PA-7500 Next-Gen Firewall Hardware Reference 12 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
The PA-7500 Series firewalls are high-performance modular firewalls designed for large
enterprise environments. These multi-blade chassis can leverage either AC or DC power and
use hot-swappable slot cards to allow for expansion as needs grow. There are a total of nine
horizontally-oriented slots on the front of the chassis where you can install one Management
Processing Card (MPC), up to eight Network Processing Cards (NPCs), and up to eight Data
Processing Cards (DPCs). The back of the chassis has two vertically-oriented slots that can
accommodate up to two Switch Fabric Cards (SFCs).
First Supported PAN-OS® Software Release:
•PAN-OS 11.1—PA-7500 Firewall
•PA-7500 Series Firewall Front and Back Panel Descriptions
•PA-7500 Series Front Panel
•PA-7500 Series Back Panel
•PA-7500 Series Module and Interface Card Descriptions
•PA-7500 Series Firewall Management Processing Card (MPC)
•PA-7500 Series Firewall Data Processing Card (DPC)
•PA-7500 Series Firewall Network Processing Card (NPC)
•PA-7500 Series Firewall Switch Fabric Card (SFC)
13

PA-7500 Series Firewall Overview
PA-7500 Series Firewall Front and Back Panel
Descriptions
•PA-7500 Series Front Panel
•PA-7500 Series Back Panel
PA-7500 Series Front Panel
The following image shows the front panel of the PA-7500 Series firewall and the table describes
each front panel component.
Item Component Description
1 Front slot cards Nine slots that house line cards to provide connectivity,
performance, and management functionality to the
firewall.
PA-7500 Next-Gen Firewall Hardware Reference 14 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
Item Component Description
From top to bottom, the chassis supports the following
card(s) in each slot:
• 1—NPC and DPC
• 2—NPC and DPC
• 3—NPC and DPC
• 4—NPC and DPC
• 5—MPC (required)
• 6—NPC and DPC
• 7—NPC and DPC
• 8—NPC and DPC
• 9—NPC and DPC
View the PA-7500 Series Module and Interface Card
Descriptions for more information on the slot cards and
their components.
2 Power supplies Ten power supply slots that provide AC or DC power
to the appliance. A minimum of four power supplies is
required, while additional power supplies can be used to
provide redundancy.
On the front panel of the chassis, the power supplies are
numbered as follows:
For more information on connecting power to the
firewall, see Connect Power to the PA-7500 Series
Firewall.
PA-7500 Series Back Panel
The following image shows the back panel of the PA-7500 Series firewall and the table describes
each back panel component.
PA-7500 Next-Gen Firewall Hardware Reference 15 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
Item Component Description
1 Back slot cards Two slots that house Switch Fabric Cards (SFCs). One SFC
must be installed while a second SFC can be installed for
redundancy.
View the PA-7500 Series Module and Interface Card
Descriptions for more information on the slot cards and
their components.
2 Fan assemblies Up to fifteen fan assemblies that provide the appliance
with cooling and ventilation. The dual-rotor fan
assemblies can be individually replaced.
3 Ground stud Two-post stud used to ground the appliance to earth
ground. Use the provided ground lug to connect a
grounded cable to the two-post stud.
PA-7500 Next-Gen Firewall Hardware Reference 16 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
Item Component Description
4 Power supplies Ten power supply slots that provide AC or DC power
to the appliance. A minimum of four power supplies is
required, while additional power supplies can be used to
provide redundancy.
On the back panel of the chassis, the power supplies are
numbered as follows:
For more information on connecting power to the
firewall, see Connect Power to the PA-7500 Series
Firewall.
PA-7500 Next-Gen Firewall Hardware Reference 17 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
PA-7500 Series Module and Interface Card Descriptions
The following topics list the components and features of each PA-7500 Series firewall interface
card.
•PA-7500 Series Firewall Management Processing Card (MPC)
•PA-7500 Series Firewall Network Processing Card (NPC)
•PA-7500 Series Firewall Data Processing Card (DPC)
•PA-7500 Series Firewall Switch Fabric Card (SFC)
PA-7500 Series Firewall Management Processing Card (MPC)
The Management Processing Card (MPC) provides the firewall with a management interface, first
packet processing, logging interfaces, and inter-chassis HSCI ports. The MPC must be installed in
slot 4 of the chassis.
The following image shows the PA-7500 MPC and the table below describes each labeled
component.
Item Component Description
1 LED Indicators Eight LEDs that indicate the status of various hardware
components. For details on the LEDs, see Interpret the
PA-7500 Series Firewall Interface Card LEDs
2USB Port One USB port that accepts a USB flash drive that contains
a bootstrap bundle (PAN-OS configuration) that enables
you to bootstrap the firewall. Bootstrapping enables you
to provision the firewall with a specific configuration,
license it, and make it operational on the network.
3 RJ-45 Console Port Use the RJ-45 console port to connect a management
computer to the firewall using a 9-pin serial-to-RJ-45
cable and terminal emulation software.
The console connection provides access to firewall boot
messages, the Maintenance Recovery Tool (MRT), and the
command line interface (CLI).
PA-7500 Next-Gen Firewall Hardware Reference 18 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
Item Component Description
4 Micro USB Console Port Use the Micro USB console port to connect a
management computer to the firewall using a standard
Type-A USB-to-micro USB cable and terminal emulation
software.
The console connection provides access to firewall boot
messages, the Maintenance Recovery Tool (MRT), and the
command line interface (CLI).
5 Management Ports Two SFP/SFP+/SFP28 management ports providing
1Gbps/10Gbps/25Gbps connectivity that are used to
access the management interface. MGT-1 and MGT-2
are bundled by default as a single logical interface called
bond0. The two bonded ports provide redundancy, which
enables the management interface to remain active if one
interface goes down.
To manage the firewall, change your management
computer IP address to 192.168.1.2, connect an SFP+
cable from your computer to one of the MGT ports and
browse to https:// 192.168.1.1. The default login name is
admin and the default password is admin.
6 HSCI-1 and HSCI-2
(High Speed Chassis
Interconnect) Ports
Quad-SFP+ (QSFP+/QSFP28) interfaces used to connect
two PA-5400 Series firewalls for a high availability (HA)
configuration. Each port offers 80Gbps (two 40Gbps
links) or 200Gbps (two 100Gbps links) connectivity and is
used for HA2 data link in an active/passive configuration.
When in active/active mode, the port is also used for
HA3 packet forwarding for asymmetrically routed
sessions that require Layer 7 inspection for App-ID™ and
Content#ID™.
In a typical installation, HSCI-1 on the first firewall
connects directly to HSCI-1 on the second firewall and
HSCI-2 on the first firewall connects to HSCI-2 on the
second firewall. The purpose of HSCI-2 is to increase
the bandwidth for HA2/HA3 processing. This provides
full 80-200Gbps transfer rates. In software, both ports
(HSCI-1 and HSCI-2) are treated as one HA interface.
The HSCI ports are not routable and must be connected
directly to each other, not through a switch. Palo Alto
Networks recommends using an active or passive QSFP+
cable to connect the two HSCI ports.
You can configure HA2 (data link) on the HSCI ports or
on NPC data ports. When configuring on dataplane ports,
you must ensure that both the HA2 and HA2-Backup
PA-7500 Next-Gen Firewall Hardware Reference 19 ©2023 Palo Alto Networks, Inc.

PA-7500 Series Firewall Overview
Item Component Description
links are configured on dataplane interfaces. HA2-Backup
cannot be configured on the HSCI ports.
For installations where the two firewalls are
not near each other and you cannot use an
active or passive QSFP+ cable, use a standard
QSFP+ transceiver and the appropriate cable
length.
7 Logging Ports Two SFP/SFP+ logging ports that offer 1Gbps/10Gbps
connectivity and are used as log interfaces. LOG-1 and
LOG-2 are bundled by default as a single logical interface
called bond1. Bond1 supports LACP (link aggregation
control protocol) as IEEE 802.3ad. Set the Mode for LACP
status queries to Active and the Transmission Rate for
LACP query and response exchanges to Slow.
You must Configure Log Forwarding to forward logs from
the log interface to one or more log collectors. If the log
interface is not configured, the management interface is
used to forward logs instead.
8 Logging Drive Covers Secure the two logging drives in the MPC. By default,
the MPC does not have a logging drive installed. For
information about installing a logging drive, see Replace a
PA-7500 Series Firewall Logging Drive.
9 Ejector Tabs Push tabs that are used to insert or replace the interface
card.
PA-7500 Series Firewall Network Processing Card (NPC)
The Network Processing Card (NPC) provides the firewall with network connectivity. An NPC can
be installed in slots 1, 2, 3, 4, 6, 7, 8, and 9.
The following image shows the PA-7500 NPC and the table below describes each labeled
component.
PA-7500 Next-Gen Firewall Hardware Reference 20 ©2023 Palo Alto Networks, Inc.