- Home
- Firewalls & Appliances
- PA-7000 Series Firewall Hardware Reference
- PA-7000 Series Firewall Installation
- Install the Mandatory PA-7000 Series Firewall Front Slot Cards
- Install a PA-7000 Series Firewall Data Processing Card (DPC)
- Install a PA-7000 Series Firewall DPC in a High Availability (HA) Configuration
Install a PA-7000 Series Firewall DPC in a High Availability (HA) Configuration
Table of Contents
Expand all | Collapse all
-
-
-
- PA-7000 Series Power Configuration Options
- Determine PA-7000 Series Firewall Power Configuration Requirements
- Connect AC Power to a PA-7050 Firewall
- Connect DC Power to a PA-7050 Firewall
- Connect AC Power to a PA-7080 Firewall
- Connect DC Power to a PA-7080 Firewall
- View PA-7000 Series Firewall Power Statistics
- Connect Cables to a PA-7000 Series Firewall
- Install the PA-7080 Firewall EMI Filter
-
- Replace a PA-7000 Series Firewall Air Filter
- Replace a PA-7000 Series SMC Boot Drive
- Replace a PA-7000 Series Firewall LPC Drive
- Re-Index the LPC Drives
- Replace a PA-7050-SMC-B or PA-7080-SMC-B Drive
- Increase the PA-7000 Series Firewall LPC Log Storage Capacity
Install a PA-7000 Series Firewall DPC in a High Availability (HA) Configuration
Learn how to install a Data Processing Card (DPC) in a PA-7000 Series Firewall high
availability configuration.
With all Palo Alto Networks firewalls, the hardware must match when configuring two
firewalls in an HA pair. When configuring PA-7000 Series firewalls, the installed
Data Processing Cards (DPCs) must also match and must be installed in the same slots
on each firewall.
Installing and enabling a new DPC also causes any virtual routers to restart. In
an HA clustering configuration, it is recommended that you activate the DPCs in
both chassis simultaneously in order to limit downtime.
- Put the provided ESD wrist strap on your wrist ensuring that the metal contact is touching your skin. Then attach (snap) one end of the ground cable to the wrist strap and remove the alligator clip from the banana clip on the other end of the ESD grounding cable. Plug the banana clip end into one of the ESD ports located on the front of the chassis before handling ESD sensitive hardware. For details on the ESD port location, see PA-7050 Front Panel (AC) or PA-7080 Front Panel (AC).Using a Phillips-head screwdriver, remove the blank slot covers for each slot in which you will install a DPC.Remove the first DPC from the antistatic bag and partially slide it into any of the available DPC slots, ensuring that the handles are in the open position. When the card is about 1/4-inch from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in place.Install the second DPC in the other chassis in the HA pair in the same slot you installed the DPC in the first chassis. For example, if you installed the first DPC in slot 3 of the first chassis, install the second DPC in slot 3 of the second chassis.After you install the firewall in the rack and power it on as described in Connect Power to a PA-7000 Series Firewall, use the CLI to bring up the DPCs in the HA pair.Run the following command to power-on both DPCs in the HA pair:
admin@PA-7050> request chassis power-on slot <slot-number> target ha-pair
For example, if you installed the DPCs in slot 3 of each chassis, run the following command:admin@PA-7050> request chassis power-on slot s3 target ha-pair
This will simultaneously power-on both cards in each chassis.Enable the DPCs by running the following command:admin@PA-7050> request chassis enable slot s3 target ha-pair
It is recommended that you observe the enabled cards for about two minutes to check for internal path monitoring failures. If there is no failure, proceed to the next step.Check the status of the card in slot 3 on either chassis by running:admin@PA-7050> show chassis status slot s3
If the cards are functioning properly, the status will show an output similar to the following:Slot...Component........Card Status.....Config Status 3.......PA-7000-DPC ...Up..................Success
Ensure that the DPC's session distribution policy is set to session-load.- Run the following command to check the DPC's current distribution policy:
admin@PA-7050> show session distribution policy
If the Ownership Distribution Policy reads as any value other than session-load, run the following command:admin@PA-7050> set session distribution-policy session-load
Running the show session distribution policy command should now read Ownership Distribution Policy: session-load.