PA-220 shows alarm true for S1 12.0V IN B Power Rail

[M.Sharma415844]

Hello Team,

We have a PA-220 in our environment and we have received an alert which shows alarm is TRUE for 12.0V IN B Power Rail and voltage is 1.57 which is less than the min and max value. This is a standalone firewall.

Please advise how can i proceed in this case. Can this impact our production?

Below logs are for your reference:

> show system info

hostname: FW-P-HKG-PAN01
ip-address: 172.29.8.253
public-ip-address: unknown
netmask: 255.255.255.0
default-gateway: 172.29.8.254
ip-assignment: static
ipv6-address: unknown
ipv6-link-local-address: fe80::286:9cff:feda:b000/64
ipv6-default-gateway:
mac-address: 00:86:9c:da:b0:00
time: Fri Mar 22 14:19:46 2024
uptime: 14 days, 15:39:25
family: 220
model: PA-220
serial: 012801062216
cloud-mode: non-cloud
sw-version: 10.2.7-h3
global-protect-client-package-version: 5.2.11
device-dictionary-version: 119-483
device-dictionary-release-date: 2024/03/16 01:22:54 HKT
app-version: 8826-8651
app-release-date: 2024/03/21 18:33:20 HKT
av-version: 4764-5282
av-release-date: 2024/03/21 05:10:29 HKT
threat-version: 8826-8651
threat-release-date: 2024/03/21 18:33:20 HKT
wf-private-version: 0
wf-private-release-date: unknown
url-db: paloaltonetworks
wildfire-version: 857864-861730
wildfire-release-date: 2024/03/21 22:07:18 HKT
wildfire-rt: Disabled
url-filtering-version: 20240322.20095
global-protect-datafile-version: unknown
global-protect-datafile-release-date: unknown
global-protect-clientless-vpn-version: 98-260
global-protect-clientless-vpn-release-date: 2023/05/23 06:41:22 HKT
logdb-version: 10.2.0
dlp: dlp-3.0.5
platform-family: 220
vpn-disable-mode: off
multi-vsys: off
operational-mode: normal
advanced-routing: off
device-certificate-status: Valid

> show system environmentals

----Thermal----
Slot Description Alarm Degrees C Min C Max C

S1 Temperature @ U48 False 42.50 0.00 60.00
S1 Temperature @ U49 False 41.50 0.00 60.00
S1 Temperature @ Cavium Core False 44.01 0.00 80.00

----Power----
Slot Description Alarm Volts Min V Max V

S1 0.85V Power Rail False 0.84 0.76 0.94
S1 0.9V Power Rail False 0.90 0.81 0.99
S1 1.2V Power Rail False 1.18 1.08 1.32
S1 1.8V Power Rail False 1.78 1.62 1.98
S1 2.5V Power Rail False 2.34 2.25 2.75
S1 3.3V Power Rail False 3.30 2.97 3.63
S1 3.3V SD Power Rail False 3.26 2.97 3.63
S1 5.0V Power Rail False 4.92 4.50 5.50
S1 12.0V IN A Power Rail False 11.96 11.40 12.60
S1 12.0V IN B Power Rail True 1.57 11.40 12.60

----Power Supplies----
Slot Description Alarm Inserted
S1 Power Supply #1 False True
S1 Power Supply #2 False True

> show system state | match alarm

env.s1.mp.power.9: { 'alarm': True, 'avg': 1.572, 'desc': 12.0V IN B Power Rail, 'hyst': 0.060, 'max': 12.600, 'min': 11.400, 'samples': [ 1.572, 1.572, 1.572, ], }

chassis.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }
chassis.s0.leds: { 'alarm': Off, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Off, 'temp': Off, }
hw.s1.mp.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }

> show system state | match fan
chassis.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }
chassis.s0.leds: { 'alarm': Off, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Off, 'temp': Off, }
hw.s1.mp.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }

> show system state | match alarm

chassis.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }
chassis.s0.leds: { 'alarm': Off, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Off, 'temp': Off, }

hw.s1.mp.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'service': Off, 'status': Green, 'temp': Green, }

> less mp-log ehmon.log
*
* Ehmon (v3.0)
*
2024-03-07 22:45:49.330 +0800 Start time.
2024-03-07 22:45:51.348 +0800 Loading: libkernel_error.so... done
2024-03-07 22:45:51.350 +0800 Loading: libpower.so... done
2024-03-07 22:45:51.352 +0800 Loading: libpwrsupply.so...2024-03-07 22:45:51.353 +0800 POWERSUPPLY: Power Supply #1 present
2024-03-07 22:45:51.353 +0800 POWERSUPPLY: Power Supply #2 present
done
2024-03-07 22:45:51.354 +0800 Loading: libsfp_mon.so... done
2024-03-07 22:45:51.355 +0800 Loading: libthermal.so... done
2024-03-07 22:45:51.382 +0800 SHM:Shared mutex retrived from memory pid 4145
2024-03-07 22:45:51.467 +0800 Sensor Alarm [True ]: 12.0V IN B Power Rail = 1.284
2024-03-07 22:45:53.498 +0800 Warning: pan_log_proxy(pan_priv_log.c:269): Alarm being proxied

[Adrian_Jensen]

It sounds like you have the optional second/redundant power supply and it has failed. The PA-220 has an external power supply and 2 power input ports on the back. The power supply plugged into the "PWR 2" port seems to have failed... either its AC input power is bad or the power supply itself has failed. The PA-220 is currently running off the first external power supply.

Should be easy to replace, unplug the old, plug in a new power supply. Its not currently affecting your production but could if either the other power supply fails or someone unplugs the wrong power supply to replace. Have someone visually verify onsite. I believe there should be a green/red LED on both the power supply and the input port to indicate if they are good.

https://docs.paloaltonetworks.com/hardware/pa-220-hardware-reference/pa-220-firewall-overview/pa-220...

https://docs.paloaltonetworks.com/hardware/pa-220-hardware-reference/connect-power-to-a-pa-220-firew...

[M.Sharma415844]

Hello @Adrian_Jensen 

Thank you for your response!

I understand that as a next action plan, I can follow the below:
Step1 - Unplug the power cable from PWR2 and plug it back.
Step2 - If step1 did not fix the issue then need to use the new power cable.

Please confirm.

What if above steps do not fix the issue, then what would be the next step?

I will wait for your response.

[Adrian_Jensen · Accepted solution]

Step 1 - Unplug the power supply attached to PWR2 and plug it back in.

Step 2 - Replace the power supply.

The PA-220 uses external 12V 1.75A power supplies. It is not just an AC cable, but an entire inline power supply that takes AC voltage in and creates DC 12V out, similar to a laptop or small home office switch. The Palo Alto part number for the power supply is PAN-PA-220-PWR-AC.

Palo Alto doesn't seem to have any pictures of the power supply, the best I could find is in this Ebay listing of a used PA-220:

https://www.ebay.com/itm/176192465423

Note that there are a lot of power supplies listed on Ebay as "Genuine Power Supply for Palo Alto PA-220", but they are not genuine. A genuine power supply will have a threaded nut on the end of the plug. A standard plug will probably work, but I don't believe Palo Alto ever supplied them that way.

** Special note: The above applies to the PA-220. The PA-220R is a special version with a completely different power connector for ruggedized DC power environments, but since you said you had PA-220 I assumed you had the common PA-220 version.

[M.Sharma415844]

Hi @Adrian_Jensen 

The 2^nd power supply was unplugged at the socket end and is now reconnected. The issue has been resolved.

Thanks for your help.

[Hazel98]

Ensure that the power cable is securely connected to the PA-220 and the power source.  Office Ally Practice Mate A loose connection can cause power fluctuations and trigger alarms.