FortiGate-5144C Chassis Guide

Transcription

1 FortiGate-5144C Chassis Guide

2 FORTINET DOCUMENT LIBRARY FORTINET VIDEO GUIDE FORTINET BLOG CUSTOMER SERVICE & SUPPORT FORTIGATE COOKBOOK FORTINET TRAINING SERVICES FORTIGUARD CENTER END USER LICENSE AGREEMENT FEEDBACK Thursday, June 16, 2016 FortiGate-5144C - Chassis Guide

3 TABLE OF CONTENTS FortiGate-5144C Chassis 6 FortiGate-5144C front panel 6 FortiGate-5144C back panel 7 Chassis hardware information 8 Shipping components 9 Accessories 9 Supported Fortinet ATCA boards 9 Power requirements 11 Physical description of the FortiGate-5144C chassis 11 FortiGate-5144C shelf managers 12 Connecting to the Shelf manager and shelf manager Ethernet channels 13 Shelf manager Ethernet connections to chassis slots (and boards) 14 Changing the shelf manager switch configuration to prevent Ethernet loops 14 Radial IPMB bus topology 16 Using the shelf manager CLI 17 Shelf Manager fan and power control 17 Telco alarms 17 Air Filter 19 Cooling fans, cooling air flow, and minimum clearance 19 FortiGate-5144C hardware procedures 21 Mounting the FortiGate-5144C chassis 21 Air flow 22 Inserting FortiGate-5000 series boards and RTM modules 22 Installing FortiController or FortiSwitch boards 23 Power connection and configuration 24 FortiGate-5144C chassis power level requirements 24 Connecting the FortiGate-5144C chassis to DC power and ground 25 Crimping guidelines 26 Connecting FortiGate-5144C power feeds to DC power 27 Connecting the FortiGate-5144C chassis to ground 28 FortiGate-5053B power supply shelf and PSU-5000B power supplies 29 Power requirement guidelines 31 Connecting a FortiGate-5144C chassis to the FortiGate-5053B power supply shelf 31 Connecting the FortiGate-5053B power supply shelf to ground 33

4 Turning on FortiGate-5144C chassis power 34 Shelf Manager CLI 35 Connecting to the shelf manager CLI using the shelf manager console port 35 Connecting to the shelf manager CLI from an Ethernet network 36 Changing the shelf manager root account password 37 Resetting a lost shelf manager password 37 The shelf manager command line interface agent (CLIA) 38 Using CLIA interactive mode 38 IPMB addresses, logical and physical slot numbers, and FRU ids 38 Change IP address of the primary Shelf Manager 40 Display the shelf manager firmware version 40 List all FRUs in the chassis 41 List all sensors on a FRU 41 List only sensors that are outside of established thresholds 41 Display sensor data for a FRU 41 Display the FRU information for a FRU 41 Change the speed for a fan tray 41 Display the contents of the system event log (sel) 41 Clear the system event log (sel) 41 Changing the shelf manager IP address and default gateway 42 Sensor types 43 CLI command Reference 43 activate/deactivate 43 alarm 44 board 44 clia 46 exit/quit 46 fans 46 fru 47 fruinfo 47 getlanconfig 48 getthreshold/threshold 49 help 51 minfanlevel 54 sel 54 sensor 56 sensordata 56 setthreshold 57 shmstatus 58 showunhealthy 59 switchover 59 terminate 60

5 user 60 version 62 Generating SNMP traps for shelf manager system events 62 Example SNMP configuration 62 Testing the configuration 66 SNMP trap details 66 Removing and inserting a fan tray 68 Setting up SNMP polling for the shelf manager 68 Using the shelf manager system event log (SEL) 69 Before you begin 69 Chassis Design Background 69 Alarm LEDs 70 Reading the SEL 70 Clearing SEL logs 71 Example IPMC log output 71 Example FRU log output 73 Example sensor log output 74 Sample sections of SEL Output 86 Regulatory notices, cautions and warnings 88 Federal Communication Commission (FCC) USA 88 Industry Canada Equipment Standard for Digital Equipment (ICES) Canada 88 Voluntary Control Council for Interference (VCCI) Japan 88 Bureau of Standards Metrology and Inspection (BSMI) Taiwan 88 China 89 European Conformity (CE) - EU 89 Environmental specifications 89 Safety 90

6 FortiGate-5144C front panel FortiGate-5144C Chassis FortiGate-5144C Chassis You can install up to 14 FortiGate-5000 series boards in the 14 slots of the FortiGate-5144C ATCA chassis. The FortiGate-5144C is a 14U 19-inch rackmount ATCA chassis that contains four redundant hot swappable DC power entry Modules (PEMs). The PEMs connect to -48V DC power and supply 400 W to each chassis front slot. The FortiGate-5144C chassis also includes four hot swappable cooling fan trays that provide 450W of cooling power per slot and a front replaceable air filter with redundant pressure sensors. If all 14 slots containfortigate- 5001D boards, the FortiGate-5144C chassis provides a total of 28 FortiGate 40-gigabit Ethernet interfaces and 28 FortiGate 10-gigabit interfaces. Using the dual dual star 40-gigabit fabric and 1-gigabit base backplane interfaces the FortiGate-5144C chassis can support a wide range of different configurations. For example: Up to 14 FortiGate-5001D boards in chassis slots 1 to 14, each board operating as a separate FortiGate firewall. One or two FortiController-5913C boards in chassis slots 1 and 2 in a dual-star configuration to support a 100 Gbps session-aware load balancing cluster (SLBC) that distributes traffic to up to 12 FortiGate-5001D boards (called workers) installed in chassis slots 3 to 14. One or two FortiController-5903C boards to support a 40 Gbps SLBC with up to 12 FortiGate-5001D workers. One or two FortiController-5913C or FortiController-5903C boards in chassis slots 1 and 2 can also be used for FortiGate-5144C fabric and base backplane switching and to support FGCP clustering. In the future, the FortiGate-5144C will support using four FortiController-5913C or FortiController-5903C boards in chassis slots 1 to 4 in a dual dual star SLBC with up to ten FortiGate-5001D workers. Two FortiController-5103B boards can be installed in slots 1 and 2 to create an SLBC for FortiGate-5001D (or older) workers. FortiController-5103B boards can also be used for fabric and base backplane switching and to support FGCP clustering. Two FortiController-5902D boards can be installed in slots 1 and 2 to support content clustering to load balance traffic to multiple FortiGate-5001D workers. The FortiGate-5144C chassis requires -48V DC power. If DC power is not available you can install a FortiGate- 5053B power supply shelf and PSU-5000B power supplies (purchased separately). FortiGate-5144C front panel The following illustration shows the front of a FortiGate-5144C chassis containing two FortiController-5903C boards are installed in slots 1 and 2 and 12 FortiGate-5001D boards installed in slots 3 to 14. These components are also visible on the front of the FortiGate-5144C chassis: The primary and secondary Shelf Managers. Fortinet ships thefortigate-5144c chassis with the primary shelf manager installed. You can purchase and install a secondary shelf manager for redundancy. The shelf manager provides power allocation, cooling, alarms, shelf status, displays alarms and includes a telco alarm interface. The location of the front-replaceable air filter frame and retention screws. The location of hot swappable fan trays 1 and 2 (can be accessed by opening the top cover at the front of the chassis). The Electrostatic discharge (ESD) socket, used for connecting an ESD wrist band when working with the chassis. 6 FortiGate-5144C Chassis Guide

7 FortiGate-5144C Chassis FortiGate-5144C back panel Do not operate the FortiGate-5144C chassis with open slots on the front or back panel. For optimum cooling performance and safety, each chassis slot must contain either a FortiGate-5000 series board or an air baffle slot filler. For the same reason, all cooling fan trays and the air filter should be installed while the chassis is operating. As well all four PEMs (two primary and two redundant) must be installed in the back of the chassis. Example FortiGate-5144C front panel Fan Tray 1 (front) Fan Tray 2 (front) FortiController-5903C boards slots 1 and 2 FortiGate-5001D boards slots 4, 6, 8, 10, 12, and 14 FortiGate-5001D boards slots 3, 5, 7, 9, 11, and 13 Slot numbers Air filter frame ESD socket Primary Shelf Manager Secondary Shelf Manager FortiGate-5144C back panel The FortiGate-5144C chassis back panel includes access to hot swappable fan trays 3 and 4. The FortiGate-5144C chassis back panel includes four -48V to -60 VDC power entry modules (PEMs). Fortinet ships the FortiGate-5144C chassis with all four installed. The PEMs are divided into two power feeds. PEMs 1 and 2 make up feed A. PEMs 3 and 4 make up power feed B. To provide power to the chassis you must connect the PEMs in feed A. To provide redundant power you can also connect the PEMs in feed B. FortiGate-5144C Chassis Guide 7

8 Chassis hardware information FortiGate-5144C Chassis Each PEM has two power feeds (feed 1 and feed 2) that include a -48V/-60 VDC terminal (labeled -) and a RTN terminal (labeled +). To connect a PEM, both of its feeds must be connected to DC power. The back panel also contains 14 RTM slots numbered to correspond to the front panel slots. When the chassis is shipped, these slots are covered by RTM air baffle slot covers. The back panel includes the FortiGate-5144C chassis ground connector that must be connected to ground. Example FortiGate-5144C chassis back panel Fan Tray 4 (back) Fan Tray 3 (back)!! RTM slot numbers RTM air baffle slot covers PEM 4 Feed B PEM 3 Chassis ground connector PEM 2 Feed A PEM 1 Chassis hardware information This section introduces FortiGate-5144C hardware components and accessories including power requirements and FortiGate-5000 series boards that can be installed in the chassis. 8 FortiGate-5144C Chassis Guide

9 FortiGate-5144C Chassis Chassis hardware information Shipping components The FortiGate-5144C chassis ships pre-assembled with the following components: The 14U FortiGate-5144C chassis One shelf manager installed in the front of the chassis Four Power Entry Modules (PEMs) installed in the back of the chassis One air filter installed behind the air intake bezel at the bottom of the chassis Four cooling fans installed in the fan bays at the top of the chassis 13 front panel air baffle slot covers installed in the front panel slots 14 RTM air baffle slot covers installed in the RTM slots Eight 4-ft. power cables with 8 AWG stranded wires and double-hole lugs: Black for -48VDC and red for RTN. These cables should only be used to connect the FortiGate-5144C PEMs to a FortiGate-5053B power convertor shelf if purchased with your FortiGate-5144C chassis Rack mount template (labeled metal strips showing how to line up cage nuts with rack holes when installing the chassis) 5 spare nuts and washers for the PEM power studs 20 cage nuts with M6 screws 1 Philips No.2 screw driver 1 flat (4mm) screw driver 1 socket wrench (10mm) Cage nut installation tool Accessories Supported Fortinet ATCA boards Shelf Manager Shelf FRU data module Supported Fortinet ATCA boards You can install the following FortiGate-5000 series boards in a FortiGate-5144C chassis to provide security services. The FortiGate-5144C chassis has been added to the FortiGate-5000 product family to support recent and future FortiGate-5000 series boards with high power requirements. This includes the following: ATCA board Interfaces Function Power Used (WDC)* Heat Dissipation (BTU/hr)* FortiGate-5001B Front Panel: 8 x 10 Gbps Fabric: 10 Gbps FortiOS network security Max: 225 Ave: FortiGate-5001C Front Panel: 2 x 10 Gbps Fabric: 10 Gbps FortiOS network security Max: 225 Ave: FortiGate-5144C Chassis Guide 9

10 Chassis hardware information FortiGate-5144C Chassis ATCA board Interfaces Function Power Used (WDC)* Heat Dissipation (BTU/hr)* FortiGate-5101C Front Panel: 4 x 10 Gbps Fabric: 10 Gbps FortiOS network security Max: 236 Ave: FortiGate-5001D Front Panel: 2 x 40 Gbps, 2 x 10 Gbps, or split into 8 x 10 Gbps Fabric: 40 Gbps or 10Gbps FortiOS network security Max: 226 Ave: FortiSwitch-5203B Front Panel: 8 x 10 Gbps Fabric: 10 Gbps Content clustering with FortiGate-5001Bs Max: 250 Ave: FortiController-5902D Front Panel: 4 x 40 Gbps or split into 16 x 10 Gbps Fabric: 40 Gbps or 10 Gbps Content clustering with FortiGate-5001Ds Max: 270 Ave: FortiSwitch-5003B Front Panel: 8 x 10 Gbps Fabric: 10 Gbps Backplane switching, FGCP HA, and extended load balancing (ELBC) Max: 180 Ave: FortiController-5103B Front Panel: 8 x 10 Gbps, or 8 x 1 Gbps Fabric: 10 Gbps or 1 Gbps Session-aware load balancing Clustering (SLBC) and FGCP HA Max: 255 Ave: FortiController-5903C Front Panel: 4 x 40 Gbps or split into 16 x 10 Gbps Fabric: 40 Gbps or 10 Gbps Session-aware Load Balancing Clustering (SLBC) and FGCP HA Max: 400 Ave: FortiController-5913C Front Panel: 2 x 100 Gbps or split into 20 x 10 Gbps Fabric: 40 Gbps or 10 Gbps Session-aware Load Balancing Clustering (SLBC) and FGCP HA Max: 400 Ave: *Approximate values, see product datasheets for official values. Any Fortinet ATCA board can be installed in the FortiGate-5144C chassis including the following older models: FortiGate-5001A FortiCarrier-5001A FortiGate-5005FA2 FortiGate-5001FA2 FortiGate-5001 FortiGate RTM-XB2 FortiGate RTM-XD2 FortiSwitch-5003A 10 FortiGate-5144C Chassis Guide

11 FortiGate-5144C Chassis Chassis hardware information Power requirements The FortiGate-5144C is rated to draw up to 153A. Each of the four PEM feeds/terminals draws up to 39A with - 48VDC input and 450W/slot (400W front and 50W RTM). If no RTM slots are used, the total current will be up to 138.5A and with up to 35A per feed with -48VDC input. (the draw from the 4 feeds may not be even.) The FortiGate-5144C chassis is designed to be installed in a Telecom or data center or similar location that has available -48VDC power fed from a listed circuit breaker (also called battery power or main DC power). Fortinet expects that mostfortigate-5144c customers will be installing their chassis in a location that is already equipped with a -48VDC power system fed from a listed circuit breaker that provides power to existing networking or telecom equipment. The FortiGate-5144C chassis is designed to be connected directly to this DC power system. If DC power is not available you can use one or more FortiGate-5053B power converter shelves equipped with PSU-5000B power supplies to convert AC to DC to supply DC power to the FortiGate-5144C chassis from an AC source. Physical description of the FortiGate-5144C chassis The FortiGate-5144C chassis is a 14U chassis that can be installed in a standard 19-inch rack. The following table describes the physical characteristics of the FortiGate-5144C chassis. Dimensions (H x W x D) Shipping weight and size completely assembled with packaging Chassis weight completely assembled with shelf manager and air baffles PEM DC terminal torque Operating environment x x in. (62.10 x x cm) 165 lbs (75 kg) (36 x 31 x 27in) (91 x 78 x 69cm) (13 front and 14 RTM) 108 lbs (50 kg) No more than 3.8 Nm (33.62 lbf.in) Temperature (long term): 32 to 104 F (0 to 40 C) Temperature (short term): 23 to 131 F (-5 to 55 C) Relative humidity: 20 to 90% (Non-condensing) Power consumption Heat Dissipation Power input Overcurrent Protection Min: 150W, Max: 1000 W (Power consumed by an empty chassis with four fans, one shelf manager and four PEMs installed and operating with the fans running at full speed.) 150W to 1000W (512 BTU/hr and max 3412 BTU/hr) 4x to 2 PEMs (2 per PEM) with 2x redundant PEMs -48 Vdc/- 60Vdc, 153A/122A Each PEM includes 4 power channels. Each channel includes its own 30 A fuse. Cooling Capacity 450 W per slot (Front slot 400 W and RTM slot 50 W) FortiGate-5144C Chassis Guide 11

12 FortiGate-5144C shelf managers FortiGate-5144C Chassis Protected Earth Test Hipot Test EN , test current 25 A, resistance <100 mohm EN , 1000 V FortiGate-5144C shelf managers The FortiGate-5144C chassis includes one or two redundant hot-swappable shelf managers, located in the dedicated shelf manager slots at the bottom of the front panel. The primary shelf manager is installed on the left the secondary shelf manager (if present) is installed on the right. The secondary shelf manager is optional. FortiGate-5144C shelf manager front panel Retention Screw Out of Service (Red), Active (Green), and Hot Swap (Blue) LEDs RS-232 Serial Ethernet Interface Telco Alarm Interface Alarm Cut Off Button Retention Screw Hot Swap Button Fan Tray Reset LEDs Button Backplane Ethernet Link LEDs Critical Alarm (Red) Major Alarm (Red) Minor Alarm (Amber) Power OK (Green) Fortinet ships the FortiGate-5144C chassis with the primary shelf manager installed. You can purchase a secondary shelf manager for redundancy. If your chassis has two shelf managers, they support redundant operation with automatic switchover. If both shelf managers are operating normally, one acts as the active shelf manager and the other as the backup. You can tell which shelf manager is active by the state of the shelf manager front panel ACT(Active) LED. This LED is solid green for the active shelf manager and flashing green for the backup shelf manager. The active shelf manager performs all shelf manager functions. The shelf managers monitor each other and if the active shelf manager stops communicating (for example because it has failed or is restarting) the backup shelf manager becomes the active shelf manager. When the failed or restarting former active shelf manager comes back up it will detect that the other shelf manager is active and become the backup shelf manager. Also, if one shelf manager fails or is removed the other will operate independently as the active shelf manager and the chassis will continue to function normally. The active Shelf Manager communicates with Intelligent Platform Management Controllers (IPMCs) in the chassis, each of which is responsible for local management of one or more Field Replaceable Units (FRUs), such as boards, fan trays or power entry modules. Management communication within a chassis occurs primarily over the Intelligent Platform Management Bus (IPMB), which is implemented using radial bus technology. The active shelf manager controls chassis power allocation, monitors chassis operating parameters, monitors and controls chassis cooling, and generates alarms if the chassis encounters problems. The active shelf manager also displays alarms and includes a telco alarm interface. All FortiGate-5000 boards installed in the chassis communicate with the active Shelf Manager through the IPMCs. 12 FortiGate-5144C Chassis Guide

13 FortiGate-5144C Chassis FortiGate-5144C shelf managers The shelf managers are hot swappable. You remove a shelf manager by pressing and holding the hot swap button. The hot swap LED starts blinking blue. When the hot swap LED turns solid blue you can loosen both retention screws and remove the shelf manager from the chassis. Connecting to the Shelf manager and shelf manager Ethernet channels Each shelf manager has an RS-232 serial port for connecting to the shelf manager console CLI. For information about using this port, see Connecting to the shelf manager CLI using the shelf manager console port on page 35. Each shelf manager also includes an Ethernet switch that connects the shelf manager front panel Ethernet interface and the shelf manager base channel backplane Ethernet interface. The switch has two Ethernet channels, ETH0 and ETH1: ETH0 connects to the shelf manager Ethernet switch. This switch splits ETH0 into 2 independent channels. One channel connects to both shelf manager front panel Ethernet interfaces and the other connects to the chassis backplane base channel SH1. ETH1 connects the Shelf manager directly to the chassis backplane base channel SH2. Shelf Manager Ethernet switch and ETH0 and ETH1 architecture The factory default shelf manager ETH0 port IP address is You can change this IP address from the shelf manager CLI. If your chassis has one shelf manager it will be installed in the primary shelf manager slot and you can communicate with it by connecting the shelf manager's front panel Ethernet interface (ETH0) or to the B1 or B2 interface of a hub or switch board installed in chassis slot 1 or 2. If your chassis has two shelf managers (one in the primary shelf manager slot and one in the secondary shelf manager slot) either one of them can be the active shelf manager. From an external device you can only connect to the active shelf manager. You should connect the front panel Ethernet interface (ETH0) of both shelf managers to your network. That way, no matter which shelf manage is active you can still connect to the active shelf manager using the shelf manager IP address (default ). You can change the active Shelf Manager's IP address from the shelf manager CLI. You can also connect to the active shelf manager from the B1 or B2 interface of a hub or switch board installed in chassis slot 1 or 2 You cannot connect to the backup shelf manager from an external device and you normally don't have to. However, if you want to connect to the backup shelf manager you can log into the active shelf manager and then Telnet to This is the fixed internal IP address of the backup shelf manager and is normally only used to allow communication between the active and backup shelf managers. FortiGate-5144C Chassis Guide 13

14 FortiGate-5144C shelf managers FortiGate-5144C Chassis If a failover occurs the active shelf manager's IP address will be transferred to the new active shelf manager. The new backup shelf manager will have the internal IP address of Shelf manager Ethernet connections to chassis slots (and boards) The following diagram shows how the shelf managers connect to the chassis slots. Each shelf manager has two connections to the chassis; one to each of the hub slots. ETH0 connects to SH1 of one chassis slot and ETH1 connects to SH2 of the other chassis slot. Shelf Manager Ethernet cross-connections and connections to chassis slots Changing the shelf manager switch configuration to prevent Ethernet loops Because ETH0 connects to both shelf manager front panel Ethernet interface and to the chassis backplane base channel via the shelf manager onboad Ethernet switch, it is possible to create an Ethernet loop if you connect the 14 FortiGate-5144C Chassis Guide

15 FortiGate-5144C Chassis FortiGate-5144C shelf managers shelf manager front panel interfaces and the B1 or B2 interface of a switch board in slot 1 or 2 to same network. So connecting these interfaces to the same network is not recommended. The most recent version of the shelf manager firmware (version G) is factory set to disable the connection between the shelf manager switch and the backplane. This means that you must connect to the shelf manager front panel Ethernet interface to manage the shelf manager. This also means that if you connect the shelf manager front panel interfaces and the B1 or B2 backplane to the same network you will not get looping. Firmware version G includes the ShMC_Eth_Switch_config command that can be used to change the switch configuration. The command has four options: get_eeprom_config displays the current switch configuration. set_default_eeprom sets the switch to the default switch configuration. The default configuration enables BOTH the front panel and the backplane interfaces. disable_backplane_port disables the connection to the backplane. This option is factory set by Fortinet. disable_front_panel_port disables the connection to the front panel Ethernet interface. Entering these commands (except for get_eeprom_config) reboots the shelf manager. If your chassis has two shelf managers if you enter one of these commands to change the configuration you must enter the command on each shelf manager. When you enter a command the active shelf manager reboots and while this is happening the backup shelf manager becomes the active shelf manager. FortiGate-5144Cshelf manager LEDs LED State Description FT1-4 OOS (Fan Tray 1-4 out of service) Off Red Fan tray 1 to 4 is operating normally. Fan tray 1 to 4 is out of service. OOS (Out of Service) Off Normal Operation. Red Shelf manager software reboot or other failure. ACT (Active) Solid Green Indicates that this is the active shelf manager. Blinking Green Indicates that this is the backup shelf manager. H/S (Hot Swap) Off Normal operation. Blinking Blue Blue The shelf manager is shutting down in preparation for being removed from the chassis. The shelf manager can be removed from the chassis. LA2 (backplane port 1) Green Backplane ethernet port 1 connected. Blinking Network activity on backplane ethernet port 1. FortiGate-5144C Chassis Guide 15

16 FortiGate-5144C shelf managers FortiGate-5144C Chassis LED State Description LS2 (backplane port 1) LA1 (backplane port 0) LS1 (backplane port 0) 10/100 (Front panel ethernet port) L/A (Front panel ethernet port) Amber 100 Mbit Link on backplane ethernet port 1. Off 10 Mbit Link on backplane ethernet port 1. Green Link on backplane ethernet port 0. Blinking Network activity on backplane ethernet port 0. Amber 100 Mbit Link on backplane ethernet port 0. Off 10 Mbit Link on backplane ethernet port 0. Amber 100 Mbit link on Front Panel Ethernet Port 0. Off 10 Mbit link on Front Panel Ethernet Port 0. Green Front Panel Ethernet Port 0 connected. Blinking Network activity on Front Panel Ethernet Port 0. CRITICAL (Major Alarm) Red Critical alarm detected in chassis. MAJOR (Major Alarm) Red Major alarm detected in chassis. MINOR (Minor Alarm) Amber Minor alarm detected in chassis. POWER OK Green Input power to the chassis is within limits. FortiGate-5144Cshelf manager Buttons Button H/S (Hot Swap) RST (Reset) CUTOFF (Telco Alarm Cut Off) Description Start the hot swap procedure. Push and the H/S LED blinks. Hold until H/S is solid blue then remove shelf manager. Reset the shelf manager. Reset alarm contacts when alarm LEDs are blinking. Radial IPMB bus topology The FortiGate-5144C backplane includes a redundant dual star radial IPMB bus for higher reliability. Each shelf manager provides 14 unique IPMB0-A and 14 unique IPMB0-B links to the 14 chassis slots. This means 28 IPMB channels per shelf manager. The radial topology is shown below. 16 FortiGate-5144C Chassis Guide

17 FortiGate-5144C Chassis FortiGate-5144C shelf managers Radial IPMB bus topology Using the shelf manager CLI You can use the shelf manager command line interface (CLI) to communicate with the intelligent management controllers of the chassis, with boards in the chassis, and with the shelf manager itself. The CLI is an IPMI-based set of commands that can be accessed directly or through a higher-level management application or a script. Using the CLI, you can access information about the current state of the chassis including current board population, current sensor values, threshold settings, recent events, and overall chassis health. To get started using the shelf manager CLI, see"shelf Manager CLI" on page 35. Shelf Manager fan and power control The FortiGate-5144C shelf managers monitor the internal temperature of the chassis and adjust the operating speed of the cooling fans as required. When the chassis is first powered on all cooling fans run at full speed. Once the shelf manager is up and running, the shelf manager reduces cooling fan speeds to maintain an optimum temperature in the chassis. If shelf managers are not installed or not operating correctly the FortiGate-5144C chassis cooling fans always operate at full speed. Telco alarms The Telco Alarm Interface is a standard DB-15 male Telco Form-c connector. The external dry relay Telco alarm interface (48VDC) provides Telco form-c relay connections for minor, major and critical power faults. The cable required to connect to the alarm interface is not supplied by Fortinet. To monitor alarms you should connect to the telco alarm interface of the active shelf alarm panel, which by default is the one on the left. The Telco alarm interface relay circuits are capable of carrying 60 VDC or 1 A with a max. rating of 30 VA. The shelf alarm panel accepts timed pulse inputs for clearing minor and major alarm states. Reset is accomplished by asserting a voltage differential from 3.3 V to 48 V for between 200 and 300 ms. The acceptance voltage range is from 0 to 48 VDC continuous (handles up to 60 VDC at a 50% duty cycle). The current drawn by a reset input does not exceed 12 ma. FortiGate-5144C Chassis Guide 17

18 FortiGate-5144C shelf managers FortiGate-5144C Chassis The alarm LED reset button activates the alarm cutoff (ACO) state for major, minor, and user-defined alarms. You cannot reset critical alarms with the alarm LED reset button. When the ACO state is activated, active alarm LEDs blink and all of the alarm relays are deactivated. The alarm reset button activates the ACO state but does not clear the alarm completely. The telco alarm connector (DB-15 male) Telco alarm connector pin assignment Pin Descrption 1 MinorReset+ 2 MinorReset- 3 MajorReset+ 4 MajorReset- 5 CriticalAlarm - NO 6 Critical Alarm NC 7 Critical Alarm COM 8 Minor Alarm NO 9 Minor Alarm NCT 10 Minor Alarm COM 11 Major Alarm NO 12 Major Alarm NC 13 Major Alarm COM 14 Power NO 15 Power COM 18 FortiGate-5144C Chassis Guide

19 Left Right FortiGate-5144C Chassis Air Filter Air Filter The FortiGate-5144C chassis includes a front replaceable air filter that removes dust from intake air and provides static pressure to achieve uniform airflow. The filter must be installed for the chassis to operate normally. If the air filter is not locked into place the air filter presence sensors cause an alarm. The air filter should be inspected regularly. If dirty or damaged, the filter should be disposed of and replaced. The air filter can be fragile and should be handled carefully. To service the air filter you must loosen two the air filter frame retention screws at the bottom of the front of the chassis. Tilt down the air filter frame and remove the air filter material. Care should be taken when inserting an new air filter to prevent damage to the sensors. To insert a new filter, slide it into the frame using the guides at each side of frame until the filter contacts springs at the back of the chassis. Then tilt the frame up and tighten the retention screws. Cooling fans, cooling air flow, and minimum clearance The FortiGate-5144C chassis contains four hot-swappable cooling fans (fan 1 to fan 4) installed in the fan cabinet at the top of the chassis. Two fans are access able from the front of the chassis and two from the back. Fan tray locations (top view of chassis) Back of Chassis Fan 3 Fan 4 Fan 1 Fan 2 Front of Chassis Front and back fan trays!! Front Fan Tray (Fan Trays 1 and 2) Back Fan Tray (Fan Trays 3 and 4) FortiGate-5144C Chassis Guide 19

20 Cooling fans, cooling air flow, and minimum clearance FortiGate-5144C Chassis To service the front fan trays (fan trays 1 and 2), open the front fan cabinet. The back fan trays (fan trays 3 and 4), are accessible from the back of the chassis. The fan trays are hot swappable. You do not need to press a hot swap switch to remove a fan. Just pull a fan out of the chassis and replace it. The shelf manager regulates the fan speed by adjusting the DC voltage supplied to the fan trays. FortiGate-5144C fan tray LEDs LED H/S (Hot Swap) OOS (Out of Service) ACT (Active) Description Normally off. Blinking blue indicates that the fan is starting up. Normally off. Blinking red indicates the fan is out of service and should be replaced. Normally solid green. Indicates the fan is operating normally. When installing the chassis, make sure there is enough clearance for effective cooling air flow. The following diagram shows the cooling air flow through the chassis and the locations of the air filter and cooling fans. Make sure the cooling air intake and warm air exhaust openings are not blocked by cables or rack construction because this could result in cooling performance reduction and possible overheating and component damage. Cooling air flow, fan locations, and required minimum air flow clearance 40 mm Fan Warm air Exhaust Fan 100 mm Front 60 mm Back Cool air Intake Air Filter 600 mm 600 mm 20 FortiGate-5144C Chassis Guide

21 FortiGate-5144C hardware procedures Mounting the FortiGate-5144C chassis FortiGate-5144C hardware procedures This chapter describes how to mount the FortiGate-5144C chassis and how to install FortiGate-5000 boards in the chassis. Mounting the FortiGate-5144C chassis Mount the FortiGate chassis in a rack before installing the FortiGate-5000 boards. The FortiGate-5144C chassis must be mounted in a standard 19-inch rack. The chassis can be mounted in a 4- post rack using the rack mount brackets in the standard front mounting position as they are installed the chassis when it is shipped. If you choose to mount the chassis in a 2-post rack you need to move the rack mount brackets to the mid mount position. Rack mount bracket standard front mount position mm mm Rack mount bracket mid-mount position The chassis requires 14U of vertical space in the rack. You can use the rack mount template included with the chassis to line up cage nuts with mounting holes before mounting the chassis. If you install the FortiGate-5144C chassis in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient temperature. Make sure the operating ambient temperature does not exceed the manufacturer's maximum rated ambient temperature. FortiGate-5144C Chassis Guide 21

22 Inserting FortiGate-5000 series boards and RTM modules FortiGate-5144C hardware procedures The FortiGate-5144C chassis should not be operated as a free-standing appliance. It is recommended that you mount the FortiGate-5144C chassis near the bottom of the rack to avoid making the rack top-heavy and potentially falling over. If you are going to mount the chassis higher make sure the rack is well anchored. Since the chassis is over 100 lbs use a lift to raise the chassis into position before mounting it. Air flow For rack installation, make sure that the amount of air flow required for safe operation of the FortiGate-5144C chassis is not compromised. Make sure that the chassis ventilation openings at the top rear and the bottom front are not blocked by cables or other components. The recommended minimum clearance at the front of the chassis is 100 mm and the recommended clearance from the rear of the chassis is 60 mm. This results in a total footprint of 600 mm from front to back. See Cooling fans, cooling air flow, and minimum clearance on page 19 for more details. Inserting FortiGate-5000 series boards and RTM modules You can insert FortiGate and FortiSwitch-5000 series boards into the front of the FortiGate-5144C chassis and RTM modules into the back of the chassis. Arrange the boards and modules in slots as required for your configuration. FortiGate-5000 series boards can be installed in any FortiGate-5144C front panel slots. FortiController and FortiSwitch boards can only be installed in switch slots 1 and 2. FortiController boards can also be installed in slots 3 and 4 for a dual dual star configuration. FortiGate-5000 series RTM modules can be installed in any FortiGate-5144C RTM slot. All FortiGate-5144C chassis are shipped with air baffle filler panels/cards on all but one front slot that include a warning message to read the FortiGate-5000 documentation before installing your product. The temporary slot fillers must be removed and all slots filled; either with FortiGate-5000 series boards or with air baffle slot fillers. Air baffle slot fillers are similar to blank FortiGate-5000 boards and are required for proper cooling air flow. All FortiGate-5000 series boards must be protected from static discharge and physical shock. Only handle or work with these boards at a static-free workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist strap when handling these boards. Do not operate the FortiGate-5144C chassis with open slots on the front panel or rear panel. For optimum cooling performance and safety, front panel slots must contain a FortiGate-5000 series module or an air baffle slot filler and rear panel slots must either be covered or must contain a rear transition module or slot filler. To avoid damaging components, you should install RTM modules (such as the FortiGate-RTM-XD2 module) first before you install the corresponding FortiGate front panel board. If you have already installed a FortiGate board, you should remove it before installing the RTM module. To install FortiGate-5000 boards or RTM modules, see the documentation supplied with the board or module. 22 FortiGate-5144C Chassis Guide

23 FortiGate-5144C hardware procedures Installing FortiController or FortiSwitch boards Installing FortiController or FortiSwitch boards FortiController and FortiSwitch boards are always installed in chassis in slots 1 or 2 to provide fabric and base backplane load balancing or switching. The dual dual-star 40-Gigabit switch fabric backplane is most often used for data communication between boards in the chassis. Base backplane switching is usually used for sync and HA heartbeat communication boards in the. To install FortiController or FortiSwitch boards, see the documentation supplied with the board. FortiGate-5144C Chassis Guide 23

24 FortiGate-5144C chassis power level requirements Power connection and configuration Power connection and configuration The FortiGate-5144C chassis is designed to be installed in a Telecom data center or similar location that has available -48VDC power fed from a listed circuit breaker (also called battery power or main DC power). Fortinet expects that most FortiGate-5144C customers will be installing their chassis in a location that is already equipped with a -48VDC power system fed from a listed circuit breaker that provides power to existing networking or Telecom equipment. The FortiGate-5144C chassis is designed to be connected directly to this DC power system. The FortiGate-5144C is rated at 48VDC 156A with 4x feeds up to 39A/feed. For each feed, the provision can be with one main breaker rated for 156A or more or four breakers rated at 40A. With a 20% margin, the main breaker should be rated for 187A. The four breakers for each feed should be rated for at least 46.8A. For full redundancy, a second set of identical breakers are needed for the second feed. The current rating is reduced to 138A if no RTM slots are used. If DC power is not available you can use the FortiGate-5053B power converter shelf to convert AC to DC to supply DC power to the FortiGate-5144C chassis. Fortinet supplies eight 4-ft. power cables with 8 AWG stranded wires and double-hole lugs: Black for -48VDC and red for RTN. These cables should only be used to connect the FortiGate-5144C PEMs to a FortiGate-5053B power convertor shelf if purchased with your FortiGate-5144C chassis. The double-hole lugs to be connected to the FortiGate-5144C PEMs should be covered with the supplied clear PEM terminal protection covers before energizing the power system. If the power cable length needs to be significantly longer than 4 ft., higher gauge wires should be considered. If you are connecting your chassis to a local DC power source, use cables that meet your local wiring codes. To connect the wires to the FortiGate-5144C PEMs use 5/8-inch double-hole lugs with suitable for the DC cables used, such as Thomas & Betts PN 54850BE. Green 8 AWG wires are recommended for ground connections (not supplied with the chassis). FortiGate-5144C chassis power level requirements This section provides some basic guidelines for determining the power requirements of your FortiGate-5144C chassis. Actual requirements may vary depending on your installation requirements. Contact Fortinet Support if you need more information. The base FortiGate-5144C chassis (empty, with four fan trays, one shelf manager, and four PEMs installed and operating with the fans running at full speed) requires a maximum of 1000 W. Each chassis slot can supply up to 400 W. You can use these numbers to estimate the power requirement for a chassis configuration. 24 FortiGate-5144C Chassis Guide

25 Power connection and configuration Connecting the FortiGate-5144C chassis to DC power and ground Example: power for a chassis with 5 boards For example, the power requirement for a FortiGate-5144C chassis with FortiGate-5000 series boards in five slots would be: 1000W + (400W * 5) = 3000W Example: power for a fully-loaded chassis (14 boards) The power requirement for a fully loaded FortiGate-5144C chassis with boards in all 14 slots would be: 1000W + (400W * 14) = 6600W Connecting the FortiGate-5144C chassis to DC power and ground The chassis includes two redundant power feeds (Feed A and Feed B) which provide power to all chassis slots and components. Each power feed includes two power entry modules (PEMs). To power the chassis you need to connect the PEMs in Feed A to a -48VDC/-60VDC power source. For redundant power you can also connect the PEMs in Feed B to a -48VDC/-60VDC power source. Each PEM includes a Reverse Voltage LED that lights if you have reversed the polarity when connecting power. FortiGate-5144C power Feeds, PEMs, and ground connector PEM 4 Feed B PEM 3 Chassis ground connector PEM 2 Feed A PEM 1 Each PEM includes two input feeds (feed 1 and feed 2). Each of these input feeds includes two -48VDC/-60 VDC connectors (labeled -) and two return connectors (labeled +). Each input feed is a separate power channel that includes its own 30A fuse. Each power channel provides power to a different set of chassis components. All terminals of each input feed should be connected to a single -48VDC power source with a listed circuit breaker. FortiGate-5144C Chassis Guide 25

26 Connecting the FortiGate-5144C chassis to DC power and ground Power connection and configuration Power segmentation for Feed A and Feed B PEM Input Feed Channel Physical Component Logical Slot PEM 1/ Slot 1, Slot 2 Slot 13, Slot 11 2 Slot 3, Slot 4 Slot 9, Slot 7 3 Slot 5, Slot 6 Slot 5, Slot 3 4 Slot 7, Fan Tray 1, Fan Tray 2, Shelf Manager 1 Slot 1 PEM 2/ Slot 8, Slot 9 Slot 2, Slot 4 2 Slot 10, Slot 11 Slot 6, Slot 8 3 Slot 13, Slot 14 Slot 12, Slot 14 4 Slot 12, Fan Tray 3, Fan Tray 4, Shelf Manager 2 Slot 10 To connect the FortiGate-5144C PEMs to DC power you must use power connectors and wires that comply with the local electrical wiring code and the requirements of the facility in which you are installing the FortiGate-5144C chassis. The PEMs are hot-swappable, which means if both power feeds are connected you can remove and replace a defective PEM while the chassis is operating. It is not necessary to notify the software or reset the system power to remove a PEM. You can add, remove, or replace a second PEM without interrupting FortiGate-5144C operation. Crimping guidelines To connect the PEMs to data center power you should use 8 AWG or larger wires depending on the wire length and the power requirements of your chassis. The ends of these wires must be fitted with 5/8-inch double-hole lugs suitable the DC cables used, such as Thomas & Betts PN 54850BE. Use the following information to crimp and prepare these wires. Do not crimp energized wires. Follow these crimping guidelines: Strip the insulation from cable. Be careful not to nick cable strands which may later result in stands breaking Cable end should be clean: wire brush or clean with emery cloth if necessary. Insert cable into connector until it stops. The insertion length must approximate the stripped length of cable Insert connector in die and compress between the markings beginning near the tongue of the connector. Using the wrong installing die may result in a defective connection. After crimping, remove all sharp edges, flash or burrs. 26 FortiGate-5144C Chassis Guide

27 Power connection and configuration Connecting FortiGate-5144C power feeds to DC power Connecting FortiGate-5144C power feeds to DC power The following procedure describes how to connect the PEMs in a FortiGate-5144C power feed to DC power. Repeat this procedure to connect each power feed. Eight DC cables are required for the PEMs in a feed (and all terminals of each polarity should be used). The supplied clear terminal protection covers must be installed on all PEMs before they are energized. Connecting Feed A PEM1 and PEM2 or Feed B PEM3 and PEM4 to DC power -48VDC connector DC Power Source RTN connector Terminal Cover Active, OOS, and H/S LEDs Reverse Voltage LEDs Fuse LEDs (channels 5 to 8) Terminal Cover FortiGate-5144C PEM LEDs LED State Description ACTIVE Solid Green Normal operation. OOS (Out of Service) H/S (Hot Swap) REV. VOLT FEED 1 REV. VOLT FEED 2 (Reverse Voltage for feed 1 and feed 2) Off Solid Red Off Blinking Blue Blue Off Solid Red Normal Operation. Out of Service. Normal operation. The PEM is shutting down in preparation for being removed from the chassis. The PEM can be removed from the chassis. Normal operation Feed input voltage polarity reversed. FortiGate-5144C Chassis Guide 27

28 Connecting the FortiGate-5144C chassis to ground Power connection and configuration LED State Description FUSE MONITOR CH1 to CH8 (Fuses for power channels 1 to 8) Off Red Normal operation. One or both fuses blown or absent. You need the following equipment to connect the primary FortiGate-5144C PEMs to DC power: An electrostatic discharge (ESD) preventive wrist strap with connection cord. Four black 8 AWG stranded wires labeled -48V with attached 5/8-inch listed closed loop double-hole lugs suitable for the DC cables used, such as Thomas & Betts PN 54850BE. Four red 8 AWG stranded wires labeled RTN with attached 5/8-inch listed closed loop double-hole lugs suitable for he DC cables used, such as Thomas & Betts PN 54850BE. To connect the PEMs in a power feed to DC power 1. Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal surface on the chassis or frame. 2. Make sure that the PEMs and power cords are not energized. 3. Remove the PEM terminal covers. 4. Remove the first set of nuts and lock washers from the connectors on each PEM. 5. Connect black -48V power wires from the DC power source to the connectors on the PEMs labeled - using doublehole lugs. Install each double-hole lug vertically. Do not apply torque of more than 3.8 Nm (33.62 lbf.in). 6. Connect red RTN power wires from your location s RTN terminal to the connectors on the PEMs labeled + using double-hole lugs. Install each double-hole lug vertically. Do not apply torque of more than 3.8 Nm (33.62 lbf.in). 7. Install previously removed nuts and washers to secure the connectors. 8. Make sure the power wires are secured using tie wraps if required. 9. If required, label the black wires -48V. 10. If required, label the red wires RTN. 11. Install the PEM terminal covers. Connecting the FortiGate-5144C chassis to ground The FortiGate-5144C chassis includes a ground terminal on the rear the bottom of the FortiGate-5144C back panel. The ground terminal provides two connectors to be used with a double-holed lug such as Thomas & Betts PN 54850BE. This connector must be connected to a local ground connection. You need the following equipment to connect the FortiGate-5144C chassis to ground: An electrostatic discharge (ESD) preventive wrist strap with connection cord. One green 8 AWG stranded wire with listed closed loop double-hole lug suitable for minimum 8 AWG copper wire, such as Thomas & Betts PN 54850BE. 28 FortiGate-5144C Chassis Guide

29 Power connection and configuration FortiGate-5053B power supply shelf and PSU-5000B power supplies Connecting a FortiGate-5144C chassis to ground Chassis Ground Connector (green) Data Center ground connector (Central office ground system) To connect the FortiGate-5144C chassis to ground 1. Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal surface on the chassis or frame. 2. Make sure that the chassis and ground wire are not energized. 3. Connect the green ground wire from the local ground to the ground connector on the FortiGate-5144C chassis. 4. Secure the ground wire to the chassis. 5. Optionally label the wire GND. FortiGate-5053B power supply shelf and PSU-5000B power supplies If DC power is not available at your location, you can use the FortiGate-5053B 1U 19-inch rack mount power supply shelf with PSU-5000B hot swappable power supplies to convert AC power to DC power. These components are not supplied with the FortiGate-5144C chassis and must be purchased separately. FortiGate-5053B power supply shelf with four PSU-5000B power supplies Edge Controller PSU-5000B hot swappable Power Supplies (4) In addition to adding multiple FortiGate-5053B power supply shelves for additional power, you can also pair a FortiGate-5053B with a FortiGate-5053B-LC power supply shelf. The LC unit can also include up to four PSU but does not include an edge controller. Instead, both FortiGate-5053B power supply shelves are managed by one edge controller. FortiGate-5144C Chassis Guide 29

30 FortiGate-5053B power supply shelf and PSU-5000B power supplies Power connection and configuration FortiGate-5053B and 5053B-LC power supply shelves PSU-5000B hot swappable Power Supplies (4) Edge Controller FortiGate-5053B power supply shelf FortiGate-5053B-LC power supply shelf PSU-5000B hot swappable Power Supplies (4) You can install multiple power supply shelves and multiple power supplies to provide additional power and for redundancy. For more information about the FortiGate-5053B power supply shelf see the FortiGate-5053B Power Supply Shelf Guide. As already stated, Fortinet supplies eight 4-ft. power cables with 8 AWG stranded wires and double-hole lugs: Black for -48VDC and red for RTN. These cables should be used to connect the FortiGate-5144C PEMs to a FortiGate-5053B power supply shelf. If the power cable length needs to be significantly longer than 4 ft., higher gauge wires should be used. The FortiGate-5053B power supply shelf can include up to four PSU-5000B power supplies. The power supply shelf can be connected to high line AC input ( VAC) or low line AC input ( VAC). When connected to high-line AC input, a single power supply can provide 2725W of DC power and a fully populated FortiGate-5053B power supply shelf can provide up to 10.9KW of DC power and 8175W of DC power with 3+1 redundancy with an output voltage of 54 VDC. When connected to low-line AC input a single power supply can provide 1200W of DC power and a fully populated FortiGate-5053B power supply shelf can provide up to 4800W of DC power and 3600W of DC power with 3+1 redundancy with an output voltage of 54 VDC. When connected to low-line AC power a minimum of 6 PSU-5000B power supplies are required to power a fully loaded FortiGate-5144C chassis (that can require up to 6600W). Fortinet recommends the following low-line AC power configurations to provide power to a FortiGate-5144C chassis: Two FortiGate-5053B power supply shelves with a total of 8 PSU-5000Bs. One power supply shelf connects to chassis power Feed A and the other to Feed B providing 6+2 redundancy. A FortiGate-5053B and a FortiGate-5053B-L with a total of 8 PSU-5000Bs. One power supply shelf connects to chassis Feed A and the other to Feed B providing 6+2 redundancy. Two sets of a FortiGate-5053B and a FortiGate-5053B-L power supply shelves with a total 16 PSU-5000Bs powered from 2 different AC power feeds and connected to both Feed A and Feed B to provide added redundancy. 30 FortiGate-5144C Chassis Guide