PaloAlto Networks PA-220R Hardware Reference Manual

PA-220R Next-Gen Firewall Hardware
Reference

paloaltonetworks.com/documentation

Contact Information

Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054

www.paloaltonetworks.com/company/contact-support

About the Documentation

• For the most recent version of this guide or for access to related documentation, visit the Technical
Documentation portal www.paloaltonetworks.com/documentation.

• To search for a specific topic, go to our search page www.paloaltonetworks.com/documentation/

document-search.html.

• Have feedback or questions for us? Leave a comment on any page in the portal, or write to us at

[e-mail].

Copyright

Palo Alto Networks, Inc.

www.paloaltonetworks.com

©

2018-2018 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/

trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.

Last Revised

July 30, 2018

2 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE |

Table of Contents

Before You Begin................................................................................................5

Tamper Proof Statement........................................................................................................................... 7

Third-Party Component Support.............................................................................................................8

Product Safety Warnings.......................................................................................................................... 9

PA-220R Firewall Overview...........................................................................13

PA-220R Front Panel...............................................................................................................................15

PA-220R Back Panel................................................................................................................................ 17

PA-220R Status LEDs.............................................................................................................................. 18

Install the PA-220R Firewall.......................................................................... 19

Install the PA-220R Firewall on a Flat Surface................................................................................. 21

Install the PA-220R Firewall on a DIN Rail........................................................................................22

Install the PA-220R Firewall on a Wall...............................................................................................23

Install the PA-220R Firewall in a 19-inch Equipment Rack............................................................25

Connect Power to a PA-220R Firewall....................................................... 27

Prepare to Connect DC Power to a PA-220R Firewall................................................................... 29

Connect DC Power to a PA-220R Firewall........................................................................................30

PA-220R Firewall Specifications................................................................... 33

PA-220R Physical Specifications...........................................................................................................35

PA-220R Electrical Specifications.........................................................................................................36

PA-220R Environmental Specifications............................................................................................... 37

PA-220R Miscellaneous Specifications............................................................................................... 38

PA-220R Firewall Hardware Compliance Statements Overview.......... 39

PA-220R Firewall Hardware Compliance Statements..................................................................... 41

TABLE OF CONTENTS iii

iv TABLE OF CONTENTS

Before You Begin

Read the following topics before you install or service a Palo Alto Networks® next-generation
firewall or appliance. The following topics apply to all Palo Alto Networks firewalls and
appliances except where noted.

> Tamper Proof Statement
> Third-Party Component Support
> Product Safety Warnings

5

6 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin

©

2018 Palo Alto Networks, Inc.

Tamper Proof Statement

To ensure that products purchased from Palo Alto Networks were not tampered with during shipping, verify
the following upon receipt of each product:

• The tracking number provided to you electronically when ordering the product matches the tracking
number that is physically labeled on the box or crate.

• The integrity of the tamper-proof tape used to seal the box or crate is not compromised.

• The integrity of the warranty label on the firewall or appliance is not compromised.

(PA-7000 Series firewalls only) PA-7000 Series firewalls are modular systems and therefore
do not include a warranty label on the firewall.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 7

©

2018 Palo Alto Networks, Inc.

Third-Party Component Support

Before you consider installing third-party hardware, read the Palo Alto Networks Third-Party Component

Support statement.

8 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin

©

2018 Palo Alto Networks, Inc.

Product Safety Warnings

To avoid personal injury or death for yourself and others and to avoid damage to your Palo Alto Networks
hardware, be sure you understand and prepare for the following warnings before you install or service the
hardware. You will also see warning messages throughout the hardware reference where potential hazards
exist.

All Palo Alto Networks products with laser-based optical interfaces comply with 21 CFR

1040.10 and 1040.11.

The following safety warnings apply to all Palo Alto Networks firewalls and appliances, unless a specific
hardware model is specified.

• When installing or servicing a Palo Alto Networks firewall or appliance hardware component that has
exposed circuits, ensure that you wear an electrostatic discharge (ESD) strap. Before handling the
component, make sure the metal contact on the wrist strap is touching your skin and that the other end
of the strap is connected to earth ground.

French Translation: Lorsque vous installez ou que vous intervenez sur un composant matériel de
pare-feu ou de dispositif Palo Alto Networks qui présente des circuits exposés, veillez à porter un
bracelet antistatique. Avant de manipuler le composant, vérifiez que le contact métallique du bracelet
antistatique est en contact avec votre peau et que l’autre extrémité du bracelet est raccordée à la terre.

• Use grounded and shielded Ethernet cables to ensure agency compliance with electromagnetic
compliance (EMC) regulations.

French Translation: D es câbles Ethernet blindés reliés à la terre doivent être utilisés pour garantir la
conformité de l'organisme aux émissions électromagnétiques (CEM).

• (PA-220 firewalls only) The PA-220 firewall meets the requirements of IEC 61000-4-5 surge immunity
test. To prevent damage from electrical surges on Ethernet ports, we recommend that you use an
Ethernet surge protection device with the following specifications:

• Rated for Gigabit Ethernet up to category 5E and minimum 1Gbps.

• Protection provided on all eight signal leads.

• Both line-to-line and line-to-ground/shield are provided.

• Protection device must be connected to earth ground and use shielded category 5E or higher

Ethernet cable.

Technical Specifications:

• Protective circuit complies with IEC test classifications B2, C1, C2, C3, and D1.

• Normal discharge current (core to earth ground) is 2kA per signal pair.

• Normal discharge current (core to core) is 100A.

• Total discharge current is 10kA.

• French Translation: (PA-220 uniquement) Les pare-feux PA-220 sont conformes aux exigences du test
d’immunité aux surtensions IEC 61000-4-5. Pour éviter les dommages résultant de surtension électrique
sur les ports Ethernet, il est recommandé d’utiliser un dispositif de protection contre les surtensions aux
caractéristiques suivantes:

• Gigabit Ethernet jusqu’à la catégorie 5E, débit 1 Go/s minimum.

• Protection sur les huit câbles signal.

• Le blindage et la mise à la terre “ligne à ligne” et “ligne à la terre” sont fournis.

• Le dispositif de protection doit être raccordé à la terre et un câble Ethernet blindé de catégorie 5E ou

supérieure doit être utilisé.

Caractéristiques techniques:

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 9

©

2018 Palo Alto Networks, Inc.

• Le circuit de protection est conforme aux classifications de test IEC B2, C1, C2, C3, et D1.

• Le courant de décharge normal (cœur vers terre) est de 2kA par paire de signal.

• Le courant de décharge normal (cœur vers cœur) est de 100 A.

• Le courant de décharge total est de 10kA.

• Do not connect a supply voltage that exceeds the input range of the firewall or appliance. For details
on the electrical range, refer to electrical specifications in the hardware reference for your firewall or
appliance.

French Translation: Veillez à ce que la tension d’alimentation ne dépasse pas la plage d’entrée du
pare-feu ou du dispositif. Pour plus d’informations sur la mesure électrique, consulter la rubrique des
caractéristiques électriques dans la documentation de votre matériel de pare-feu ou votre dispositif.

• Do not replace a battery with an incorrect battery type; doing so can cause the replacement battery to
explode. Dispose of used batteries according to local regulations.

French Translation: Ne remplacez pas la batterie par une batterie de type non adapté, cette dernière
risquerait d’exploser. Mettez au rebut les batteries usagées conformément aux instructions.

• (All firewalls with two or more power supplies) Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.

French Translation: (Tous les pare-feux avec au moins deux sources d’alimentation) Débranchez tous les
cordons d’alimentation (c.a. ou c.c.) des entrées d’alimentation et mettez le matériel hors tension.

• (PA-7000 Series firewalls only) When removing a fan tray from a PA-7000 Series firewall, first pull the
fan tray out about 1 inch (2.5cm) and then wait a minimum of 10 seconds before extracting the entire
fan tray. This allows the fans to stop spinning and helps you avoid serious injury when removing the
fan tray. You can replace a fan tray while the firewall is powered on but you must replace it within 45
seconds and you can only replace one fan tray at a time to prevent the thermal protection circuit from
shutting down the firewall.

French Translation: (Pare-feu PA-7000 uniquement) Lors du retrait d’un tiroir de ventilation d’un pare-
feu PA-7000, retirez tout d’abord le tiroir sur 2,5 cm, puis patientez au moins 10 secondes avant de
retirer complètement le tiroir de ventilation. Cela permet aux ventilateurs d’arrêter de tourner et permet
d’éviter des blessures graves lors du retrait du tiroir. Vous pouvez remplacer un tiroir de ventilation
lors de la mise sous tension du pare-feu. Toutefois, vous devez le faire dans les 45 secondes et vous ne
pouvez remplacer qu’un tiroir à la fois, sinon le circuit de protection thermique arrêtera le pare-feu.

• (All firewalls with two or more power supplies) Disconnect all power cords (AC or DC) from the power
inputs to fully de-energize the hardware.

French Translation: (Tous les pare-feux avec au moins deux sources d’alimentation) Débranchez tous les
cordons d’alimentation (c.a. ou c.c.) des entrées d’alimentation et mettez le matériel hors tension.

The following applies only to Palo Alto Networks firewalls that support a direct current (DC) power source:
French Translation: Les instructions suivantes s’appliquent uniquement aux pare-feux de Palo Alto

Networks prenant en charge une source d’alimentation en courant continu (c.c.):

• Do not connect or disconnect energized DC wires to the power supply.
French Translation: Ne raccordez ni débranchez de câbles c.c. sous tension à la source d’alimentation.

• The DC system must be earthed at a single (central) location.
French Translation: Le système c.c. doit être mis à la terre à un seul emplacement (central).

• The DC supply source must be located within the same premises as the firewall.
French Translation: La source d’alimentation c.c. doit se trouver dans les mêmes locaux que ce pare-feu.

• The DC battery return wiring on the firewall must be connected as an isolated DC (DC-I) return.
French Translation: Le câblage de retour de batterie c.c. sur le pare-feu doit être raccordé en tant que

retour c.c. isolé (CC-I).

10 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin

©

2018 Palo Alto Networks, Inc.

• The firewall must be connected either directly to the DC supply system earthing electrode conductor
or to a bonding jumper from an earthing terminal bar or bus to which the DC supply system earthing
electrode conductor is connected.

French Translation: Ce pare-feu doit être branché directement sur le conducteur à électrode de mise à
la terre du système d’alimentation c.c. ou sur le connecteur d'une barrette/d'un bus à bornes de mise à la
terre auquel le conducteur à électrode de mise à la terre du système d'alimentation c.c. est raccordé.

• The firewall must be in the same immediate area (such as adjacent cabinets) as any other equipment that
has a connection between the earthing conductor of the DC supply circuit and the earthing of the DC
system.

French Translation: Le pare-feu doit se trouver dans la même zone immédiate (des armoires adjacentes
par exemple) que tout autre équipement doté d’un raccordement entre le conducteur de mise à la terre
du même circuit d’alimentation c.c. et la mise à la terre du système c.c.

• Do not disconnect the firewall in the earthed circuit conductor between the DC source and the point of
connection of the earthing electrode conductor.

French Translation: Ne débranchez pas le pare-feu du conducteur du circuit de mise à la terre entre la
source d'alimentation c.c. et le point de raccordement du conducteur à électrode de mise à la terre.

• Install all firewalls that use DC power in restricted access areas only. A restricted access area is where
access is granted only to craft (service) personnel using a special tool, lock and key, or other means of
security, and that is controlled by the authority responsible for the location.

French Translation: Tous les pare-feux utilisant une alimentation c.c. sont conçus pour être installés
dans des zones à accès limité uniquement. Une zone à accès limité correspond à une zone dans laquelle
l’accès n’est autorisé au personnel (de service) qu'à l'aide d'un outil spécial, cadenas ou clé, ou autre
dispositif de sécurité, et qui est contrôlée par l'autorité responsable du site.

• Install the firewall DC ground cable only as described in the power connection procedure for the firewall
that you are installing. You must use the American wire gauge (AWG) cable specified and torque all nuts
to the torque value specified in the installation procedure for your firewall.

French Translation: Installez le câble de mise à la terre c.c. du pare-feu comme indiqué dans la procédure
de raccordement à l’alimentation pour le pare-feu que vous installez. Utilisez le câble American wire
gauge (AWG) indiqué et serrez les écrous au couple indiqué dans la procédure d’installation de votre
pare-feu pare-feu.

• The firewall permits the connection of the earthed conductor of the DC supply circuit to the earthing
conductor at the equipment as described in the installation procedure for your firewall.

French Translation: Ce pare-feu permet de raccorder le conducteur de mise à la terre du circuit
d’alimentation c.c. au conducteur de mise à la terre de l’équipement comme indiqué dans la procédure
d’installation du pare-feu.

• A suitably-rated DC mains disconnect device must be provided as part of the building installation.
French Translation: Un interrupteur d'isolement suffisant doit être fourni pendant l'installation du

bâtiment.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin 11

©

2018 Palo Alto Networks, Inc.

12 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Before You Begin

PA-220R Firewall Overview

The Palo Alto Networks® PA-220R next-generation firewall is a rugged-design firewall built
for uncontrolled environments with varying temperature and humidity levels. This firewall
includes the following main features: active/passive and active/active high availability (HA),
passive cooling (no fans) to reduce noise and power consumption, RJ-45 ports with built-in
surge protection, and dual 12-24VDC power inputs for power redundancy.

First Supported Software Release: PAN-OS® 8.1

The following topics describe the hardware features and the status LEDs of the PA-220R
firewall. To view or compare performance and capacity information, refer to the Product
Selection tool.

> PA-220R Front Panel
> PA-220R Back Panel
> PA-220R Status LEDs

13

14 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Overview

©

2018 Palo Alto Networks, Inc.

PA-220R Front Panel

The following image shows the front panel of the PA-220R firewall and the table describes each front-panel
component.

Item Component Description

1 Screw-on ground point Use this ground point to connect the firewall to earth

ground (ground cable not included).

2 DC power and ground inputs Use the DC input terminal block to connect DC power

to the firewall. The terminal block is included in the
accessories kit and is labeled A+, A-, B+, and B-.

The two inputs to the right of the four DC power inputs
are ground inputs (use only one) that you can use in
place of the screw-on ground point on the firewall (see

Connect Power to a PA-220R Firewall).

3 Ethernet ports 1 through 6 Six RJ-45 10Mbps/100Mbps/1000Mbps ports for

network traffic. You can set the link speed and duplex
or choose auto-negotiate for each port. These ports also
have built-in surge protection.

4 SFP ports 7 and 8 Two SFP (1Gbps) ports for network traffic.

These ports also support 100Base-FX.

5 MGT port Use this Ethernet 10Mbps/100Mbps/1000Mbps port

to access the management web interface and perform
administrative tasks. The firewall also uses this port for
management services, such as retrieving licenses and
updating the threat and application signatures.

6 CONSOLE port (RJ-45) Use this port to connect a management computer to the

firewall using a 9-pin serial-to-RJ-45 cable and terminal
emulation software.

The console connection provides access to firewall boot
messages, the Maintenance Recovery Tool (MRT), and
the command line interface (CLI).

If your management computer does not
have a serial port, use a USB-to-serial
converter.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Overview 15

©

2018 Palo Alto Networks, Inc.

Item Component Description

Use the following settings to configure your terminal
emulation software to connect to the console port:

• Data rate: 9600

• Data bits: 8

• Parity: None

• Stop bits: 1

• Flow control: None

7 USB A USB port that accepts a USB flash drive with a

bootstrap bundle (PAN-OS configuration).

Bootstrapping speeds up the process of configuring
and licensing the firewall to make it operational on the
network with or without internet access.

8 CONSOLE port (Micro USB) Use this port to connect a management computer to

the firewall using a standard Type-A USB-to-micro USB
cable.

The console connection provides access to firewall boot
messages, the Maintenance Recovery Tool (MRT), and
the command line interface (CLI).

Refer to the Micro USB Console Port page for more
information and to download the Windows driver or to
learn how to connect from a Mac computer.

9 LED status indicators Five LEDs that indicate the status of the firewall

hardware components (see PA-220R Status LEDs).

16 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Overview

©

2018 Palo Alto Networks, Inc.

PA-220R Back Panel

The following image shows the back panel of the PA-220R firewall. The only usable components on the
back panel are the two screw holes used to Install the PA-220R Firewall on a DIN Rail. There are also two
DIN-bracket screw holes (not shown) on the bottom of the firewall.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Overview 17

©

2018 Palo Alto Networks, Inc.

PA-220R Status LEDs

The following table describes how to interpret the status LEDs on the PA-220R firewall.

LED Description

PWR (Power) • Green—The firewall is powered on.

• Off—The firewall is not powered on or an error

occurred with the internal power system (for
example, power is not within tolerance levels).

ALRM (Alarm) • Red—A hardware failure, such as a power

supply failure, a firewall failure that caused an
HA failover, a drive failure, or if the hardware
overheated and exceeded the high temperature
threshold.

• Off—The firewall is operating normally.

STAT (Status) • Green—The firewall is operating normally.

• Yellow—The firewall is booting.

HA (High Availability) • Green—The firewall is the active peer in an

active/passive configuration.

• Yellow—The firewall is the passive peer in an

active/passive configuration.

• Off—HA is not operational on this firewall.

In an active/active configuration,
the HA LED indicates HA status for
only the local firewall and has two
possible states; it does not indicate
HA connectivity of the peer. Green
indicates that the firewall is either
active-primary or active-secondary
and off indicates that the firewall
is in any other state (for example,
non-functional or suspended).

TEMP (Temperature) • Green—The firewall temperature is normal.

• Yellow—The firewall temperature is outside

tolerance levels.

Ethernet

port LEDs

SFP LEDs These ports have one green LED:

• Left LED—Solid green indicates a network link.

• Right LED—Blinking green indicates network

activity.

• Solid green indicates a network link.

• Blinking green indicates network activity.

18 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Overview

Install the PA-220R Firewall

The PA-220R next-generation firewall ships with the hardware required to install the firewall
on a flat surface or on a DIN rail. You can also order a wall-mount kit to install the firewall on a
wall or a rack-mount kit to install the firewall in a 19” equipment rack.

> Install the PA-220R Firewall on a Flat Surface
> Install the PA-220R Firewall on a DIN Rail
> Install the PA-220R Firewall on a Wall
> Install the PA-220R Firewall in a 19-inch Equipment Rack

19

20 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall

©

2018 Palo Alto Networks, Inc.

Install the PA-220R Firewall on a Flat Surface

Attach the rubber pads to the recessed circles on the bottom of the firewall and then place the firewall
right-side up on a flat stable surface.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall 21

©

2018 Palo Alto Networks, Inc.

Install the PA-220R Firewall on a DIN Rail

The following procedure describes how to install the PA-220R firewall using the DIN rail kit that is provided
with the firewall. You can attach the DIN bracket to either the back or to the bottom surface of the firewall
(choose the option that best fits the installation site).

STEP 1 |

STEP 2 |

STEP 3 |

Attach a 35mm DIN rail (not included) to the wall where you will install the firewall.

Attach the DIN bracket to the back or bottom surface of the firewall using the DIN bracket
captive screws. Ensure that the spring-loaded clips on the DIN bracket are oriented so that
they will grasp the bottom of the DIN rail when you install it.

Engage the bottom of the DIN bracket (with spring-loaded clips) with the bottom part of the
DIN rail. Push the firewall and bracket upward to fully compress the spring-loaded clips against
the rail and then pivot the firewall toward the wall so that the top clips on the bracket will
grasp the top of the rail as you carefully lower the firewall to decompress the clips and secure
the firewall on the DIN rail.

22 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall

©

2018 Palo Alto Networks, Inc.

Install the PA-220R Firewall on a Wall

The following procedure describes how to install the PA-220R firewall on a wall using the wall-mount kit.

You can purchase the wall-mount kit separately from the Palo Alto Networks Sales Department or an
authorized reseller.

STEP 1 |

STEP 2 |

Identify the location where you will install the firewall and ensure there are no building services
(water, gas, or wiring) behind the wall.

Attach the wall-mount bracket to the bottom of the firewall using four 6-32 x 1/4” Phillips­head screws and torque each screw to 9 in-lbs.

STEP 3 |

Use a Phillips-head screwdriver to install the appropriate hardware to mount the firewall to the
wall based on the wall type:

To ensure proper heat dissipation, install the firewall so that the front panel (with ports
and LEDs) faces either left or right.

• Drywall—First hold the firewall up to the wall where you will install it and use a sharp object to

mark the wall behind the center of each of the four wall-mount bracket holes. Remove the firewall
and press a drywall anchor into the center of each of the four locations you marked and use your
screwdriver to apply pressure while turning the anchor clockwise until the surface of the anchor is
flush with the wall. Mount the firewall to the wall using four anchor screws.

• Plywood—Hold the firewall up to the wall where you will install it and then use a Phillips-head

screwdriver to mount the bracket to the wall using four 3/4” plywood screws.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall 23

©

2018 Palo Alto Networks, Inc.

24 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall

©

2018 Palo Alto Networks, Inc.

Install the PA-220R Firewall in a 19-inch
Equipment Rack

The following procedure describes how to install the PA-220R firewall in a two-post or four-post equipment
rack using the 19-inch rack-mount kit.

You can purchase the 19-inch rack-mount kit separately from the Palo Alto Networks Sales Department or
an authorized reseller. Refer to SKU PAN-PA-220R-RACK4 when ordering.

STEP 1 |

STEP 2 |

STEP 3 |

Place the firewall upside-down on a table with the front of the firewall hanging off the edge of
the table by about three inches.

Place the shelf upside down on top of the firewall and align the four holes on the bottom of
the shelf with the four screw holes on the bottom of the firewall. The front bezel of the firewall
protrudes out of the front opening of the shelf.

Secure the shelf to the firewall using four 6-32 x 1/4” Phillips-head screws and torque each
screw to 9 in-lbs.

STEP 4 |

Hold the shelf (with the firewall attached) right-side up in the rack and secure the shelf to the
rack using two screws for each side of the shelf. Use the appropriate screws (#10-32 x 3/4” or
#12-24 x 1/2”) for your rack and torque to 25 in-lbs. Use cage nuts (not provided) to secure
the screws if the rack has square holes.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall 25

©

2018 Palo Alto Networks, Inc.

The weight of the product is not enough to require mounting to the rear posts of the four­post rack.

26 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Install the PA-220R Firewall

Connect Power to a PA-220R Firewall

The following topics describe how to prepare the hardware that is required to connect power
to a PA-220R firewall and how to connect ground and DC power to the firewall.

> Prepare to Connect DC Power to a PA-220R Firewall
> Connect DC Power to a PA-220R Firewall

27

28 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Connect Power to a PA-220R Firewall

©

2018 Palo Alto Networks, Inc.

Prepare to Connect DC Power to a PA-220R
Firewall

Use the following information to gather and prepare the hardware that is required to Connect DC Power to

a PA-220R Firewall.

Due to the various cable lengths required for a given installation site, DC power and ground
cables are not included with the firewall.

Required Hardware

• 16-22AWG cable—Use this cable for the ground cable and DC power cables.

• 6-32 ring lug—Use this lug to connect a ground cable to the screw-on ground point on the firewall. You
can, instead, choose one of the DC terminal block ground inputs.

• Cable/wire strippers—Use this tool to strip the cable shielding off the ends of the DC power and ground
cables.

• Screwdrivers—Use these tools to attach the ground cable and DC power cables: use a Phillips-head
screwdriver for the screw-on ground point and a small flat-head screwdriver to secure cables to the DC
terminal block inputs.

Prepare for the Installation

STEP 1 |

STEP 2 |

STEP 3 |

STEP 4 |

Read PA-220R Electrical Specifications for power requirements.

Measure and cut the DC power cables and ground cable. Ensure that the DC power cables
reach from the firewall to your DC power source and that the ground cable reaches from the
firewall to your ground location.

You will need one ground cable and two DC cables (one for the positive connection and
one for the negative connection). To provide power redundancy for the firewall, prepare
two additional DC power cables to connect the second set of DC power inputs.

Prepare the ground cables using one of the following methods based on which ground location
you decide to use:

• Screw-on ground point (above the DC terminal block)—Strip 1/4-inch of cable shielding from the end

of the ground cable and crimp a 6-32 ring lug onto the end of the cable.

• DC terminal block ground input—Strip 1/4-inch of cable shielding from the end of the ground cable.

Strip 1/4-inch of cable shielding from the ends of each DC power cable that you will insert into
the DC terminal block.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Connect Power to a PA-220R Firewall 29

©

2018 Palo Alto Networks, Inc.

Connect DC Power to a PA-220R Firewall

The following procedure describes how to connect DC power to a PA-220R firewall. Before you connect
power, read the PA-220R Electrical Specifications and Prepare to Connect DC Power to a PA-220R

Firewall. The DC terminal block for connecting the DC power cables to the firewall is included in the

PA-220R accessories kit.

To avoid injury to yourself or damage to your Palo Alto Networks® hardware or the data that
resides on the hardware, read the Product Safety Warnings.

Power off the DC power sources that you will connect to the power supplies before you
continue.

STEP 1 |

STEP 2 |

Verify that the DC power source that will power the firewall is powered off.

In the following procedure, connect the DC power cables—and ground cable if you do
not use the screw-on ground point—to the DC terminal block before you attach the DC
terminal block to the firewall.

Connect one end of a 16-22AWG ground cable to the firewall and connect the other end to
earth ground. There are three ground locations on the firewall: one screw-on ground point
above the DC power inputs and two ground inputs on the DC terminal block (last two inputs to
the right of the DC inputs); use only one of the three ground locations even if you will connect
a second set of DC power cables for redundancy.

• Screw-on ground point (Option 1)—Remove the ground screw from the screw-on ground point, hold

the 6-32 ring lug (that you previously attached to the ground cable) over the screw hole, and then re­attach the screw to secure the cable to the firewall. Do not torque the screw to more than 6 in-lbs.

• DC terminal block ground inputs (Option 2)—Insert the cable into one of the two ground input

terminals and then secure the cable by turning the flat-head terminal screw clockwise. Do not torque
the terminal screws to more than 2 in-lbs.

STEP 3 |

Insert the positive DC cable into terminal A+ and secure the cable by turning the flat-head
terminal screw clockwise until tight. Insert the negative cable into terminal A- and secure the
cable using the terminal screw. Do not torque the terminal screws to more than 2 in-lbs.

30 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Connect Power to a PA-220R Firewall

©

2018 Palo Alto Networks, Inc.

STEP 4 |

(Optional) Repeat step 3 to connect a second DC power source to terminals B+ and B-.

STEP 5 |

STEP 6 |

Plug the cabled DC terminal block into the DC inputs on the firewall. Secure the terminal block
by turning the two screws on each side of the block clockwise and torque to 3 in-lbs.

Power on the DC power source to power on the firewall. The firewall powers on and the
power (PWR) LED turns green.

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Connect Power to a PA-220R Firewall 31

©

2018 Palo Alto Networks, Inc.

32 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | Connect Power to a PA-220R Firewall

PA-220R Firewall Specifications

The following topics describe the hardware specifications for the PA-220R firewall. For
feature, capacity, and performance information, refer to the PA-220R firewall datasheet.

> PA-220R Physical Specifications
> PA-220R Electrical Specifications
> PA-220R Environmental Specifications
> PA-220R Miscellaneous Specifications

33

34 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Specifications

©

2018 Palo Alto Networks, Inc.

PA-220R Physical Specifications

The following table describes PA-220R firewall physical specifications.

Specification Value

Dimensions and Rack units (U) Firewall Dimensions

2.0” H x 8.66” D x 9.25” W (5.08cm H x 22cm D x

23.5cm W)

The depth measurement includes
hardware that protrudes from the
front of the firewall. If the rubber
feet are installed on the bottom of
the firewall, add .78” (2cm) to the
height.

Rack Units

The following dimensions apply when the firewall
is installed in the PA-220R 19-inch rack kit:

• Rack units—2U

• Rack kit dimensions—3.5” H x 8” D x 19” W

(8.89cm H x 20.32cm D x 48.26cm W)

Weight • Firewall weight—4.5 lbs. (2.04kg)

• Shipping weight—6 lbs. (2.72kg)

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Specifications 35

©

2018 Palo Alto Networks, Inc.

PA-220R Electrical Specifications

The following table describes PA-220R firewall electrical specifications.

Input voltage must comply with Safety Extra Low Voltage (SELV) requirements and the
available input power must be limited to less than 100W as defined in IEC 60950-1.

Specification Value

Input voltage and current 12-24VDC 1.25A

Power consumption 13-16W

Maximum current consumption 1.25A@12VDC

Maximum inrush current 4.9A@12VDC

36 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Specifications

©

2018 Palo Alto Networks, Inc.

PA-220R Environmental Specifications

The following table describes PA-220R firewall environmental specifications.

Specification Value

Operating temperature range -40°F to 158°F (-40° to 70°C)

Non-operating temperature -40°F to 167°F (-40° to 75°C)

Humidity tolerance 5% to 90% non-condensing

Airflow The PA-220R firewall uses passive cooling and

does not contain fans.

Maximum BTU/hr 55BTU/hr

Acoustic noise Emits no sound

Maximum operating altitude 10,000ft (3,048m)

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Specifications 37

©

2018 Palo Alto Networks, Inc.

PA-220R Miscellaneous Specifications

The following table describes PA-220R firewall miscellaneous specifications.

Specification Value

Storage capacity One 32GB solid-state drive (SSD) for the PAN-OS

system files, system logs, and network traffic logs.

Mean time between failures (MTBF) 29 years

38 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Specifications

PA-220R Firewall Hardware Compliance
Statements Overview

Palo Alto Networks obtains regulatory compliance certifications to comply with the laws and
regulations in each country where there are requirements applicable to our products. Our
products meet standards for product safety and electromagnetic compatibility when used for
their intended purpose.

To view compliance statements for the PA-220R firewall, see PA-220R Firewall Hardware
Compliance Statements.

39

40 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Hardware Compliance

Statements Overview

©

2018 Palo Alto Networks, Inc.

PA-220R Firewall Hardware Compliance
Statements

The following are the PA-220R firewall hardware compliance statements:

• BSMI EMC Statement—User warning: This is a Class A product. When used in a residential environment
it may cause radio interference. In this case, the user will be required to take adequate measures.

• Manufacturer—Flextronics International.

• Country of Origin—Made in the USA with parts of domestic and foreign origin.

• CE (European Union (EU) Electromagnetic Compatibility Directive)—This device is herewith confirmed
to comply with the requirements set out in the Council Directive on the Approximation of the Laws of
the Member States relating to Electromagnetic Compatibility Directive (2014/30/EU).

The above product conforms with Low Voltage Directive 2014/35/EC and complies with the
requirements relating to electrical equipment designed for use within certain voltage limits.

• Federal Communications Commission (FCC) statement for a Class A digital device or peripheral—This
equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference in a residential installation. This equipment generates, uses, and can radiate radio frequency
energy and, if not installed and used in accordance with the instructions, may cause harmful interference
to radio communications. However, there is no guarantee that interference will not occur in a particular
installation. If this equipment does cause harmful interference to radio or television reception, which
can be determined by turning the equipment off and on, the user is encouraged to try to correct the
interference by one or more of the following measures:

• Reorient or relocate the receiving antenna.

• Increase the separation between the equipment and receiver.

• Connect the equipment to an outlet on a circuit that is different from the one to which the receiver is

connected.

• Consult the dealer or an experienced radio/TV technician for help.

• ICES (Canadian Department Compliance Statement)—This Class A digital apparatus complies with
Canadian ICES-003.

French translation: Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada.

• Korean Communications Commission (KCC) Class A Statement—This equipment is an electromagnetic
compatible device for business purposes (Class A). The provider or user should be aware that the
equipment is intended for use outside the home.

• Technischer Überwachungsverein (TUV)

Risk of explosion if battery is replaced by an incorrect type. Dispose of used battery
according to local regulations.

• VCCI—This section provides the compliance statement for the Voluntary Control Council for
Interference by Information Technology Equipment (VCCI), which governs radio frequency emissions in
Japan.

The following information is in accordance to VCCI Class A requirements:

PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Hardware Compliance Statements

Overview 41

©

2018 Palo Alto Networks, Inc.

Translation: This is a Class A product. In a domestic environment this product may cause radio
interference, in which case the user may be required to take corrective actions.

42 PA-220R NEXT-GEN FIREWALL HARDWARE REFERENCE | PA-220R Firewall Hardware Compliance

Statements Overview