PaloAlto Networks PA-7000 Series Hardware Reference Manual page 63

Install an NPC in a High Availability (HA) Configuration
With all Palo Alto Networks firewalls, the platform hardware must match when configuring two
firewalls in an HA pair. When configuring PA-7000 Series firewalls, the installed Network Processing
Cards (NPC) must also match and must be installed in the same slots on each firewall.
Important: When installing a new NPC in a PA-7000 Series firewall with high availability (HA)
configured, PAN-OS puts the cards in a disabled state. This allows you to bring up both cards at the
same time, so HA can start monitoring the cards.
1. Put the provided ESD wrist strap on your wrist ensuring that the metal contact is touching your
skin. Then attach (snap) one end of the ground cable to the wrist strap and remove the alligator clip
from the banana clip on the other end of the ESD grounding cable. Plug the banana clip end into
one of the ESD ports located on the front of the chassis before handling ESD sensitive hardware.
For details on the ESD port location, see "PA-7050 Front Panel (AC)" on page 6 or "PA-7080
Front Panel (AC)" on page 13.
2. Using a Phillips-head screwdriver, remove the blank slot covers for each slot in which you will
install an NPC.
3. Remove the first NPC from the antistatic bag and partially slide it into any of the available NPC
slots, ensuring that the handles are in the open position. When the card is about 1/4-inch from being
fully inserted, adjust the levers to align with the chassis and then close the levers to seat the card in
place.
4. Install the second NPC (of the same model) in the other chassis in the HA pair in the same slot you
installed the NPC in the first chassis. For example, if you installed the first NPC in slot 3 of the first
chassis, install the second NPC in slot 3 of the second chassis.
After you install the firewall in the rack and power it on as described in "Connect Power to a PA-7000
Series Firewall" on page 65, continue the following steps to bring up the NPCs in the HA pair. Refer to
"Verify the NPC Configuration" on page 86 for information on how to check the status of the NPCs.
5. Run the following command to power-on both NPCs in the HA pair:
admin@PA-7050> request chassis power-on slot <slot-number> target
ha-pair
For example, if you installed the NPCs in slot 3 of each chassis, run the following command:
admin@PA-7050> request chassis power-on slot s3 target ha-pair
This will simultaneously power-on both cards in each chassis.
Enable the NPCs by running the following command:
admin@PA-7050> request chassis enable slot s3 target ha-pair
6. Check the status of the card in slot 3 on either chassis by running:
admin@PA-7050> show chassis status slot s3
If the cards are functioning properly, the status will show an output similar to the following:
Slot...Component........Card Status.....Config Status
3 .....PA-7000-20G-NPC .Up..............Success
7. Connect the network cables and the NPCs are ready to process network traffic.
Palo Alto Networks
Install the Mandatory Front Slot Cards
Install the PA-7000 Series Firewall • 63