3com SECPATH U200-CS Installation guide

H3C SecPath U200 Series Unified Threat

Management Products

Installation Manual

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Manual Version: 5PW101-20090520

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H

3

Care,

, TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V

2

G, V

n

G, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Technical Support

customer_service@h3c.com

http://www.h3c.com

About This Manual

Organization

H3C SecPath U200 Series Unified Threat Management Products Installation Manual is organized as

follows:

Chapter Contents

1 Product Overview

Briefly introduces the product specifications, as well as the features

and applications of the H3C SecPath U200 series UTM devices.

2 Interface Modules

Describes the interface cards and interface modules supported by

the H3C SecPath U200 series UTM devices.

3 Preparing for Installation

Describes the site requirements for installing the H3C SecPath U200

series UTM devices, safety recommendations before and during

installation, and required tools.

4 Installing the U200 Series

Device

Introduces how to install an H3C SecPath U200 series UTM device,

as well as how to connect the power cable, console cable, Ethernet

cable, and interface cable.

5 Starting and Configuring

the U200 Series Device

Describes how to boot and configure an H3C SecPath U200 series

UTM device, including device startup, power-on, and initialization of

system files.

6 Maintaining Software

Introduces how to maintain software of the H3C SecPath U200

series UTM devices, including upgrading software and updating

configuration files.

7 Maintaining Hardware

Introduces how to maintain hardware of the H3C SecPath U200

series UTM devices.

8 Troubleshooting

Describes some problems you may encounter during installation and

startup of an H3C SecPath U200 series UTM device and how to

solve them.

Appendix Compliance and

Safety Manual

This section introduces part of the compliance and safety

precautions that should be followed during the installation and

maintenance of the equipment.

Conventions

The manual uses the following conventions:

Command conventions

Convention Description

Boldface

The keywords of a command line are in Boldface.

italic

Command arguments are in italic.

[ ] Items (keywords or arguments) in square brackets [ ] are optional.

{ x | y | ... }

Alternative items are grouped in braces and separated by vertical bars.

One is selected.

[ x | y | ... ]

Optional alternative items are grouped in square brackets and

separated by vertical bars. One or none is selected.

{ x | y | ... } *

Alternative items are grouped in braces and separated by vertical bars.

A minimum of one or a maximum of all can be selected.

Convention Description

[ x | y | ... ] *

Optional alternative items are grouped in square brackets and

separated by vertical bars. Many or none can be selected.

&<1-n>

The argument(s) before the ampersand (&) sign can be entered 1 to n

times.

# A line starting with the # sign is comments.

GUI conventions

Convention Description

Boldface

Window names, button names, field names, and menu items are in

Boldface. For example, the New User window appears; click OK.

>

Multi-level menus are separated by angle brackets. For example, File >

Create > Folder.

Symbols

Convention Description

Means reader be extremely careful. Improper operation may cause

bodily injury.

Means reader be careful. Improper operation may cause data loss or

damage to equipment.

Means a complementary description.

Related Documentation

In addition to this manual, each H3C SecPath Series Security Products documentation set includes the

following:

Manual Description

H3C SecPath Series Security

Products User Manual

Describes the features, operation fundamentals, and configuration

commands of the H3C SecPath series security products, guides

you to make configuration, and provides configuration examples.

Obtaining Documentation

You can access the most up-to-date H3C product documentation on the World Wide Web at this URL:

http://www.h3c.com.

The following are the columns from which you can obtain different categories of product documentation:

[Products & Solutions]: Provides information about products and technologies.

[Technical Support & Document > Technical Documents]: Provides several categories of product

documentation, such as installation, configuration, and maintenance.

[Technical Support & Document > Software Download]: Provides the documentation released with the

software version.

Documentation Feedback

You can e-mail your comments about product documentation to [email protected].

We appreciate your comments.

Environmental Protection

This product has been designed to comply with the requirements on environmental protection. For the

proper storage, use and disposal of this product, national laws and regulations must be observed.

i

Table of Contents

1 Product Overview······································································································································1-1

Introduction ·············································································································································1-1

Features ··········································································································································1-1

Physical Description································································································································1-2

U200-A ············································································································································1-2

U200-M············································································································································1-3

U200-S ············································································································································1-4

Technical Specifications··························································································································1-5

Processor and Storages··················································································································1-5

Dimensions and Weight···················································································································1-5

Fixed Interfaces and Slots···············································································································1-6

Power Input ·····································································································································1-6

Operating Environment Specifications ····························································································1-6

Components············································································································································1-7

Processor and Storages··················································································································1-7

Front Panel LEDs ····························································································································1-7

Fixed Interfaces ·······························································································································1-8

AC Power Input ·····························································································································1-14

Clock··············································································································································1-14

Port Lightning Arrester (Optional)··································································································1-14

Power Lightning Arrester (Optional) ······························································································1-15

Signal Lightning Arrester (Optional) ······························································································1-15

System Software ···························································································································1-16

1-1

1 Product Overview

Introduction

The H3C SecPath U200 Series Unified Threat Management Products are new-generation UTM devices

designed for enterprise users.

The U200 series comprises three models:

z U200-A: Designed for large- and medium-sized enterprise users

z U200-M: Designed for medium-sized enterprise users

z U200-S: Designed for small- and medium-sized enterprise users

In addition to traditional firewall functions, the U200 series protect network security by providing a wide

range of functions including virtual firewall, security zone, intrusion detection and protection, gateway

anti-virus, anti-spam, P2P traffic control, and URL filtering. With the application specification packet filter

(ASPF) technology, a U200 series device can monitor connection setup processes and illegal

operations, and dynamically filter packets based on ACLs. Moreover, the U200 series support multiple

VPN services including IPSec VPN, L2TP VPN, and GRE VPN, and thereby can be used for

constructing a variety of VPN networks. The series deliver abundant routing capabilities and support

RIP and OSPF. Adopting a high-performance multi-core CPU, the U200-A, U200-M and U200-S can

support up to 10, 8, and 7 GE interfaces respectively, delivering high scalability for user investment

protection.

The U200 series are available with AC power supply to ensure high reliability, fully satisfy requirements

for network maintenance, update, and optimization, support detection of chassis internal temperature,

support network management, and provide a Web management interface.

The U200-A provides two MIM expansion slots for future service expansion. Currently, the slots support

the NSQ1GT2UA0 and NSQ1GP4U0 MIM modules.

The U200-M provides one MIM expansion slot and currently supports the same MIM as the U200-A

does.

The U200-S provides a mini expansion slot for future service expansion. Currently, the device supports

the 2-GE and NSQ1WLAN0 interface modules.

Features

The U200 series deliver the following features:

Powerful hardware platform

The U200 series perfectly fit in enterprise networks thanks to the adoption of MIPS64-based CPUs and

integrated high-performance hardware-based VPN accelerators.

Abundant security protection functions

z Security zone management: You can create security zones based on physical interfaces, logical

interfaces, Layer-2 Ethernet interfaces, or combinations of Layer-2 Ethernet interfaces and VLANs.

Interfaces belonging to the same security zone share the same security requirements in security

1-2

policy control. With security zones, security administrators can classify interfaces with different

security requirements into different zones. This simplifies policy maintenance and separates

network services and security services.

z Packet filtering: Applies standard or extended ACL rules between security zones to implement

packet filtering based on UDP or TCP port information. You can also implement packet filtering

based on time ranges.

z Application specific packet filter (ASPF): Dynamically determines whether to forward or drop a

packet by checking its application layer protocol information (such as FTP, HTTP, SMTP, RTSP, or

any other application layer protocol carried on TCP/UDP), monitoring the status of

connection-oriented application layer protocols, and maintaining status information for each

connection.

z P2P traffic control: Performs in-depth packet inspection to identify and manipulate P2P traffic. With

various control policies, a U200 series device controls P2P traffic flexibly.

z Virtual firewall: You can create multiple virtual firewalls, each implementing a separate security

policy. These virtual firewalls are isolated from one another and thus can be managed separately.

z Diverse attack prevention functions: Guards against attacks including Land, Smurf, Fraggle,

WinNuke, Ping of Death, Tear Drop, IP Spoofing, IP fragment, fragment, TCP flag invalid, large

ICMP packet, IP Sweep, port scan, and DDoS attacks such as SYN Flood, UDP Flood, and ICMP

Flood.

z Packet filtering: Blocks specified URLs to better utilize network resources.

Powerful VPN functions

z IPSec and GRE

z IKE and PKI

z A built-in hardware-based VPN encryption engine, ensuring high-performance VPN processing

Physical Description

U200-A

Front view

Figure 1-1 U200-A front view

(1) 10/100/1000 Mbps electrical Ethernet

interface 0

(2) 10/100/1000 Mbps electrical Ethernet

interface 1

(3) 10/100/1000 Mbps electrical Ethernet

interface 2

(4) 10/100/1000 Mbps electrical Ethernet

interface 3

(5) 10/100/1000 Mbps electrical Ethernet

interface 4

(6) 10/100/1000 Mbps electrical Ethernet

interface 5

(7) Console port (CONSOLE) (8) USB interface

(9) CF card ejector button (10) CF card slot

(11) System LED (SYS) (12) Slot 2 LED (SLOT2)

(13) Slot 1 LED (SLOT1) (14) Power LED (PWR)

(15) CF card LED (CF)

1-3

Rear view

Figure 1-2 U200-A rear view

(1) (2) (3) (4) (5) (6)

(1) Grounding screw and symbol (2) OPEN BOOK symbol

(3) AC power switch (ON/OFF) (4) AC power socket

(5) Slot 1 (with an NSQ1GT2UA0 module

installed)

(6) Slot 2 (with an NSQ1GT2UA0 module

installed)

The open book symbol is used to remind the operator to read the relevant chapters when performing

any of these operations on the U200-A:

z Connecting the ESD-preventive wrist strap

z Installing the device on a workbench or in a rack

z Connecting the PGND cable or the AC power cord

z Connecting the power lightning arrester, signal lightning arrester, or port lightning arrester

z Connecting the console cable, AUX cable, or Ethernet cables

z Opening and closing the chassis cover

z Installing or removing the mini card (available only on the U200-S), MIM module (available only on

the U200-A and U200-M), or CF card

U200-M

Front view

Figure 1-3 U200-M front view

(1) 10/100/1000 Mbps electrical Ethernet

interface 0

(2) 10/100/1000 Mbps electrical Ethernet

interface 1

(3) 10/100/1000 Mbps electrical Ethernet

interface 2

(4) 10/100/1000 Mbps electrical Ethernet

interface 3

(5) 10/100/1000 Mbps electrical Ethernet

interface 4

(6) 10/100/1000 Mbps electrical Ethernet

interface 5

(7) Console port (CONSOLE) (8) USB interface

(9) CF card ejector button (10) CF card slot

(11) System LED (SYS) (12) Slot 1 LED (SLOT1)

(13) Power LED (PWR) (14) CF card LED (CF)

1-4

Rear view

Figure 1-4 U200-M rear view

(1) Grounding screw and symbol (2) OPEN BOOK symbol

(3) AC power switch (ON/OFF) (4) AC power socket

(5) Slot 1 (with an NSQ1GT2UA0 module installed)

For detailed description of the OPEN BOOK symbol, refer to the note under Figure 1-2.

U200-S

Front view

Figure 1-5 U200-S front view

(1) 10/100/1000 Mbps electrical Ethernet

interface 0

(2) 10/100/1000 Mbps electrical Ethernet

interface 1

(3) 10/100/1000 Mbps electrical Ethernet

interface 2

(4) 10/100/1000 Mbps electrical Ethernet

interface 3

(5) 10/100/1000 Mbps electrical Ethernet

interface 4

(6) Console port (CONSOLE)

(7) USB interface (8) CF card ejector button

(9) CF card slot (10) System LED (SYS)

(11) Slot LED (SLOT) (12) Power LED (PWR)

(13) CF card LED (CF)

1-5

Rear view

Figure 1-6 U200-S rear view

(1) AC power socket (2) Slot (with 2GE)

(3) OPEN BOOK symbol (4) Grounding screw and sign

For detailed description of the open book symbol, refer to the note under Figure 1-2.

Technical Specifications

Processor and Storages

Table 1-1 Processor and storages of the U200 series

Description

Item

U200-A U200-M U200-S

Processor RMI XLS208 750 MHz RMI XLS404 800 MHz

Flash 32 MB

Memory type and size

DDR2 SDRAM

1 GB by default

DDR2 SDRAM

512 MB by default

External CF card 256 MB, 512 MB, or 1 GB

Dimensions and Weight

Table 1-2 Dimensions and weight of the U200 series

Description

Item

U200-A U200-M U200-S

Dimensions (H × W × D),

excluding feet and

mounting brackets

44.2 × 442 × 400 mm (1.74 × 17.40 × 15.75 in.)

43.6 × 300 × 260

mm (1.72 × 11.81 ×

10.24 in.)

Weight (fully configured)

5.9 kg (13.01 lb) 5.5 kg (12.13 lb) 2.22 kg (4.89 lb)

1-6

Fixed Interfaces and Slots

Table 1-3 Interface (fixed) and slot specifications

Description

Item

U200-A U200-M U200-S

Console port 1 (9600 bps to 115200 bps, 9600 bps by default)

USB

interface

1 (host mode, reserved without software support)

6 (GE0 to GE5) 5 (GE0 to GE4)

GE

interfaces

10/100/1000 Mbps electrical interfaces, MDI/MDIX autosensing

CF card slot 1 external CF card slot (256 MB, 512 MB, or 1 GB)

Slots

2 MIM expansion slots

Available interface module:

NSQ1GT2UA0 and

NSQ1GP4U0

1 MIM expansion slot

Available interface module:

NSQ1GT2UA0 and

NSQ1GP4U0

1 Mini expansion slot

Available interface

module: 2GE and

NSQ1WLAN0

Power Input

Table 1-4 Input voltage specifications

Description

Item

U200-A U200-M U200-S

Rated voltage range

100 VAC to 240 VAC; 50 Hz or 60 Hz

Maximum input current

1.6 A 0.6 A

Maximum power

100 W 54 W

Operating Environment Specifications

Table 1-5 Operating environment specifications

Description

Item

U200-A U200-M U200-S

Operating temperature

0°C to 45°C (32°F to 113°F)

Operating humidity

(noncondensing)

10% to 95%

Operating altitude

–60 to 3000 m (–196.85 to +9842.52 ft.)

–60 to 2000 m (–196.85

to +6561.68 ft.)

1-7

Components

Processor and Storages

Processor

A U200 series device uses a multi-core microprocessor as its data forwarding and service processing

engine.

Flash

A U200 series device uses a 32 MB flash for storing BootWare and APP.

Memory

The memory temporarily stores data for the running system and buffering data to be forwarded. By

default, the U200-A and U200-M are equipped with a 1 GB memory while the U200-S has a 512 MB

memory.

Front Panel LEDs

Figure 1-7 U200-A front panel LEDs

Figure 1-8 U200-M front panel LEDs

Figure 1-9 U200-S front panel LEDs

Table 1-6 Description of the front panel LEDs

LED Status Description

Off

No CF card is in position or the CF card cannot be

identified.

On

A CF card is in position and has passed the test. It can

be removed in this state.

CF (green)

Blinking

The system is accessing the CF card. Do not unplug

the card in this state.

1-8

LED Status Description

Off The system is powered off or faulty.

Slow blinking (at 1 Hz)

The interface module is operating normally as

configured.

SYS (green)

Fast blinking (at 8 Hz) Software is being loaded or the system is not working.

Off The power module is not working or faulty.

PWR (green)

On The power module is supplying power normally.

Off

No interface module is in the slot or the interface

module is faulty.

SLOT1/SLOT2/

SLOT (green)

On

An interface module is in the slot and operating

normally.

Fixed Interfaces

Table 1-7 Description of the fixed interfaces

Interface Description

Console port 1

USB interface 1 Host mode, reserved without software support

U200-A 6 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE5

U200-M 6 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE5

GE

interfaces

U200-S 5 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE4

CF card slot 1

Three CF card options of different memory sizes are available:

z 256 MB

z 512 MB

z 1 GB

Console port

1) Introduction

A U200 series device provides an RS232 asynchronous serial console port (Console), which can be

connected to a computer for system debugging, configuration, maintenance, management, and

software loading.

2) Specifications

Table 1-8 Technical specification of the console port

Attribute Description

Connector type

RJ-45

Interface standard

Asynchronous EIA/TIA-232

Baud rate

9600 bps (default) to 115200 bps

Maximum transmission distance

15 m (49.21 ft.)

1-9

Attribute Description

Services

Connection to an ASCII terminal

Connection to the serial interface of a local PC to run the

terminal emulation program

Command line interface

3) Console cable

The console cable is an 8-core shielded cable. The RJ-45 connector at one end of the cable is for the

console port on the UTM device, and the DB-9 female connector at the other end is for the serial port on

a configuration terminal.

Figure 1-10 illustrates the console cable.

Figure 1-10 Console cable

Table 1-9 Console cable pinouts

RJ-45 Signal direction DB9 Signal

1

Æ

8 CTS

2

Æ

6 DSR

3

Æ

2 RXD

4

Å

1 DCD

5 — 5 GND

6

Å

3 TXD

7

Å

4 DTR

8

Å

7 RTS

For how to connect the console cable, refer to the “Connecting the Console Cable” section in Chapter 4

“Installing the U200 Series Device.”

Ethernet interfaces

1) Introduction

A UTM series device provides fixed 10/100/1000Base-T Ethernet interfaces on its front panel, the

number of which depends on the device model. Each fixed Ethernet interface (RJ-45) uses two built-in

1-10

LEDs in the upper corners to indicate its status.

Table 1-10 Description of Ethernet interface LEDs

Status Description

Off No link is present.

LINK

On A link is present.

Off No data is being received or transmitted.

ACT

Blinking Data is being received or transmitted.

2) Specifications

Table 1-11 Technical specifications of the Ethernet interfaces

Item Description

Connector type RJ-45

Interface type

Autosensing (Ethernet does not support MDI/MDIX autosensing when

working in the forced mode)

Frame format

Ethernet_II

Ethernet_SNAP

10 Mbps (autosensing)

Half-/full-duplex auto-negotiation

100 Mbps (autosensing)

Half-/full-duplex auto-negotiation

Rate and negotiation

mode

1000 Mbps (autosensing)

Full-duplex auto-negotiation

The media dependent interface (MDI) standard is typically used for the Ethernet interfaces of network

adaptors. The media dependent interface crossover (MDI-X) standard is typically used on hubs or LAN

switches.

3) RJ-45 connector

The 10/100/1000Base-T Ethernet interfaces of the U200 series use RJ-45 connectors and support

MDI/MDIX autosensing. Category-5 twisted pair cables are used for RJ-45 connectors.

Figure 1-11

shows an RJ-45 connector.

Figure 1-11 RJ-45 connector

1-11

When working in the forced mode, Ethernet does not support MDI/MDIX autosensing.

4) Cable connecting electrical Ethernet interfaces

Ethernet electrical interfaces usually use category-5 twisted pair cables. Ethernet cables fall into two

categories:

z Standard cables: Also known as straight-through cables. At both ends of a standard cable, wires

are crimped in the RJ-45 connectors in the same sequence. A straight-through cable is used for

connecting a terminal (for example, a PC or UTM device) to a hub or LAN switch. Straight-through

cables are shipped with the U200 series.

z Crossover cables: At both ends of a crossover cable, wires are crimped in the RJ-45 connectors in

different sequences. A crossover cable is used for connecting two terminals (for example, two PCs

or UTM devices). You can make crossover cables yourself as needed.

Figure 1-12 Ethernet cable

Table 1-12 Straight-through cable connector pinouts

RJ-45 Signal

Category-5

twisted pair

Signal direction RJ-45

1 TX+ White (Orange)

Æ

1

2 TX- Orange

Æ

2

3 RX+

White (Green)

Å

3

4 — Blue

— 4

5 — White (Blue)

— 5

6 RX- Green

Å

6

7 — White (Brown)

— 7

8 — Brown

— 8

Table 1-13 Crossover cable connector pinouts

RJ-45 Signal direction

Category-5

twisted pair

Signal direction RJ45

1 TX+ White (Orange)

Æ

3

2 TX- Orange

Æ

6

3 RX+ White (Green)

Å

1

1-12

RJ-45 Signal direction

Category-5

twisted pair

Signal direction RJ45

4 — Blue — 4

5 — White (Blue) — 5

6 RX- Green

Å

2

7 — White (Brown) — 7

8 — Brown — 8

z You can refer to the tables above when trying to identify or preparing the two types of Ethernet

cables.

z When preparing Ethernet cables, follow the color pairings in the tables. Otherwise, communication

quality will be affected even if the two devices at both ends can communicate.

z When preparing Ethernet cables, use shielded cables preferentially for electromagnetic

compatibility.

USB interface

USB interfaces can connect multiple types of devices and provide higher data transfer rates than

common parallel interfaces and serial interfaces.

The U200 series support USB 2.0 to provide important storage and security functions. For example,

with USB interfaces, you can provide large flash memory space for application programs, configuration

files, and VPN certificates for setting up secure VPN connections and, secure distribution of

configuration files.

In addition, USB interfaces provide a backup CF card mechanism to make file backup and restoration

easy and reliable.

Figure 1-13 USB interface

The USB interface provided by a U200 series device is a USB 2.0 type-A interface. Serving as a host, it

can connect an external USB device to expand the device's storage space for storing files and logs and

in addition, facilitate file transfer.

1-13

z At present, the USB interface provided on a U200 series device is a reserved module without

software support.

z Use the USB flash drives provided by H3C only, because the U200 series may be incompatible

with other USB flash drives.

z Avoid removing the USB flash drive when its LED is flashing. Doing so may cause the file system

on the drive to get corrupted.

CF card

1) Introduction

A compact flash (CF) card is used for storing logs, host files, and configuration files.

A U200 series device provides an external CF card slot for expanding storage space.

Three CF card options of different memory sizes are available:

z 256 MB

z 512 MB

z 1 GB

Use the CF cards provided by H3C only, because the U200 series may be incompatible with other CF

cards.

2) CF card slot

Figure 1-14 CF card

(1) Ejector button (2) CF card slot

(3) CF card LED (CF)

3) CF card LED

For description of the CF card LED, see

Table 1-6.

1-14

The CF card is hot-swappable. When the device is reading from or writing to the CF card or performing

any other file system related operation, the CF card LED blinks. Do not unplug the CF card in this state

because doing so can corrupt the file system in it.

AC Power Input

Table 1-14 lists the AC power specifications for the U200 series.

Table 1-14 AC power specifications

Description

Item

U200-A U200-M U200-S

Rated voltage range

100 VAC to 240 VAC; 50 Hz or 60 Hz

Maximum input current

1.6 A

0.6 A

Maximum power

100 W 54 W

Clock

The U200 series are designed with a clock module for providing system time. You can set the system

time at the command line interface.

The clock module can work despite power failure to ensure that the system time is correct at reboot.

With the device powered off, the clock module can work for at least 10 years.

Note that:

z Never replace the clock module battery when power is present on the device.

z The system time gets lost once the clock module battery is removed. You can set it at the

command line interface.

You can use three commands including clock datetime, ock summer-time one-off (or clock

summer-time repeating), and clock timezone to complete setting the system time. See the

accompanying documentation for how to do that.

Port Lightning Arrester (Optional)

Before connecting an outdoor Ethernet cable to an Ethernet port, install a port lightning arrester to

protect the device against lightning strikes.

The port lightning arresters available for the U200 series feature these:

Page is loading ...

3com SECPATH U200-CS, SECPATH U200A, SECPATH U200M, SECPATH U200S, U200-M/A 2-PORT 10/100/1000 MODULE, U200-M/A 4-PORT 1000X MODULE, U200-S 2-PORT 10/100/1000 MODULE Installation guide

Related papers

Other documents