Focus

PA-7500 Next-Gen Firewall Hardware Reference

Replace a PA-7500 Series Firewall Interface Card

Table of Contents

Replace a PA-7500 Series Firewall Interface Card

Learn how to replace an MPC, NPC, DPC, and SFC on a PA-7500 Series firewall.

The procedures to replace the Management Processing Card (MPC), Network Processing Card (NPC), and Data Processing Card (DPC) are the same. The Switch Fabric Card (SFC), located on the back of the chassis, has a similar procedure.

If your PA-7500 is in a NGFW cluster, you must follow the procedures for replacing an interface card in a NGFW cluster.

The replacement MPC ships with a factory default configuration and version of PAN-OS. You may need to upgrade or downgrade the PAN-OS version to your preferred version and you will need to restore the firewall configuration from a backup.

To learn how to create a backup of your PAN-OS configuration, see Save and Export Firewall Configurations.

If an NPC fails, the card will reboot and attempt to recover. If the card does not recover, it will change to a down state. If there is only one functioning NPC in the appliance and the NPC fails after three recovery attempts, the firewall will reboot to attempt to recover the card.

If your firewall has two SFCs installed (a dual-SFC configuration), follow Step 2 before physically removing an SFC. When the replacement SFC comes online, PAN-OS automatically syncs to the higher PAN-OS version between the two SFCs. New SFCs ship with PAN-OS 11.1.5-h1 as the manufacturing image.

Put the provided ESD wrist strap on your wrist ensuring that the metal contact is touching your skin. Then attach (snap) one end of the ground cable to the wrist strap and remove the alligator clip from the banana clip on the other end of the ESD grounding cable. Plug the banana clip end into one of the ESD ports located on the appliance before handling ESD sensitive hardware.
(Dual-SFC configuration only) Switch the SFC you are replacing to Standby mode if it is currently Active.
1. Identify the current Active and Standby SFCs. The following example shows a firewall where the SFC in slot 10 is Active:
```
10    PA-7500-SFC-A    Up    Success    Active
11    PA-7500-SFC-A    Up    Success    Standby
```
2. If the SFC you are replacing is Active, run the following command to switch it to Standby:
```
request failover switchcard
```
  To skip the confirmation prompt, include the force yes option:
```
request failover switchcard force yes
```
3. Verify that the SFC you are replacing now shows Standby status before proceeding. Using the example above, the states switch as follows after the command runs:
```
10    PA-7500-SFC-A    Up    Success    Standby
11    PA-7500-SFC-A    Up    Success    Active
```
After the replacement SFC is installed, it boots and comes online automatically. If you also need to replace the SFC in the other slot, repeat this procedure for that slot.
(MPC only) Ensure that the PA-7500 firewall is powered off and that the fans are not still spinning.
Unlock the interface card.
- (MPC, NPC, and DPC) Push the ejector tabs on the card towards the center, prompting a click. This will cause ejector handles on the front of the card to rotate outward and unlock the card.
- (SFC) Push the ejector tabs on the card away from the center, prompting a click. This will allow the ejector handles to rotate outward and unlock the card.
Grip the ejector handles and gently pull the card out of its slot.

The cards are heavy and should be removed and replaced in their antistatic bags on a table or other flat, stable surface. Ensure that the card connectors do not make contact with other surfaces or objects.
Retrieve your replacement card and install it into the appropriate slot.
The following chassis front slots (numbered from top to bottom) can support the following interface cards:
- 1—NPC and DPC
- 2—NPC and DPC
- 3—NPC and DPC
- 4—NPC and DPC
- 5—MPC (required)
- 6—NPC and DPC
- 7—NPC and DPC
- 8—NPC and DPC
- 9—NPC and DPC
The two slots on the back of the chassis support SFCs.
(MPC only) Boot the appliance with the new MPC installed. When prompted, log in and reset the firewall to factory default settings.
(MPC only) Restore your previous device configuration.

Replace a PA-7500 Series Firewall AC or DC Power Supply

Replace a PA-7500 Series Firewall Interface Card in a NGFW Cluster