H3C SecPath V100-E Installation guide

H3C SecPath V100-E Security Gateway

Installation Manual

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Manual Version: APW100-20090518

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H

3

Care,

, TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V

2

G, V

n

G, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Technical Support

customer_service@h3c.com

http://www.h3c.com

About This Manual

Organization

H3C SecPath V100-E Security Gateway Installation Manual is organized as follows:

Chapter Contents

1 Product Overview

Introduces the features and applications of the

V100-E and provides the appearance and

system specifications of the V100-E.

2 Installation Preparations

Introduces the environment requirements for

installing the V100-E, installation precautions

and installation tools.

3 Installing the V100-E

Introduces how to install the V100-E and how to

connect the power cable, console cable and

Ethernet cable.

4 Starting and Configuring the V100-E

Introduces the startup and configuration of the

V100-E, including device boot and powering up

and system file initialization.

5 Maintaining Software

Introduces software maintenance of the V100-E,

including software upgrade and configuration file

loading.

6 Maintaining Hardware

Introduces hardware maintenance of the

V100-E, including replacing a DDR SDRAM.

7 Troubleshooting

Introduces the faults that may occur during the

installation and startup of the V100-E and the

corresponding solutions.

8 MIM Modules

Introduces the appearance, panel and LEDs of

the MIMs, and describes how to install the MIMs

and how to connect the interface cables.

Appendix Compliance and Safety Manual

This section introduces part of the safety

precautions that should be followed during the

installation and maintenance of the equipment.

Conventions

The manual uses the following conventions:

Command conventions

Convention Description

Boldface

The keywords of a command line are in Boldface.

italic

Command arguments are in italic.

[ ] Items (keywords or arguments) in square brackets [ ] are optional.

{ x | y | ... }

Alternative items are grouped in braces and separated by vertical bars.

One is selected.

[ x | y | ... ]

Optional alternative items are grouped in square brackets and

separated by vertical bars. One or none is selected.

Convention Description

{ x | y | ... } *

Alternative items are grouped in braces and separated by vertical bars.

A minimum of one or a maximum of all can be selected.

[ x | y | ... ] *

Optional alternative items are grouped in square brackets and

separated by vertical bars. Many or none can be selected.

&<1-n>

The argument(s) before the ampersand (&) sign can be entered 1 to n

times.

# A line starting with the # sign is comments.

GUI conventions

Convention Description

Boldface

Window names, button names, field names, and menu items are in

Boldface. For example, the New User window appears; click OK.

>

Multi-level menus are separated by angle brackets. For example, File >

Create > Folder.

Symbols

Convention Description

Means reader be extremely careful. Improper operation may cause

bodily injury.

Means reader be careful. Improper operation may cause data loss or

damage to equipment.

Means a complementary description.

Related Documentation

In addition to this manual, each H3C SecPath Series Security Products documentation set includes the

following:

Manual Description

H3C SecPath Series Security Products

Operation Manual

It introduces the functional features, principles

and guide to configuration and operation for H3C

SecPath Series Security Gateways/Firewalls.

H3C SecPath Series Security Products

Command Manual

It discusses all commands available in the

configuration and operation on H3C SecPath

Series Security Gateways/Firewalls. The details

include command name, complete command

form, parameter, operation view, usage

description and configuration example.

H3C SecPath Series Security Products

Web-Based Configuration Manual

It directs users to configure the H3C SecPath

Series Firewalls through the Web interface.

H3C SecPath SSL VPN Administrator Manual

It provides guides for the administrator of the

H3C SecPath SSL VPN system to configure

users, resources and various policies of the

system.

Manual Description

H3C SecPath SSL VPN User Manual

It introduces resource access methods for users

of the H3C SecPath SSL VPN system.

Obtaining Documentation

You can access the most up-to-date H3C product documentation on the World Wide Web at this URL:

http://www.h3c.com.

The following are the columns from which you can obtain different categories of product documentation:

[Products & Solutions]: Provides information about products and technologies.

[Technical Support & Document > Technical Documents]: Provides several categories of product

documentation, such as installation and configuration.

[Technical Support & Document > Software Download]: Provides the documentation released with the

software version.

Documentation Feedback

You can e-mail your comments about product documentation to [email protected].

We appreciate your comments.

Environmental Protection

This product has been designed to comply with the requirements on environmental protection. For the

proper storage, use and disposal of this product, national laws and regulations must be observed.

i

Table of Contents

1 Product Overview······································································································································1-1

Overview ·················································································································································1-1

Hardware Features ·································································································································1-2

Appearance ·····································································································································1-2

System Specifications ·····················································································································1-2

LEDs················································································································································1-3

Fixed Interface Attributes ················································································································1-3

MIMs················································································································································1-4

2 Installation Preparations···························································································································2-1

Environment Requirements ····················································································································2-1

Temperature and Humidity··············································································································2-1

Cleanness Requirements ················································································································2-1

Electrostatic Discharge Prevention ·································································································2-2

Electromagnetic Interference Prevention ························································································2-2

Lightning Protection·························································································································2-2

Rack-Mounting Requirements·········································································································2-3

Safety Precautions ··································································································································2-3

Safety Signs ····································································································································2-3

General Safety Recommendations ·································································································2-3

Checklist Before Installation····················································································································2-3

Installation Tools, Meters and Equipment·······························································································2-3

3 Installing the V100-E··································································································································3-1

Preparations············································································································································3-1

Installation Flowchart ······························································································································3-1

Installing the V100-E·······························································································································3-2

Free-Standing··································································································································3-2

Rack-Mounting ································································································································3-2

Installing Generic Modules······················································································································3-2

Connecting the PGND Cable ··················································································································3-3

Connecting to the Console Terminal·······································································································3-4

Connecting to the Ethernet Interface ······································································································3-4

Connecting the Power Cable ··················································································································3-5

Verifying Installation································································································································3-6

4 Starting and Configuring the V100-E·······································································································4-1

Booting ····················································································································································4-1

Setting Up a Configuration Environment·························································································4-1

Powering Up the V100-E·················································································································4-3

Booting Process ······························································································································4-4

Configuration Fundamentals···················································································································4-5

Basic Configuration Procedures······································································································4-5

Command Line Interface ·················································································································4-5

ii

5 Maintaining Software·································································································································5-1

Boot Menu···············································································································································5-1

Upgrading Application and Boot ROM Using XMODEM ········································································5-2

Backing Up and Restoring the Extended Segment of the Boot ROM ····················································5-5

Upgrading the Application Program Using TFTP····················································································5-5

Uploading/Downloading Applications/Files Using FTP···········································································5-7

Modifying Boot ROM Password ············································································································5-10

Resetting a Lost Password ···················································································································5-12

6 Maintaining Hardware ·······························································································································6-1

Preparing Tools·······································································································································6-1

Opening the Chassis Cover ····················································································································6-1

Installing and Removing a DDR SDRAM································································································6-2

Locating the DDR SDRAM on the Main Board ···············································································6-3

Removing a DDR SDRAM···············································································································6-4

Install a DDR SDRAM ·····················································································································6-5

Installing the Chassis Cover ···················································································································6-5

Installing and Removing MIMs················································································································6-5

7 Troubleshooting ········································································································································7-1

Troubleshooting PSU······························································································································7-1

Troubleshooting the Configuration System·····························································································7-1

Troubleshooting Application Upgrading ··································································································7-2

8 MIM Modules··············································································································································8-1

MIM Options············································································································································8-1

Installing and Removing an MIM·············································································································8-1

Troubleshooting an MIM ·························································································································8-3

1FE/2FE/4FE Module······························································································································8-3

Introduction······································································································································8-3

Appearance ·····································································································································8-3

Interface Attributes ··························································································································8-4

Panel and Interface LEDs ···············································································································8-5

Interface Cable ································································································································8-5

Connecting the Interface Cable·······································································································8-7

1GBE/2GBE Module ·······························································································································8-7

Introduction······································································································································8-7

Appearance ·····································································································································8-8

Interface Attributes ··························································································································8-8

Panel and Interface LEDs ···············································································································8-8

Interface Cable ································································································································8-9

1GEF/2GEF Module······························································································································8-10

Introduction····································································································································8-10

Appearance ···································································································································8-10

Interface Attributes ························································································································8-10

Panel and Interface LEDs ·············································································································8-11

Interface Cable ······························································································································8-12

HNDE Module ·······································································································································8-13

Introduction····································································································································8-13

Interface Attributes ························································································································8-13

iii

Panel and Interface LEDs ·············································································································8-13

Troubleshooting the HNDE Module·······························································································8-14

1-1

1 Product Overview

Overview

The H3C SecPath V100-E Security Gateway (referred to as the V100-E hereinafter) is a

new-generation network security device intended for enterprise users. The V100-E serves as the

access gateway for small- and medium-sized enterprises by providing various VPN access solutions,

including the SSL VPN.

The V100-E has the following features:

z Providing four 10/100 Mbps autosensing Ethernet interfaces, allowing for flexible configurations of

internal networks, external networks, demilitarized zone (DMZ), and out-of-band management.

z Offering an extension slot for multifunctional interface modules (MIMs), which can be 1FE, 2FE,

4FE, 1GBE, 1GEF, 2GBE, 2GEF, and HNDE.

z Fully satisfying the carrier-class reliability requirements as it supports power supply unit (PSU)

redundancy backup (AC+AC), detection of internal chassis temperature, network management,

and Web-based configuration and management.

z Supporting multiple VPN services, such as secure socket layer (SSL) VPN, Layer 2 tunneling

protocol (L2TP) VPN, IP security (IPsec) VPN, generic routing encapsulation (GRE) VPN, and

dynamic VPN.

z Supporting hardware encryption and connection to remote users through ADSL dial-up, VLAN, or

tunneling to implement Internet, intranet, and access VPNs.

z Integrating such technologies as the firewall, authentication, authorization and accounting (AAA),

network address translation (NAT), and quality of service (QoS) to guarantee high security and

reliability for private networks over the Internet.

z Offering chip-based encryption solution to deliver high-speed SSL VPN features.

z Delivering basic routing capabilities, supporting RIP, OSPF, BGP, route policy, and policy-based

routing, supporting abundant QoS features, and providing traffic policing, traffic shaping, and

multiple queue scheduling policies.

The V100-E supports automatically upgrading configuration and application files through the branch

intelligent management system (BIMS), and supports deploying and configuring VPNs using the VPN

manager.

1-2

Hardware Features

Appearance

Figure 1-1 Front panel of the V100-E

Figure 1-2 Rear panel of the V100-E

System Specifications

Table 1-1 Technical specifications of the V100-E

Item Description

MIM slot 1

Fixed interface

4 × 10/100 Mbps Ethernet interfaces

1 AUX port (AUX)

1 console port (CONSOLE)

Boot ROM 512 KB

DDR SDRAM 512 MB (default)

Flash memory 16 MB

Physical dimensions excluding rubber feet (H ×

W × D)

44 × 436 × 430 mm (1.73 × 17.17 × 16.93 in.)

Power supply AC+AC

Rated voltage range: 100 VAC to 240 VAC, 50

Hz or 60 Hz

Rated current: 1.0 A

Power consumption

57 W

Operating temperature

0°C to 45°C (32°F to 113°F)

Operating humidity (noncondensing)

10% to 95%

1-3

z Double data rate synchronous dynamic random access memory (DDR SDRAM) stores the data

exchanged between the system and the CPU.

z Flash memory functions as the major file storage medium to store application files, anomaly

information, and configuration files.

z Boot ROM stores the boot file for device startup.

LEDs

Table 1-2 LEDs on the V100-E

LED Description

PWR0

OFF means the PSU0 is not supplying power to the device.

ON means the PSU0 is supplying power to the device.

PWR1

OFF means the PSU1 is not supplying power to the device.

ON means the PSU1 is supplying power to the device.

SYS

ON means the system is operating normally.

OFF means the system is operating abnormally.

ACT (system)

Blinking means the software is operating normally.

OFF means the software is operating abnormally.

LINK

OFF means no link is present.

ON means a link is present.

ACT (interface)

OFF means no packets are being transmitted or received on the interface.

Blinking means packets are being transmitted or received on the interface.

Fixed Interface Attributes

Console port (CONSOLE)

Table 1-3 Attributes of the console port

Item Description

Connector

RJ-45

Interface standard

RS-232

Baud rate 1,200 bps to 115,200 bps, defaults to 9,600 bps

Services

Connected to an ASCII terminal

Connected to the serial interface of a local PC running terminal

emulation software

Command line interface (CLI)

1-4

AUX port (AUX)

Table 1-4 Attributes of the AUX port

Item Description

Connector

RJ-45

Interface standard

RS-232

Baud rate 1,200 bps to 115,200 bps

Services

Modem dialup

Backup

Ethernet interfaces

The V100-E provides four fixed 10/100 Mbps autosensing Ethernet interfaces. Their attributes are

described in

Table 1-5.

Table 1-5 Attributes of the Ethernet interfaces

Item Description

Connector type

RJ-45

Interface type MDI/MDIX autosensing

Frame formats

Ethernet_II

Ethernet_SNAP

Operating mode

10/100 Mbps autosensing

Half/full duplex

MIMs

The V100-E provides one expansion slot for the following MIMs:

z 1-port 10Base-T/100Base-TX fast Ethernet interface module (1FE)

z 2-port 10Base-T/100Base-TX fast Ethernet interface module (2FE)

z 4-port 10Base-T/100Base-TX fast Ethernet interface module (4FE)

z 1-port 10Base-T/100Base-TX/1000Base-T Ethernet interface module (1GBE)

z 2-port 10Base-T/100Base-TX/1000Base-T Ethernet interface module (2GBE)

z 1-port 1000Base-LX/1000Base-SX Ethernet optical interface module (1GEF)

z 2-port 1000Base-LX/1000Base-SX Ethernet optical interface module (2GEF)

z High performance network data encryption module (HNDE)

For details about these MIMs, refer to

MIM Modules .

2-1

2 Installation Preparations

Environment Requirements

The H3C SecPath series security gateways are designed for indoor application. To guarantee the

normal operation and prolong the service life of the device, the installation site must meet the

requirements mentioned hereunder.

Temperature and Humidity

The temperature and humidity in the equipment room shall be maintained at an appropriate level.

z A long-time high relative humidity will quite likely result in poor insulation performance, electric

leakage, mechanical property change, and corrosion.

z A long-term low relative humidity will result in looseness of fastening screws owing to shrinkage of

insulation washers, or electrostatic discharge (ESD), which may damage the CMOS circuit on the

device.

z A high temperature will speed up the aging of insulation materials, which greatly lower the device’s

reliability and shortens the service life.

Table 2-1 lists the requirements on temperature and humidity for the V100-E. .

Table 2-1 Temperature and humidity requirements in the equipment room

Temperature Relative humidity

0°C to 45°C (32°F to 113°F)

10% to 95% (noncondensing)

Cleanness Requirements

Dust is harmful to the safe operation of the device. Dust on the chassis may result in static adsorption,

which causes poor contact between metal connectors or joints. The poor contact not only shortens the

service life of the device, but also brings about communication failures. Especially under the condition

of low indoor humidity, static adsorption is more likely to occur.

The equipment room must be free of explosive, electrically and magnetically conductive, and corrosive

dust. The following table lists the limit on dust particles.

Table 2-2 Limitation on dust concentration and diameter in the equipment room

Mechanical active

material

Unit Content

Dust particle

Particle/m³

≤ 3 × 10

4

(No visible dust on desk in three days)

Note: Dust particles diameter ≥ 5 µm

2-2

Besides, the amounts of salt, acid, and sulfide in the equipment room should be strictly restricted.

Harmful gases could accelerate the corrosion of metal parts and the aging of some parts.

Table 2-3 lists the concentration limit of SO

2

, H

2

S, NH

3

, and CI

2

in the equipment room.

Table 2-3 Concentration limit of some harmful gases in the equipment room

Gas Max content (mg/m

3

)

SO

2

0.2

H

2

S 0.006

NH

3

0.05

Cl

2

0.01

Electrostatic Discharge Prevention

In the communication network to which the device is connected, static induction mainly results from:

z External electrical fields such as outdoor high voltage power line or lightning

z Indoor environment, flooring materials, and the device structure

Although the V100-E adopts many antistatic measures, damage to board circuits or even the device

may still happen when the static electricity exceeds a certain limit.

To prevent ESD,

z Make sure that the device and the floor are well grounded.

z Take dust-proof measures for the equipment room.

z Maintain the humidity and temperature at a proper level.

z Always wear an ESD-preventive wrist strap or antistatic clothing when touching a circuit board.

z Place the removed circuit board on an antistatic workbench, with the face upward, or put it into an

antistatic bag.

z Hold by the edges, instead of electronic components when observing or moving a circuit board.

Electromagnetic Interference Prevention

All possible interference sources, external or internal, affect the device in the way of capacitance

coupling, inductance coupling, electromagnetic radiation, and common impedance (including the

grounding system) coupling. To minimize the influence of interference sources on the device, take the

following into consideration:

z Take effective measures to protect the power system from power grid interference.

z Separate the protection ground of the device from the grounding device or lightning protection

grounding device of the common power supply equipments as far as possible.

z Keep the device far from heavy-duty radio transmitters, radar transmitters, and high-frequency

devices.

z Adopt electromagnetic shielding measures when necessary.

Lightning Protection

Although many measures have been taken to protect the device from lightning, damage to the device

may still happen if the lightning intensity exceeds a certain limit. To better protect the device from

lightning, do the following:

2-3

z Ensure the PGND cable of the chassis is well grounded.

z Ensure the grounding terminal of the AC power socket is well grounded.

z Install a lightning arrester at the input end of the power supply to enhance the lightning protection

capability of the power supply.

Rack-Mounting Requirements

When installing the V100-E,

z Reserve adequate clearance around the air inlet and exhaust of the chassis for heat ventilation.

z Make sure that the cabinet is equipped with a good ventilation system.

z Make sure the cabinet is sturdy enough to support the weight of the device and installation

accessories.

z The rack is well-grounded.

Safety Precautions

Safety Signs

When reading this manual, pay attention to the following:

: Means the reader be extremely careful. Improper operation may cause device damage

or bodily injury.

: Means the reader be careful. Improper operation may cause device malfunction.

General Safety Recommendations

z Keep the device far away from heat sources and water/liquid.

z Make sure that the device has been correctly grounded.

z Wear an ESD-preventive wrist strap during installation and maintenance, making sure that the

strap has good skin contact.

z Do not hot swap the console cable or AUX cable.

z Use laser with caution. Do not directly stare into apertures or fiber connectors that emit laser

radiation.

z Equip an uninterrupted power supply (UPS).

Checklist Before Installation

Check the arrived shipment contents against the packing list, making sure all the items are included and

in good condition. Contact your agent for shortage or wrong delivery.

Installation Tools, Meters and Equipment

Tools

z Phillips screwdriver

z Flat-blade screwdriver

z ESD-preventive wrist strap

z Antistatic bags

2-4

Cables

z Grounding wire and power cord

z Console cable

z Optional cables

Meters and other equipment

z Hub or LAN switch

z Console terminal (or a PC)

z Accessories for the ordered interface modules

z Multimeter

The device is not shipped with any installation tools, meters, or equipment. You need to prepare them

yourself.

3-1

3 Installing the V100-E

Preparations

z Before installing the V100-E, make sure that you have read through Chapter 2 Installation

Preparations.

z Make sure all the requirements mentioned in Chapter 2 are satisfied.

Installation Flowchart

Figure 3-1 Installation flowchart for the V100-E

Normal?

Install the device to

the specified position

Connect the PGND cable

Connect the power cables

Connect the device to

a configuration terminal

Verify the installation

Turn on the power switch

Power off the device and

disconnect the power cables

Install a MIM

(

optional

)

Connect the device to the

Ethernet network

Connect the power cables

and power on the device

Verify the installation

End

Turn off the power

switch

Troubleshooting

No

Yes

Start

Install the cabinet (optional)

3-2

Installing the V100-E

You can place the V100-E on a workbench or mount it in a 19-inch standard rack.

Free-Standing

Place the V100-E on a clean and flat workbench. To prevent any damage, observe the following:

z Ensure the workbench is stable enough.

z Allow 10 cm (3.9 in.) of clearance around the ventilation openings.

z Do not place heavy stuff on the V100-E.

Rack-Mounting

The V100-E is designed to be mounted in 19-inch standard racks. Table 3-1 shows its physical

dimensions.

Table 3-1 Physical dimensions of the V100-E

Model Physical dimensions (H × W × D)

H3C SecPath V100-E security gateway

44 × 436 × 430 mm (1.73 × 17.17 × 16.93 in.)

(excluding rubber feet)

Follow these steps to rack-mount the V100-E:

Step1 Check the grounding and stability of the rack. Use the screws to fix the mounting brackets at both sides

near the front panel of the device.

Step2 Put the device in a rack tray. Depending on the actual situation, slide the device along the guide rails to

an appropriate place.

Step3 Fix the mounting brackets to the rack posts with suitable antirust pan-head screws. Make sure that the

device is placed horizontally and securely fixed.

Figure 3-2 Install the V100-E in a rack

(1)

(2)

(3)

(1) Screws (four) (2) Mounting bracket

(3) Guide rail

Installing Generic Modules

For how to install MIMs, refer to MIM Modules.

3-3

Connecting the PGND Cable

A correct connection of the protection ground (PGND) cable on the device chassis is an essential

safeguard against lightning strokes and electromagnetic interference (EMI). When installing or using

the device, make sure the PGND cable is correctly connected.

The V100-E provides a grounding screw, which must be well grounded, so as to safely conduct the

inductive and leaky current to the earth ground, and thereby improve the capability of the whole device

to guard against the electromagnetic interference.

The grounding screw of the V100-E, which is marked with grounding symbol, is at the right end on the

real panel, as shown in

Figure 3-3.

Figure 3-3 Grounding screw of the V100-E

(1) Ground screw

Use a PGND cable to connect the grounding screw to the earth ground, and the grounding resistance

should not be greater than 5 ohm. Likewise, if the V100-E is installed in a 19-inch standard rack, this

rack is required to be grounded too.

The V100-E must be well grounded during its operation. Otherwise, it cannot be protected reliably from

lightning, which may damage the V100-E itself and even the peer device.

3-4

Connecting to the Console Terminal

Console port

The H3C SecPath series security gateways provide an RS-232 asynchronous serial console port

(CON), through which you can configure the device. For the attributes of the console port, refer to

Console port (CONSOLE).

Console cable

The console cable is an 8-core shielded cable. At one end of the cable is an RJ-45 connector that can

be plugged to the console port of the V100-E; at the other end is a DB-9 (female) connector, which can

be plugged to the serial interface of the console terminal.

Figure 3-4 illustrates a console cable.

Figure 3-4 Console cable assembly

A

X3

Connecting the console cable

Before configuring the V100-E through a console terminal, follow these steps to connect the console

cable:

Step1 Select a console terminal. The console terminal can be either a PC or a standard ASCII terminal with an

RS-232 serial interface.

Step2 Connect the cable. Turn the power switch off, connect the DB-9 serial interface of the console cable to

the PC, and then connect the RJ-45 interface to the console port of the V100-E.

Step3 Verify the connection and power up the V100-E and console terminal. The console terminal shows the

startup information of the V100-E if the connection is correct. For details, see

Booting Process.

Connecting to the Ethernet Interface

Ethernet interface

The V100-E provides four fixed 10/100 Mbps autosensing Ethernet interfaces.

Ethernet cable

The V100-E uses the category-5 twisted pair cable (straight-through or crossover) to connect its

electrical Ethernet interfaces. See

Figure 3-5.

Page is loading ...

H3C SecPath V100-E Installation guide

H3C SecPath V100-E Installation guide

Related papers

Other documents