Replace the network module with a different type

Replace an existing network module with a different type to accommodate new interface requirements or hardware upgrades.

If you replace a network module with a different type, then a reboot is required. If the new module has fewer interfaces than the old module, you will have to manually remove any configuration related to interfaces that will no longer be present.

For clustering or High Availability, you can only perform chassis operations on the control node or active unit.

Before you begin

For High Availability, you cannot disable a network module if the failover link is on the module. You will have to break the high availability pair (see Break a high availability pair), which means you will have downtime when you reboot the active unit. After the units finish rebooting, you can reform High Availability.

Follow these steps to replace the network module with a different type:

Procedure

Step 1	For clustering or High Availability, perform the following steps. Clustering—To avoid downtime, you can break each node one at a time so it is no longer in the cluster when you perform the network module replacement. Add the node back to the cluster after the replacement. High Availability—To avoid failing over when you replace the network module, disable interface monitoring for interfaces on the network module. See Configure standby IP addresses and interface monitoring.
Step 2	From Devices > Device Management, click Manage in the Chassis column. For clustering or High Availability, this option is only available for the control node/active unit; network module changes are replicated to all nodes. Manage chassis The Chassis Operations page opens for the device. This page shows physical interface details for the device.
Step 3	On the interfaces graphic, click the slider () to disable the network module. Disable the network module Do not save any changes on the Interfaces page. Because you are replacing the network module, you do not want to disrupt any existing configuration. You are prompted to confirm that you want to turn the network module off. Click Yes. Confirm disable
Step 4	On the device, remove the old network module and replace it with the new network module according to the hardware installation guide. Reboot the firewall. Refer to Shut down or restart the device for guidance. For clustering or High Availability, reboot the data nodes/standby unit first, and wait for them to come back up. Then you can change the control node or active unit (see Switch the Active Peer in the Firewall Threat Defense High Availability Pair), and reboot the former control node/active unit.
Step 5	In the Cloud-Delivered Firewall Management Center, click Sync Modules to update the page with the new network module details.
Step 6	Enable the new module by clicking the slider (). Enable the network module Click Yes when prompted to confirm that you want to turn the network module on. Confirm enable
Step 7	Click the link in the message at the top of the screen to go to the Interfaces page to save the interface changes. Go to interface page
Step 8	If the network module has fewer interfaces: At the top of the Interfaces page, click Click to know more. The Interface Changes dialog box opens. View interface changes Interface changes Click Validate Changes to make sure your policy will still work with the interface changes. If there are any errors, you need to change your policy and rerun the validation. Deleting an interface that is used in your security policy can impact the configuration. Interfaces can be referenced directly in many places in the configuration, including access rules, NAT, SSL, identity rules, VPN, DHCP server, and so on. Deleting an interface will delete any configuration associated with that interface. Policies that refer to security zones are not affected. Click Close to return to the Interfaces page.
Step 9	To change the interface speed, see Enable the physical interface and configure Ethernet settings. The default speed is set to Detect SFP, which detects the correct speed from the SFP installed. You only need to fix the speed if you manually set the speed to a particular value and you now need a new speed. Click Save to save the interface changes to the firewall.

What to do next

If you had to change any configuration, go to Deploy > Deployment and deploy the policy.
For clustering, add the node back to the cluster.
For high availability, reenable interface monitoring for interfaces on the network module. See Configure standby IP addresses and interface monitoring.