Focus

PA-5400 Series Next-Gen Firewall Hardware Reference

PA-5450 Logical Card Slots

Table of Contents

PA-5450 Logical Card Slots

Learn how to monitor and troubleshoot logically paired front slot cards in the PA-5450 firewall.

The PA-5450 firewall requires the use of logical card slots in order to direct processing power from the Data Processing Card (PA-5400 DPC-A) to the Networking Card (PA-5400 NC-A). For this to occur, an NC in Slot 1 of the appliance is logically paired to a DPC in Slot 3. Similarly, an NC in Slot 2 of the appliance is logically paired to a DPC in Slot 4. Logical pairing of the NC and DPC allows the appliance to process exception packets and other data that the NC does not process alone.

If you install a DPC in Slot 2 of the appliance, then there is no logical pairing with Slot 4.

See the following table of possible CLI commands that are used to restart, power on, or power off a card.

For more information on card states, see PA-5450 Front Slot and Card States.

CLI Command	Result
request chassis admin-power-on slot <> request chassis admin-power-on slot <> target ha-pair	Power on a card in the selected slot.
request chassis admin-power-off slot <> now <> request chassis admin-power-off slot <> target ha-pair now <>	Power off a card in the selected slot and keep it powered off across reboots until manually powered back on.
request chassis power-on slot <> request chassis power-on slot <> target ha-pair	Power on a card in the selected slot.
request chassis power-off slot <> now <> request chassis power-off slot <> target ha-pair now <>	Power off a card in the selected slot until the next reboot.
request chassis restart slot <> request chassis restart slot <> target ha-pair	Restart a card in the selected slot.
request chassis enable slot <> request chassis enable slot <> target -ha-pair	Enable a card in the selected slot.

The status of one card in a logical pair can have an impact on the status of the other card in the pair. The firewall will consult the logically paired card during different operations. For example, when a DPC is brought into a Power-Off state, its corresponding NC will also be powered off. System logs can be used to troubleshoot any status errors encountered by a logical pair. See the following table of possible outcomes that occur as a result of the status of a card or logically paired slot. The third column of the table gives examples of critical system logs that are received in response to certain outcomes.

Operation	Possible Outcomes	Critical System Log Examples
Powering on an NC	If the logically paired DPC is already in the Up state, then the operation to power on the DPC is skipped. Verify if the NC is powered on. If the logically paired DPC is in one of the following states: empty, failureCard, unsupportedCard, powerNotOK, or coolingNotOK, then the CLI prints a failure and does not power on the NC. Verify that the CLI received a critical system log. See the Critical System Log Examples column. If the logically paired DPC is in the adminPoweredDown state and you are trying to use the admin-power-on or power-on commands, the CLI prints a failure and does not power on the NC. Powering on the NC powers on the paired DPC if the paired DPC is NOT in one of the following states: adminPoweredDown, empty, failureCard, unsupportedCard, powerNotOK, or coolingNotOK.	2021/04/12 14:06:34 critical hw slot-po 0 Attempting to power down Slot 1 because the Logically Paired DPC is in a PowerOff state.
Powering off an NC	The state of the logically paired DPC is not affected when the NC fails or goes down.
Powering on a DPC	Using the admin-power-on or power-on commands will only power on the DPC. There is no effect on the state of the logically paired NC when the DPC powers on. See the system log in the Critical System Log Examples column.	2021/04/12 14:03:48 critical hw slot-po 0 The Logically paired Slot 1 might be in a PowerOff state. Power it on using Slot 1 specific CLI.
Powering down a DPC	Using the admin-power-off or power-off commands on the DPC will power off the logically paired NC before powering off the DPC. See the system log in the Critical System Log Examples column.	2021/04/12 13:56:10 critical hw slot-po 0 Attempting to power down Slot 1 because the Logically Paired Slot 3 went from an Up state to a Stopping state.
Restarting an NC	When the logically paired DPC is in the Up or Disabled state: The firewall first powers off the NC. The firewall then verifies if the DPC is still in the Up or Disabled state. Lastly, the firewall powers on the NC. When the logically paired DPC is in the power-off state: The firewall first powers off the NC. The firewall powers on the logically paired DPC. The firewall then powers on the NC. When the logically paired DPC is in one of the following states: empty, failureCard, unsupportedCard, powerNotOK, or coolingNotOK, the NC cannot be powered on after a restart.

PA-5450 Front Slot and Card States

Replace a PA-5450 Front Slot Card in a High Availability (HA) Configuration