HDD storage options on PA-5000 series Configuring RAID and disk backup on PA-5000 series April 2011 Palo Alto Networks 232 E. Java Dr. Sunnyvale, CA 94089 408.738.7700 www.paloaltonetworks.com

2010 Palo Alto Networks Page 2

Table of Contents Overview............................................................................................................................................. 3 HDD upgrade procedure .................................................................................................................... 3

Configuring RAID with two 120GB HDD ......................................................................................... 3 Upgrading from the standard 120GB to 240GB ............................................................................. 3 Configuring RAID with two 240GB HDD ......................................................................................... 6 Configuring RAID with 120GB and 240GB HDD ............................................................................ 6

Swapping drives between firewalls .................................................................................................... 8 Summary ............................................................................................................................................ 9

2010 Palo Alto Networks Page 3

Overview

The PA-5000 Series of enterprise firewalls is designed to protect data centers, large enterprise Internet gateways, and service provider environments where traffic demands dictate predictable firewall and threat prevention throughput. Traffic flows of up to 20 Gbps are effectively protected with more than 40 processors distributed across four functional areas: networking, security, content inspection and management. All PA-5000 series are equipped with 2 slots for SSD HDD. These models ship standard with a single 120GB SSD drive, which is field upgradeable. The following options of HDD is currently available on the PA-5000 series

Dual RAID 120GB SSDs, or Single 240 GB SSD or Dual RAID 240GB SSDs. Dual RAID 120GB and 240GB SSDs

.

HDD upgrade procedure

All PA-5000 series are shipped standard with a single 120GB SSD drive. In this section, we will discuss about the different upgrade options and procedures available on the PA- 5000 series. RAID 1 can be configured on the systems with two HDD.

Configuring RAID with two 120GB HDD

In order to configure RAID with standard 120GB HDD, power down the system, insert the second drive into the disk bay and power up the system. The system automatically does the data mirror in the background. Use the command show system raid detail to view the HDD status

Upgrading from the standard 120GB to 240GB

In order to upgrade from the standard 120GB HDD to 240GB, power down the system and insert the blank 240GB drive into the second drive bay. Power up the system. The system boots up and recognizes the second drive. The system then boots up in the maintenance mode. From the menu option select RAID.

Important: The HDD drives are not hot swappable. Ensure the firewall is powered off before changing the drives

2010 Palo Alto Networks Page 4

The following screen shows the information about the available HDD and data migration options.

In order to migrate from 120GB HDD to 240GB HDD, choose migrate drive 1 -> 2 option. This will initiate the migration process.

2010 Palo Alto Networks Page 5

The RAID migration status screen shown below is displayed once the migration is completed.

At this time, power off the system, remove the old drive and power on the system. The new 240GB drive can be left in the second disk bay. Once the device boots up, you can verify the disk space to confirm the 240GB HDD is use admin@PA-5060> show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/md2 3.8G 1.2G 2.5G 32% / /dev/md5 7.6G 562M 6.6G 8% /opt/pancfg /dev/md6 3.8G 401M 3.2G 11% /opt/panrepo tmpfs 1.8G 37M 1.7G 3% /dev/shm /dev/md8 198G 189M 188G 1% /opt/panlogs

2010 Palo Alto Networks Page 6

Configuring RAID with two 240GB HDD

After migrating from the 120GB HDD to 240GB HDD, you can install another 240GB HDD in the system. In order to configure RAID with standard 240GB HDD, power down the system, insert the second drive into the disk bay and power up the system. The system automatically does the data mirror in the background. Use the command show system raid detail to view the HDD status

Configuring RAID with 120GB and 240GB HDD

The system supports configuring RAID between disks of different sizes. In this case the 240GB HDD will be partitioned to use only 120GB of its capacity, loosing half its capacity. In order to set up RAID between the standard 120GB HDD and 240GB, power down the system and insert the blank 240GB drive into the second drive bay. Power up the system. The system boots up recognizes the second drive. The system then boots up in the maintenance mode. From the menu option select RAID

From the resulting screen choose RAID auto setup

2010 Palo Alto Networks Page 7

Once the RAID setup is completed, you must select a primary disk.

Choose the back option to setup the primary disk.

2010 Palo Alto Networks Page 8

Either one of the disk can be selected as the primary disk. The primary disk setting determines the source from which data will be copied from in the RAID setup. Once the primary disk is setup, reboot the device for the changes to take effect.

Use the show system raid command to view the RAID status.

admin@PA-5060> show system raid Overall RAID status Good ------------------------------------------------------------------------ Drive status Disk id 1 Present Disk id 2 Present admin@PA-5060>

Swapping drives between firewalls

The sequence of steps required to swap HDD from one PA-5000 to another is listed below. The firewalls must be powered off before you perform this swapping the drives

1. Remove all SSD drives from system #1 2. Insert all SSD drive to system #2 3. Power on system #2 4. System #2 may reboot once during the first boot with the new drives 5. System #2 will come up to its normal login prompt 6. Perform license migration for the new serial number

NOTE: Drive should always be moved as a group. So, if the original system has two drives, they should be moved together.

2010 Palo Alto Networks Page 9

Summary

The fundamental architecture of Palo Alto Networks next-generation firewalls is provide network security by enabling enterprises to see and control applications, users, and content not just ports, IP addresses, and packets using three unique identification technologies: App-ID, User-ID, and Content-ID. These features are complimented by robust hardware which is designed to provide separation of control plane and data plane This separation ensures highly available management, high speed logging and route updates, while the dataplane does all the security processing.

OverviewHDD upgrade procedureConfiguring RAID with two 120GB HDDUpgrading from the standard 120GB to 240GBConfiguring RAID with two 240GB HDDConfiguring RAID with 120GB and 240GB HDD

Swapping drives between firewallsSummary