Focus

PA-7000 Series Firewall Hardware Reference

Install a PA-7000 Series Firewall NPC in a High Availability (HA) Configuration

Table of Contents

Install a PA-7000 Series Firewall NPC in a High Availability (HA) Configuration

With all Palo Alto Networks firewalls, the hardware must match when configuring two firewalls in an HA pair. When configuring PA-7000 Series firewalls, the installed Network Processing Cards (NPC) must also match and must be installed in the same slots on each firewall.

Important: When installing new NPCs in a PA-7000 Series firewall with high availability (HA) configured, PAN-OS puts the cards in a disabled state. This allows you to bring up both cards (one in each firewall) at the same time, so HA can start monitoring the cards.

Installing a new NPC also causes any virtual routers to restart.

Put the provided ESD wrist strap on your wrist ensuring that the metal contact is touching your skin. Then attach (snap) one end of the ground cable to the wrist strap and remove the alligator clip from the banana clip on the other end of the ESD grounding cable. Plug the banana clip end into one of the ESD ports located on the front of the chassis before handling ESD sensitive hardware. For details on the ESD port location, see PA-7050 Front Panel (AC) or PA-7080 Front Panel (AC).
Using a Phillips-head screwdriver, remove the blank slot covers for each slot in which you will install an NPC.
Remove the first NPC from the antistatic bag and partially slide it into any of the available NPC slots, ensuring that the handles are in the open position. When the card is about 1/4-inch from being fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in place.
Install the second NPC (of the same model) in the other chassis in the HA pair in the same slot you installed the NPC in the first chassis. For example, if you installed the first NPC in slot 3 of the first chassis, install the second NPC in slot 3 of the second chassis.
After you install the firewall in the rack and power it on as described in Connect Power to a PA-7000 Series Firewall, continue the following steps to bring up the NPCs in the HA pair. Refer to Verify the PA-7000 Series Firewall NPC Configuration for information on how to check the status of the NPCs.
Run the following command to power-on both NPCs in the HA pair:
```
admin@PA-7050> request
chassis power-on slot <slot-number> target ha-pair
```
For example, if you installed the NPCs in slot 3 of each chassis, run the following command:
```
admin@PA-7050> request
chassis power-on slot s3 target ha-pair
```
This will simultaneously power-on both cards in each chassis.
Enable the NPCs by running the following command:
```
admin@PA-7050> request
chassis enable slot s3 target ha-pair
```
Check the status of the card in slot 3 on either chassis by running:
```
admin@PA-7050> show
chassis status slot s3
```
If the cards are functioning properly, the status will show an output similar to the following:
```
Slot...Component........Card Status.....Config Status 
3 .....PA-7000-100G-NPC .Up..............Success
```
Connect the network cables and the NPCs are ready to process network traffic.

Install a PA-7000 Series Firewall NPC in a Single Chassis

Configure a Log Card Port on a PA-7000 Series Firewall