PaloAlto Networks M-500 User manual

M-500 Appliance
Hardware Reference Guide

Contact Information
http://www.paloaltonetworks.com/contact/contact/
About this Guide
The Palo Alto Networks M-500 appliance is a multi-function appliance that you can configure to
function as a Panorama Manager, Panorama Log Collector, or PAN-DB Private Cloud used for URL
filtering. This guide provides instructions on installing the hardware and performing maintenance
procedures, and provides product specifications. This guide is intended for system administrators
responsible for installing and maintaining the M-500 appliance.
For information on using Panorama, refer to the Palo Alto Networks Panorama Administrator’s
Guide 7.0 or later. For information on using PAN-DB, refer to the Palo Alto Networks PAN-OS
Administrator’s Guide 7.0 or later.
For additional information, refer to the following resources:
•For information on the additional capabilities and for instructions on configuring the features on
the firewall, refer to https://www.paloaltonetworks.com/documentation.
•For access to the knowledge base, complete documentation set, discussion forums, and videos,
refer to https://live.paloaltonetworks.com.
•For contacting support, for information on the support programs, or to manage your account or
devices, refer to https://support.paloaltonetworks.com.
•For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates.
To provide feedback on the documentation, please write to us at:
[e-mail].
Palo Alto Networks, Inc.
www.paloaltonetworks.com 
© 2007–2015 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of
our trademarks can be found at http://www.paloaltonetworks.com/company/trademarks.html . All other marks
mentioned herein may be trademarks of their respective companies.
Revision Date: February 29, 2016

Palo Alto Networks Table of Contents • 3
February 29, 2016 - Palo Alto Networks COMPANY CONFIDENTIAL
Chapter 1 
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Front Panel Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Back Panel Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 2 
Installing the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Tamper Proof Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Equipment Rack Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Rack Mount Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Connecting Cables to the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Connecting Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Chapter 3 
Maintaining the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Cautions and Warnings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Interpreting the Port LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Replace a Disk Drive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Power Supply Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Chapter 4 
Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Physical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Interface Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table of Contents

4• Table of Contents Palo Alto Networks
Chapter 5 
Compliance Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Appendix A 
General Safety Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Other Regulatory Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Palo Alto Networks Overview • 5
Chapter 1 
Overview
The Palo Alto Networks M-500 appliance is a multi-function appliance that you can configure
for one of the following three modes:
•Panorama mode—Performs both central management and log collection for Palo Alto
Networks firewalls. This is the default mode.
•Log Collector mode—Functions as a dedicated Log Collector, which either an M-100 or
M-500 appliance in Panorama mode or a Panorama virtual appliance can manage.
•PAN-DB Private Cloud mode—Functions as a private URL filtering solution that Palo
Alto Networks firewalls can use to perform URL filtering lookups. This solution is ideal
for organizations that restrict their firewalls from having direct access to the Internet.
Use the following topics to learn about the front and back panel components.
•“Front Panel Description” on page 6
•“Back Panel Description” on page 8
Note: The minimum Panorama version that you can install on a M-500 appliance
is 7.0.

Front Panel Description
6• Overview Palo Alto Networks
Front Panel Description
Figure 1 shows the front panel of the M-500 appliance and Table 1 describes the front panel
features.
Figure 1. Front Panel
1
5
6
7
8
3
4
2
Table 1. Front Panel Features
Item Description
1. Disk drives/bays The M-500 appliance has 24 disk drive bays. Starting from left to
right, the bays are labeled A1 to L2. Each pair of drives are in a
RAID1 configuration. For example, A1-A2 is a RAID1 pair, B1-B2 is
a RAID1 pair, and so on.
By default, the M-500 appliance ships with 8 1TB drives in RAID1
pairs installed in drive bays A1-D2 to provide 4TB of storage. You
can install additional RAID1 pairs from E1-H2 to add up to 8 more
drives (4 pairs) for a total of 8TB of storage.
Drive bays I1 to L2 are reserved for future use.
2. Drive LEDs •LeftLED—Illuminates red when a drive failure occurs.
• Right LED—Flashes blue when there is drive activity. A connec-
tion to the SATA backplane enables the LED to flash on and off
when the particular drive is being accessed.
3. Power button Main power button used to power the device on or to power it off.
Turning off system power with this button keeps the standby
power on. To completely power off the device, you must remove
the power source (AC plugs).
4. Reset button Reboots the system when pressed. A small object, such as a paper
clip, is required to access the button.
5. Power LED The LED is solid green when the appliance is powered on.
6. Power failure LED The LED flashes red when a power supply failure occurs or if a power
cord is removed.

Palo Alto Networks Overview • 7
Front Panel Description
7. HDD LED Indicates IDE channel activity (SAS/SATA drive).
8. Overheat/fan failure
LED
Modes:
• Continuously on red—An overheat condition occurred, possibly
due to cables blocking the air vents.
• Blinking red (1Hz)—Fan failure has occurred.
• Blinking red (.25Hz)—Power failure due to power supply failure
or the power cord is not connected to one of the power supplies.
• Solid blue—The Unique Identification (UID) function is on. This is
used to identify the appliance in a rack. For more information, see
the back panel description.
Table 1. Front Panel Features (Continued)
Item Description

Back Panel Description
8• Overview Palo Alto Networks
Back Panel Description
Figure 2 shows the back panel of the M-500 appliance and Table 2 describes the back panel
features.
Figure 2. Back Panel
1234567
Table 2. Back Panel Features
Item Description
1. Power supplies Two 1200W redundant hot-swappable power supplies.
2. Console DB-9 serial port for console access.
3. USB Four USB ports (reserved for future use).
4. MGT

1, 2, 3
RJ-45 10/100/1000 management port used for managing the device
and for data traffic.

RJ-45 10/100/1000 Ethernet Ports 1, 2, and 3. You can configure
ports 1 and 2 to distribute the Panorama or PAN-DB traffic load.
For information on configuring these ports for Panorama, refer to
the Panorama Administrator’s Guide 7.0 or later and for information
on configuring these ports for PAN-DB, refer to the PAN-OS
Administrator’s Guide 7.0 or later located on the Technical
Documentation Portal.
Port 3 is reserved for future use.
5. Graphics port VGA port (reserved for future use and covered).
6. UID The Unique Identification (UID) feature is a combination LED/
button that is used to assist a technician in locating a device when
moving from the back of a rack to the front of a rack. When you
push the button, the rear UID LED and the front panel LEDs will
illuminate bright blue, assisting the technician in identifying the
device in a rack. Push the button again to stop the LED from
flashing.
Note that the UID button is very small and is located slightly to the
left of the UID port hole. Use a small object, such as a paper clip, to
press the button.
7. SFP ports Two 10 Gigabit Ethernet Small Form-Factor Pluggable (SFP) ports.
Reserved for future use.

Palo Alto Networks Installing the Hardware • 9
Tamper Proof Statement
Chapter 2 
Installing the Hardware
This chapter describes how to install the M-500 appliance. See the following topics:
•“Tamper Proof Statement” on page 9
•“Before You Begin” in the next section
•“Equipment Rack Installation” on page 10
•“Connecting Cables to the Device” on page 17
•“Connecting Power” on page 17
Tamper Proof Statement
To ensure that products purchased from Palo Alto Networks have not been tampered with
during shipping, verify the following upon receipt of each product:
•The tracking number provided to you electronically when ordering the product matches
the tracking number that is physically labeled on the box or crate.
•The integrity of the tamper-proof tape used to seal the box or crate has not been
compromised.
•The warranty seals on the device itself do not show evidence of tampering.
Before You Begin
•It is recommended that two people rack mount the M-500 appliance.
•Have a Phillips-head screwdriver available and a small pliers or nut wrench.
•Verify that the intended location where you will install the appliance has adequate air
circulation and meets the temperature requirements. See “Environmental Specifications”
on page 24.
•Verify that power is not connected to the M-500 appliance.
•Allow clear space on all sides of the M-500 appliance.

Equipment Rack Installation
10 • Installing the Hardware Palo Alto Networks
Equipment Rack Installation
The M-500 appliance ships with a four-post rack kit with two sets of rail assemblies (one for
each side) and the mounting screws needed for installing the system into a four-post 19”rack.
This rail kit will fit a rack between 26.5” and 36.4” deep.
The following safety guidelines apply to rack installation:
•Elevated ambient operating temperature—If the M-500 appliance is installed in a closed
or multi-unit rack assembly, the ambient operating temperature of the rack environment
may be greater than the ambient room temperature. Verify that the ambient temperature
of the rack assembly meets the maximum rated ambient temperature requirements listed
in “Environmental Specifications” on page 24.
•Reduced airflow—Ensure that the airflow required for safe device operation is not
compromised by the rack installation and that you allow at least 30” of clearance in the
back of the rack to allow for sufficient airflow and ease in servicing.
•Mechanical loading—Ensure that the rack-mounted device does not cause hazardous
conditions due to uneven mechanical loading.
•Circuit overloading—Ensure that the circuit that supplies power to the device is
sufficiently rated to avoid circuit overloading or excess load on supply wiring. See
“Electrical Specifications” on page 24.
•Reliable earthing—Maintain reliable earthing of rack mounted equipment. Pay special
attention to supply connections other than direct connections to the branch circuit (such
as the use of power strips).
Rack Mount Procedures
The following sections describe the required steps to install the M-500 appliance in a two-post
or four-post 19” rack:
•“Four-post Rack Installation” in the next section
•“Two-Post Rack Installation” on page 14
Four-post Rack Installation
1. Unpack the rail kit, which contains two rail assemblies (one for each side of the M-500
appliance). Each assembly consists of three sections: An inner rail that secures directly to
the chassis, an outer rail that secures to the rack, and a middle rail that extends from the
outer rail. These assemblies are specifically designed for the left and right side of the
chassis.
Note: You can order a two-post rail kit from Palo Alto Networks for installation
in a two-post rack. See “Two-Post Rack Installation” on page 14 for installation
procedures.

Palo Alto Networks Installing the Hardware • 11
Equipment Rack Installation
2. Pull the inner rail out of the outer rail until it is fully extended and then press the locking
tab down to release the inner rail as shown in Figure 3. Repeat this step on the other rail.
Figure 3. Remove the Inner Rail
Press
Down
Inner Rail
Middle Rail
Outer Rail
3. Install the left inner rail on the left side of the chassis and the right inner rail on the right
side of the chassis. The inner rails install over the mounting hooks and then slide forward
to lock in place. The mounting screw holes will be exposed at which time you can use the
provided screws to secure the inner rail to the chassis as shown in Figure 4.
Figure 4. Attach the Inner Rails to the Chassis
Left Inner Rail
Right Inner Rail
Note: Each inner rail has a locking tab, which locks the chassis into place when
installed and pushed fully into the rack. These tabs also lock the chassis in place
when fully extended from the rack to prevent the chassis from coming completely
out when servicing.

Equipment Rack Installation
12 • Installing the Hardware Palo Alto Networks
4. Attach the outer rail to the rack by pressing upward on the locking tab at the rear end of
the middle rail and then push the middle rail back into the outer rail. Hang the hooks of
the front of the outer rail onto the slots on the front of the rack as shown in Figure 5. Use
rack-mount screws to secure the outer rails to the rack.
Figure 5. Attach the Outer Rail to the Rack Posts
Outer Rail
Outer Rail
Front
Back
5. Pull out the rear of the outer rail to adjust the length until the rail fits within the posts of
the rack.
6. Hang the hooks of the rear portion of the outer rail onto the slots on the rear of the rack.
Use rack-mount screws to secure the rear of the outer rail to the rear of the rack as shown
in Figure 5.
7. Repeat these steps for the remaining rail.
8. Install the chassis into the rack by pulling the middle rail out from the front of the outer
rail, ensuring that the ball-bearing shuttle is at the front locking position of the middle
rail.
9. Align the chassis inner rails with the front of the middle rails and slide the inner rails on
the chassis into the middle rails, keeping even pressure on both sides until the locking tab

Palo Alto Networks Installing the Hardware • 13
Equipment Rack Installation
of the inner rail clicks into the front of the middle rail as shown in Figure 6. This will lock
the chassis into the fully extended position.
Figure 6. Install the Chassis Into the Rack
10. Simultaneously press the locking tabs on both sides of the rails and push the chassis all
the way into the rear of the rack as shown in Figure 6.
11. Use rack mounting screws to secure the chassis to the rack. The mounting holes are
located below each front handle of the chassis.

Equipment Rack Installation
14 • Installing the Hardware Palo Alto Networks
Two-Post Rack Installation
This section describes how to install the M-500 appliance in a two-post rack.
1. Unpack the two-post rail kit, which contains two rail assemblies (one for each side of the
M-500 appliance). Each assembly consists of two sections: An inner rail that secures
directly to the chassis and an outer rail that attaches to the inner rail and screws into the
chassis. The inner rail has mounting holes that mount to the front of the rack post and the
outer rail has mounting holes that mount to the back of the rack post.
2. Separate the inner and outer rails by sliding the outer rail until the posts reach the round
holes and then evenly pull the outer rail away from the inner rail as shown in Figure 7.
Figure 7. Two-Post Rail Kit Components
Left
Inner Rail
Right
Inner Rail Right
Outer Rail
Left
Outer Rail
3. Slide the inner rails on each side of the chassis over the chassis hooks. There are six hooks;
install the inner rail on the middle four hooks and then secure the inner rails on both sides
of the chassis using the flat-head screws as shown in Figure 8.
Note: The M-500 appliance ships with a four-post rack kit. To obtain a two-post
rack kit, contact Palo Alto Networks or your local sales representative.
Note: You can install the inner rail to the chassis using only one screw since this
only prevents the rail from sliding. The chassis hooks and inner rail provide the
majority of strength/stability for the rail.

Palo Alto Networks Installing the Hardware • 15
Equipment Rack Installation
4. Mount the chassis to the rack by securing the front (inner rail) mount holes to the front of
the rack with the rack mount screws and washers as shown in Figure 8.
Figure 8. Install the Chassis Into the Rack and Secure the Front Rail
Inner Rail
Inner Rail
Inner Rail
Inner Rail
5. Align the outer rail holes with the inner rail post and push the outer rail into place. Then
slide it forward until the rack mount holes rest against the rack post. Secure the rail to the
post with the provided rack mount screws and washers.
Note: The chassis will be able to support itself in the rack at this point, but the rear
outer rails are required to fully secure the chassis as described in the next step.

Equipment Rack Installation
16 • Installing the Hardware Palo Alto Networks
6. Install the cylinder head screw through the outer rail to the inner rail threaded post as
shown in Figure 9.
Figure 9.
Outer Rail
Outer Rail
Cylinder Head Screw
Install the Outer Rail to Secure the Chassis to the Rack
CAUTION: It is important that you secure the outer rail to the inner rail
with the cylinder head screw to ensure that the outer rail does not inadver-
tently become separated from the inner rail.

Palo Alto Networks Installing the Hardware • 17
Connecting Cables to the Device
Connecting Cables to the Device
Figure 10 shows the M-500 appliance cable connections on the back of the device. See Table 1
for descriptions of the front panel and Table 2 for descriptions of the back panel interfaces.
Figure 10.
Serial Console Management Optional ports 1 and 2 to used to
distribute Panorama or PAN-DB
traffic load
Back Panel Cable Connections
Connecting Power
To power on the M-500 appliance, plug two power cables into grounded wall outlets (using
separate circuits) and then attach them to each of the two power supplies on the back of the
M-500 appliance. After the power cords are connected, press the power button on the front of
the device to power on. If only one power supply is connected, a warning beep will sound.
CAUTION: You must use shielded interface cables that are grounded to ensure
agency compliance with electromagnetic emissions (EMC).

Connecting Power
18 • Installing the Hardware Palo Alto Networks

Palo Alto Networks Maintaining the Hardware • 19
Cautions and Warnings
Chapter 3 
Maintaining the Hardware
This chapter describes how to interpret the device LEDs, replace disk drives, and troubleshoot
hardware problems. See the following topics:
•“Cautions and Warnings” in the next section
•“Interpreting the Port LEDs” on page 19
•“Replace a Disk Drive” on page 19
•“Power Supply Replacement” on page 22
Cautions and Warnings
CAUTION: Disconnect all power cords before servicing the M-500 appliance.
WARNING: To avoid risk of explosion, do not replace the battery with an incorrect type. Dispose of
used batteries according to the battery manufacturer’s instructions.
WARNING: Removal of the equipment’s top cover is to be done only by Palo Alto Networks trained
service person(s).
Interpreting the Port LEDs
Each Ethernet port on the M-500 appliance has two LEDs. Table 3 describes the LEDs.
Replace a Disk Drive
The following procedures describe how to replace a disk drive on an M-500 appliance. The
M-500 appliance has 24 disk drive bays. Starting from left to right, the bays are labeled A1 to
L2. Each pair of drives are in a RAID1 configuration. For example, A1-A2 is a RAID1 pair, B1-
B2 is a RAID1 pair, and so on.
Table 3. Port LEDs
LED Description
Left • Off—No link
• Green—100 Mbps link
•Amber—1 Gbps link
Right Flashes yellow if there is network activity.

Replace a Disk Drive
20 • Maintaining the Hardware Palo Alto Networks
By default, the M-500 appliance ships with 8 1TB drives in RAID1 pairs installed in drive bays
A1-D2 to provide 4TB of storage. You can install additional RAID1 pairs from E1-H2 to add
up to 8 more drives (4 pairs) for a total of 8TB of storage. Drive bays I1 to L2 are reserved for
future use.
The only drive maintenance you will need to perform is a replacement of a failed drive in one
of the RAID1 pairs as follows:.
1. Place an anti-static wrist strap around your wrist and connect it to ground.
2. Identify the failed drive indicated by the red LED on the drive bay. You can also check the
drive status by running the show system raid CLI command and viewing the output.
You will see Disk Pair A and Disk Pair B and the failed drive will show Missing or Failed.
3. Press the purple button on the drive bay of the failed drive as shown in Figure 11.
4. Eject the failed drive by gently rotating the drive bay lever away from the drive until it
stops.
5. Remove the failed drive by gently pulling on the lever and then remove it from the
appliance.
Figure 11. Replace a Disk Drive
6. To install a new drive in the appliance, remove the old drive from the drive carrier. Place
the failed drive assembly on a flat surface with the label side down and place the new
drive next to it.
Note: The disk drives in the front drive bays of the M-500 appliance are hot
swappable.