PA-5400 Series Next-Gen Firewall Hardware Reference
    : PA-5450 Logical Card Slots
    Focus
    Download PDF
    Focus
    1. Home
    2. Firewalls & Appliances
    3. PA-5400 Series Next-Gen Firewall Hardware Reference
    4. Service the PA-5400 Series Firewall Hardware
    5. Replace a PA-5400 Series Firewall Front Slot Card
    6. PA-5450 Logical Card Slots
    Download PDF

    PA-5400 Series Next-Gen Firewall Hardware Reference

    PA-5450 Logical Card Slots

    Table of Contents

    PA-5450 Logical Card Slots

    Learn how to monitor and troubleshoot logically paired front slot cards in the PA-5450 firewall.
    The PA-5450 firewall requires the use of logical card slots in order to direct processing power from the Data Processing Card (PA-5400 DPC-A) to the Networking Card (PA-5400 NC-A). For this to occur, an NC in Slot 1 of the appliance is logically paired to a DPC in Slot 3. Similarly, an NC in Slot 2 of the appliance is logically paired to a DPC in Slot 4. Logical pairing of the NC and DPC allows the appliance to process exception packets and other data that the NC does not process alone.
    If you install a DPC in Slot 2 of the appliance, then there is no logical pairing with Slot 4.
    See the following table of possible CLI commands that are used to restart, power on, or power off a card.
    For more information on card states, see PA-5450 Front Slot and Card States.
    CLI Command
    Result
     
    request chassis admin-power-on slot <> 
    request chassis admin-power-on slot <> target ha-pair
    Power on a card in the selected slot.
    request chassis admin-power-off slot <> now <>
    request chassis admin-power-off slot <> target ha-pair now <>
    Power off a card in the selected slot.
    request chassis power-on slot <> 
    request chassis power-on slot <> target ha-pair
    Power on a card in the selected slot.
    request chassis power-off slot <> now <>
    request chassis power-off slot <> target ha-pair now <>
    Power off a card in the selected slot.
    request chassis restart slot <> 
    request chassis restart slot <> target ha-pair
    Restart a card in the selected slot.
    request chassis enable slot <>
    request chassis enable slot <> target -ha-pair
    Enable a card in the selected slot.
    The status of one card in a logical pair can have an impact on the status of the other card in the pair. The firewall will consult the logically paired card during different operations. For example, when a DPC is brought into a
    Power-Off
     state, its corresponding NC will also be powered off. System logs can be used to troubleshoot any status errors encountered by a logical pair. See the following table of possible outcomes that occur as a result of the status of a card or logically paired slot. The third column of the table gives examples of critical system logs that are received in response to certain outcomes.
    Operation
    Possible Outcomes
    Critical System Log Examples
    Powering on an NC
    • If the logically paired DPC is already in the
      Up
       state, then the operation to power on the DPC is skipped. Verify if the NC is powered on.
    • If the logically paired DPC is in one of the following states:
      empty
      ,
      failureCard
      ,
      unsupportedCard
      ,
      powerNotOK
      , or
      coolingNotOK
      , then the CLI prints a failure and does not power on the NC. Verify that the CLI received a critical system log. See the Critical System Log Examples column.
    • If the logically paired DPC is in the
      adminPoweredDown
       state and you are trying to use the
      admin-power-on
       or
      power-on
       commands, the CLI prints a failure and does not power on the NC.
    • Powering on the NC powers on the paired DPC if the paired DPC is NOT in one of the following states:
      adminPoweredDown
      ,
      empty
      ,
      failureCard
      ,
      unsupportedCard
      ,
      powerNotOK
      , or
      coolingNotOK
      .
    2021/04/12 14:06:34 critical hw           slot-po 0  Attempting to power down Slot 1 because the Logically Paired DPC is in a PowerOff state.
    Powering off an NC
    • The state of the logically paired DPC is not affected when the NC fails or goes down.
    Powering on a DPC
    • Using the
      admin-power-on
       or
      power-on
       commands will only power on the DPC.
    • There is no effect on the state of the logically paired NC when the DPC powers on. See the system log in the Critical System Log Examples column.
    2021/04/12 14:03:48 critical hw          slot-po 0  The Logically paired Slot 1 might be in a PowerOff state. Power it on using Slot 1 specific CLI.
    Powering down a DPC
    • Using the
      admin-power-off
       or
      power-off
       commands on the DPC will power off the logically paired NC before powering off the DPC. See the system log in the Critical System Log Examples column.
    2021/04/12 13:56:10 critical hw           slot-po 0  Attempting to power down Slot 1 because the Logically Paired Slot 3 went from an Up state to a Stopping state.
    Restarting an NC
    • When the logically paired DPC is in the
      Up
       or
      Disabled
       state:
      1. The firewall first powers off the NC.
      2. The firewall then verifies if the DPC is still in the
        Up
         or
        Disabled
         state.
      3. Lastly, the firewall powers on the NC.
    • When the logically paired DPC is in the
      power-off
       state:
      1. The firewall first powers off the NC.
      2. The firewall powers on the logically paired DPC.
      3. The firewall then powers on the NC.
    • When the logically paired DPC is in one of the following states:
      empty
      ,
      failureCard
      ,
      unsupportedCard
      ,
      powerNotOK
      , or
      coolingNotOK
      , the NC cannot be powered on after a restart.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.