H3C SecPath F5000-AI-20 Installation Manual Download Page 1

Page: 1 / 65

H3C SecPath F5000-AI-20[40] Firewalls

Installation Guide

New H3C Technologies Co., Ltd.
http://www.h3c.com

Document version: 6W100-20211224

Summary of Contents for SecPath F5000-AI-20

Page 1: ...H3C SecPath F5000 AI 20 40 Firewalls Installation Guide New H3C Technologies Co Ltd http www h3c com Document version 6W100 20211224 ...

Page 2: ...respective owners Notice The information in this document is subject to change without notice All contents in this document including statements information and recommendations are believed to be accurate but they are presented without warranty of any kind express or implied H3C shall not be liable for technical or editorial errors or omissions contained herein Environmental protection This produc...

Page 3: ...eplace with actual values Square brackets enclose syntax choices keywords or arguments that are optional x y Braces enclose a set of required syntax choices separated by vertical bars from which you select one x y Square brackets enclose a set of optional syntax choices separated by vertical bars from which you select one or none x y Asterisk marked braces enclose a set of required syntax choices ...

Page 4: ...a generic network device such as a router switch or firewall Represents a routing capable device such as a router or Layer 3 switch Represents a generic switch such as a Layer 2 or Layer 3 switch or a router that supports Layer 2 forwarding and other Layer 2 features Represents an access controller a unified wired WLAN module or the access controller engine on a unified wired WLAN switch Represent...

Page 5: ...hardware model configuration or software version It is normal that the port numbers sample output screenshots and other information in the examples differ from what you have on your device Documentation feedback You can e mail your comments about product documentation to info h3c com We appreciate your comments ...

Page 6: ...r Ethernet port 2 9 Connecting a fiber port 2 9 Connecting the power cord 2 11 Connecting an AC power cord 2 11 Connecting a DC power cord 2 12 Verifying the installation 2 13 3 Accessing the firewall for the first time 3 1 Setting up the configuration environment 3 1 Powering on the firewall 3 1 Checking before power on 3 1 Powering on the firewall 3 1 Checking after power on 3 1 Logging in to th...

Page 7: ...Password loss 6 2 Cooling system failure 6 2 Software loading failure 6 2 7 Appendix A Chassis views and technical specifications 7 3 Chassis views 7 3 Front panel 7 3 Interface modules 7 4 Power supplies 7 6 Fan trays 7 7 Technical specifications 7 8 Dimensions and weights 7 8 Memory and storage media 7 9 Power consumption 7 9 Power supply specifications 7 9 Fan tray specifications 7 10 Drive spe...

Page 8: ... General safety recommendations Do not place the firewall on an unstable case or desk The firewall might be severely damaged in case of a fall Make sure the ground is dry and flat and anti slip measures are in place Keep the chassis and installation tools away from walk areas Keep the chassis clean and dust free Do not place the firewall near water or in a damp environment Prevent water or moistur...

Page 9: ...cted transceiver modules to avoid damage caused by built up dust Insert a dust plug into empty fiber ports Handling safety When you move the firewall follow these guidelines Move and unpack the firewall carefully to avoid firewall damage Unpack the firewall at least half an hour and power on the firewall at least two hours after you move it from a place below 0 C 32 F to the equipment room This pr...

Page 10: ...ity and lifespan of the firewall For the temperature and humidity requirements of the firewall see Table1 2 Table1 2 Temperature humidity requirements Temperature Relative humidity Operating Without drives 0 C to 45 C 32 F to 113 F With drives 5 C to 40 C 41 F to 104 F Storage 40 C to 70 C 40 F to 158 F Operating Without drives 5 RH to 95 RH noncondensing With drives 10 RH to 90 RH noncondensing S...

Page 11: ...ween the firewall and its adjacent devices when installing the firewall in a rack The firewall uses front rear air isles Select fan trays that match the airflow direction at the installation site for the firewall The FAN 20F 2 A fan tray provides power supply side intake and port side exhaust airflows It has a blue handle Figure1 1 Airflow direction of the firewall installed with FAN 20F 2 A fan t...

Page 12: ...SD wrist strap when you install or remove a transceiver module No ESD wrist strap is provided with the firewall Purchase one yourself Before you attach an ESD wrist strap make sure the rack is reliably grounded To attach the ESD wrist strap 1 Wear the wrist strap on your wrist 2 Lock the wrist strap tight around your wrist to keep good contact with the skin 3 Secure the wrist strap lock and the al...

Page 13: ... the AC power receptacle is reliably grounded If an AC power cord is routed from outdoors for connecting to the firewall connect the power cord first to a power lightning arrester before connecting it to the power receptacle on the firewall If a network cable is routed from outdoors for connecting to an Ethernet port on the firewall connect the network cable first to a network port lightning arres...

Page 14: ...earance of 1 U 44 45 mm 1 75 in between the firewall and its adjacent devices when installing the firewall in a rack A ventilation system is available at the installation site Temperature Operating Without drives 0 C to 45 C 32 F to 113 F With drives 5 C to 40 C 41 F to 104 F Storage 40 C to 70 C 40 F to 158 F Relative humidity Operating Without drives 5 RH to 95 RH noncondensing With drives 10 RH...

Page 15: ...ay from radio stations radar and high frequency devices working in high current Use electromagnetic shielding when necessary Lightning protection The grounding cable of the chassis is reliably grounded The grounding terminal of the AC power receptacle is reliably grounded Optional A power lightning arrester is installed Power supply Verify that the power system at the installation site meets the r...

Page 16: ...cover intact and if you want to open the chassis contact the local agent of H3C for permission Otherwise H3C shall not be liable for any consequence caused thereby The installation method is similar for the F5000 AI 20 and F5000 AI 40 firewalls This section uses the F5000 AI 40 firewall as an example ...

Page 17: ...ion flow Ground the device Install fan trays Install interface modules Install power supplies End Install the device in a 19 inch rack Start Connect power cords Verify the installation Install drives Connect Ethernet interface cables ...

Page 18: ...nt and the auxiliary grounding point This section uses the primary grounding point as an example To connect the grounding cable 1 Remove the grounding screw from the primary grounding point at the firewall rear 2 Attach the grounding screw to the ring terminal of the grounding cable 3 Use a screwdriver to fasten the grounding screw into the grounding hole 4 Connect the other end of the grounding c...

Page 19: ...ake sure the rack is sturdy and reliably grounded 2 Wear an ESD wrist strap and unpack the firewall and accessories 3 Use a mounting bracket and a slide rail to mark the cage nut installation positions on the front and rear rack posts respectively Four cage nuts are required on each front rack post and two are required on each rear rack post 4 Install cages nuts at the marked positions 5 Use M6 sc...

Page 20: ...ck posts 8 Fasten the M6 rack screws with a Phillips screwdriver to secure the mounting brackets to the front rack posts Figure2 5 Mounting the firewall in the rack Installing a power supply CAUTION Make sure the power supply is powered off and the firewall is correctly grounded before installation Install a filler panel over an empty power supply slot to prevent dust and ensure good ventilation i...

Page 21: ...ly in slot PWR1 remove the filler panel from the slot To install the power supply in slot PWR2 skip this step Figure2 6 Removing the filler panel 2 Install the power supply in a correct direction with the power receptacle at right a Grasp the handle of the module with one hand and support the module bottom with the other b Push the power supply along the guide rails into the slot until it has firm...

Page 22: ...d the connectors on the backplane insert the fan tray gently If you encounter any resistance while inserting the fan tray pull out the fan tray re orient it and then insert it again No fan tray is provided with the firewall Purchase fan trays as required The firewall supports the FAN 20B 2 A and FAN 20F 2 A fan trays The firewall supports hot swapping of fan trays The installation procedures for t...

Page 23: ...illips screwdriver and remove the filler panel Keep the filler panel for future use 3 Open the ejector levers on the module and slide the module steadily into the slot along the guide rails 4 Close the ejector levers until they touch the panel tightly and the module seats into the backplane 5 Fasten the captive screws on the module with a Phillips screwdriver Figure2 9 Installing an interface modu...

Page 24: ...r network cable to connect a copper Ethernet port For more information about Ethernet twisted pair cables see Ethernet twisted pair cable To connect a copper Ethernet port 1 Connect one end of the Ethernet cable to the copper Ethernet port of the firewall and the other end to the Ethernet port of the peer device 2 Examine whether the LEDs of the Ethernet port are normal For more information about ...

Page 25: ...iber first install the transceiver module in the fiber port and then connect the fiber Insert a dust plug into any open fiber port Make sure the Tx and Rx ports on a transceiver module are connected to the Rx and Tx ports on the peer end respectively The firewall supports GE SFP transceiver modules 10GE SFP transceiver modules and 40GE QSFP transceiver modules For the transceiver module specificat...

Page 26: ...r into the transceiver module in the firewall and plug the other end into the transceiver module in the peer device Make sure the Rx port and the Tx port are connected to the Tx port and the Rx port on the peer device respectively Figure2 14 Connecting a fiber port Connecting the power cord CAUTION Make sure the grounding cable of the firewall is correctly connected and the power source is powered...

Page 27: ...rectly orient the DC power cord plug with the power receptacle on the power supply and insert the plug into the receptacle 2 Use a removable cable tie to secure the DC power cord to the power supply handle 3 Connect the other end of the power cord to the DC power source 1 2 4 3 ...

Page 28: ... installation After installation verify that There is enough space for heat dissipation around the firewall and the firewall is steady All screws are fastened The grounding cable and power cord are securely connected The correct power source is used 1 2 4 3 ...

Page 29: ...d The correct power source is used The console cable is correctly connected the terminal or PC used for configuration has started and the configuration parameters have been correctly set The interface module if any is correctly installed Powering on the firewall Switch on the power source of the firewall Checking after power on After powering on the firewall verify that The LEDs on the front panel...

Page 30: ...assed Known answer test for SHA256 passed Known answer test for SHA384 passed Known answer test for SHA512 passed Known answer test for HMAC SHA1 passed Known answer test for HMAC SHA224 passed Known answer test for HMAC SHA256 passed Known answer test for HMAC SHA384 passed Known answer test for HMAC SHA512 passed Known answer test for AES passed Known answer test for RSA signature verification p...

Page 31: ...B at the prompt the system starts to read and decompress program files To enter the EXTENDED BOOT menu afterwards you need to reboot the firewall Logging in to the firewall For more information about logging in to the firewall see the configuration guides and command references for the firewall Logging in from the console port You can use the console port to access the firewall for the first time ...

Page 32: ...n the firewall 2 Configure an IP address in subnet 192 168 0 0 24 for the PC Make sure the PC and the firewall are reachable to each other The PC must use a different IP address than the Ethernet management interface 3 Start a browser enter 192 168 0 1 in the address bar and press Enter 4 Enter the default username admin and password admin and then click Login Logging in through Telnet 1 Log in to...

Page 33: ...s and rotating axis even if they are not rotating To replace a fan tray 1 Holding the fan tray handle with one hand and supporting the fan tray bottom with the other pull the fan tray out of the slot along the guide rails 2 Put the removed fan tray into an antistatic bag 3 Install a new fan tray For the installation procedure see Installing a fan tray Figure4 1 Removing a fan tray Replacing a powe...

Page 34: ...tallation procedure see Installing a power supply If you are not to install a new power supply install a filler panel in the power supply slot Replacing an interface module CAUTION The firewall does not support hot swapping of interface modules Before replacing an interface module first power off the firewall To replace an interface module 1 Power off the firewall 2 Use a Phillips screwdriver to l...

Page 35: ...the file systems before removing a drive The device does not support hot swapping of drives To replace a drive 1 Wear an ESD wrist strap and make sure it makes good skin contact and is reliably grounded 2 Press the red button on the drive panel to release the locking lever 3 Hold the locking lever and pull the drive out of the slot 4 Install a new drive For the installation procedure see Installin...

Page 36: ...en plating To replace a transceiver module 1 Use the shutdown command in interface view at the CLI to shut down the optical source before you remove the fiber connector 2 Remove the LC connectors with the optical fiber from the transceiver module and install dust caps to the LC connectors 3 Pivot the clasp of the transceiver module down to the horizontal position and gently pull the transceiver mo...

Page 37: ... Ver 1 0 CPLD_A 1 0 CPLD_B 1 0 CFCard Num 0 Displaying the software and hardware version information for the firewall Use the display version command to display software and hardware version information for the firewall Sysname display version H3C Comware Software Version 7 1 064 Alpha 9606P03 Copyright c 2004 2017 New H3C Technologies Co Ltd All rights reserved H3C SecPath F5000 AI 40 uptime is 0...

Page 38: ...ame display device manuinfo Slot 1 CPU 0 DEVICE_NAME SecPath F5000 AI 40 DEVICE_SERIAL_NUMBER 210235A1XYH175000008 MAC_ADDRESS 1CAB 3497 D7DE MANUFACTURING_DATE 2019 06 11 VENDOR_NAME H3C Fan 0 The operation is not supported on the specified fan Fan 1 The operation is not supported on the specified fan Fan 2 The operation is not supported on the specified fan Fan 3 The operation is not supported o...

Page 39: ... average CPU usage at intervals of 5 minutes Displaying the memory usage of the firewall Use the display memory command to display the memory information of the firewall Sysname display memory Memory statistics are measured in KB Slot 1 Total Used Free Shared Buffers Cached FreeRatio Mem 32870736 4244812 28625924 0 2048 200756 87 1 Buffers Cache 4042008 28828728 Swap 0 0 0 Table5 3 Output descript...

Page 40: ...ption Field Description Power Number of the power supply Status Power supply status Normal The power supply is operating correctly Absent No power supply is present Abnormal The power supply is faulty Displaying the operational status of fan trays Use the display fan command to display the operational status of fan trays Sysname display fan SLOT 1 Fan 0 0 Status Normal Speed 7692 SLOT 1 Fan 0 1 St...

Page 41: ...ture information degree centigrade Slot Sensor Temperature LowerLimit Warning UpperLimit Alarm UpperLimit S hutdown UpperLimit 1 inflow 1 36 0 60 70 NA 1 inflow 2 34 0 60 70 NA 1 outflow 1 42 0 60 70 NA 1 hotspot 1 62 0 80 92 NA Table5 6 Output description Field Description Slot Slot number of the interface module Sensor Temperature sensor inflow Air inlet vent temperature sensor outflow Air outle...

Page 42: ... user view to decompress the file b Execute the gunzip diag gz command c Execute the more diag command d Press Page Up and Page Down Display the operational statistics for each functional module of the firewall Sysname display diagnostic information Save or display diagnostic information Y save N display Y N n display clock 17 22 11 UTC Mon 08 21 2017 Displaying transceiver module information Iden...

Page 43: ...eboot command for security To reboot a firewall use one of the following methods Use the reboot command to reboot the firewall immediately Enable the scheduled reboot function at the CLI You can set a time at which the firewall can automatically reboot or set a delay so that the firewall can automatically reboot within the delay Power on the firewall after powering it off which is also called hard...

Page 44: ... displays nothing or garbled text when the firewall is powered on Solution To solve the issue 1 Verify that the power supply system is operating correctly 2 Verify that the console cable is correctly connected 3 Verify that the console cable is connected to the serial port that is configured for the configuration terminal 4 Verify that the configuration terminal parameters are configured as follow...

Page 45: ...h temperature alarm threshold back up data immediately power off the firewall and contact your local sales agent Information about the firewall temperature in the display environment command output varies by firewall model 4 If the issue persists contact your local sales agent Software loading failure Symptom Software loading fails and the system runs the software of the previous version Solution ...

Page 46: ...ve slots on the front panel Figure7 1 Front panel 1 Interface module slots slots 1 through 8 2 Drive slot HD0 3 Drive slot HD1 4 LEDs Rear panel The firewall provides the following ports and slots on the rear panel Three combo interfaces including three 10 100 1000BASE T autosensing copper ports One management Ethernet port Four 1000BASE X fiber ports Two USB ports One console port Two fan tray sl...

Page 47: ...atibility with device slots Table7 1 displays the slots available for interface module installation Table7 1 Interface module and device slot compatibility Interface module Available slots NSQM1TG8A Slots 1 to 3 NSQM1QG2A Slots 1 to 3 NSQM1G4XS4 Slots 1 to 3 NSQM1GT8A Slots 4 to 8 NSQM1GP8A Slots 4 to 8 NSQM1GT4PFCA Slots 4 to 8 NOTE When an NSQM1TG8A or NSQM1G4XS4 interface module is installed in...

Page 48: ...fiber Ethernet ports 3 Captive screw 4 Ejector lever NSQM1G4XS4 The NSQM1G4XS4 interface module provides four 10GBASE R fiber Ethernet ports 10G SR LR and four 1000BASE X fiber Ethernet ports Figure7 5 NSQM1G4XS4 front view 1 LED 2 1000BASE X fiber Ethernet ports 3 10GBASE R fiber Ethernet ports 4 Captive screw 5 Ejector lever NSQM1GT8A The NSQM1GT8A interface module provides eight 10 100 1000BASE...

Page 49: ... T copper Ethernet ports that support the bypass function Figure7 8 NSQM1GT4PFCA front view 1 LED 2 10 100 1000BASE T copper Ethernet ports 3 Captive screw 4 Ejector lever Power supplies The firewall comes with power supply slot PWR0 installed with a filler panel and power supply slot PWR1 empty You can install two power supplies to achieve 1 1 power redundancy or install only one power supply If ...

Page 50: ...e firewall Purchase fan trays for the firewall as required The FAN 20F 2 A and FAN 20B 2 A fan trays are available for the firewall The FAN 20F 2 A fan tray provides power supply side intake and port side exhaust airflow The FAN 20B 2 A fan tray provides port side intake and power supply side exhaust airflow For the fan tray specifications see Fan tray specifications To ensure adequate heat dissip...

Page 51: ...tray 1 Handle 2 Alarm LED FAN 20B 2 A fan tray Figure7 12 FAN 20B 2 A fan tray 1 Handle 2 Alarm LED Technical specifications Dimensions and weights The weight of the firewall includes the chassis and its removable components as shown in Table7 2 1 2 1 2 ...

Page 52: ... lb NSQM1GT4PFCA 19 8 189 212 4 mm 0 78 7 44 8 36 in 0 6 kg 1 32 lb Memory and storage media Table7 3 Memory and storage media specifications Firewall model Flash Memory F5000 AI 20 4GB eMMC flash 16GB DDR3 F5000 AI 40 4GB eMMC flash 32GB DDR3 Power consumption The power consumption of the firewall is the total power consumption of the chassis and removable components as shown in Table7 4 Table7 4...

Page 53: ...ding the handle 84 5 87 209 mm 3 33 3 43 8 23 in Airflow direction FAN 20F 2 A From the power supply side to the port side FAN 20B 2 A From the port side to the power supply side Hot swapping Supported Max airflow volume 120 CFM Max power consumption 57 W Operating voltage 12 VDC Drive specifications Table7 8 NS SSD 480G SATA SFF specifications Item Specification Dimensions H W D 19 75 7 118 4 mm ...

Page 54: ...le7 10 GE copper port specifications Item Specification Connector RJ 45 Standard compliance 802 3 802 3u and 802 3ab Interface type MDI MDI X autosensing Cable type Category 5 or higher twisted pair cable Transmission distance 100 m 328 08 ft Interface speed and duplex mode 10 Mbps half full duplex 100 Mbps half full duplex 1000 Mbps full duplex NOTE The media dependent interface MDI standard is t...

Page 55: ...5 500 400 62 5 125 500 SFP GE LH40 SM1310 1310 SMF 9 125 N A SFP GE LH40 SM1550 1550 SMF 9 125 N A SFP GE LH80 SM1550 1550 SMF 9 125 N A SFP GE LH100 SM1550 1550 SMF 9 125 N A Table7 13 1000BASE X SFP transceiver module specifications 2 Transceiver module Transmission distance Transmitted optical power dBm Received optical power dBm SFP GE SX MM850 A 550 m 1804 46 ft 9 5 to 0 17 to 3 500 m 1640 42...

Page 56: ...m 62 14 miles 0 to 5 30 to 9 10 GE fiber port Table7 14 10 GE fiber port specifications Item Specification Connector type LC Transceiver module type SFP Standard compliance 10GBASE R Interface speed LAN PHY 10 Gbps Table7 15 SFP transceiver module specifications 1 Transceiver module Central wavelength nm Fiber mode Fiber diameter µm Mode bandwidth MHz km SFP XG SX MM850 A 850 MMF 50 125 2000 500 4...

Page 57: ... MM850 A 300 m 984 25 ft 10 31 Gbps 7 3 to 1 9 9 to 0 5 82 m 269 03 ft 66 m 216 54 ft 33 m 108 27 ft 26 m 85 30 ft 8 m 26 25 ft SFP XG LX220 MM131 0 220 m 721 78 ft 10 31 Gbps 6 5 to 0 5 6 5 to 1 5 220 m 721 78 ft 100 m 328 08 ft 220 m 721 78 ft 220 m 721 78 ft SFP XG LX SM1310 10 km 6 21 miles 10 31 Gbps 8 2 to 0 5 14 4 to 0 5 SFP XG LH40 SM1550 40 km 24 85 miles 10 31 Gbps 4 7 to 4 15 8 to 1 40 ...

Page 58: ...ver module specifications 2 Transceiver module Transmission distance Transmission speed Transmitted optical power dBm Received optical power dBm QSFP 40G SR4 MM850 100 m 328 08 ft 40 Gbps 7 6 to 0 9 5 to 2 4 150 m 492 13 ft QSFP 40G LR4 WDM1300 10 km 6 21 miles 40 Gbps 7 to 2 3 13 7 to 2 3 QSFP 40G CSR4 MM850 300 m 984 25 ft 40 Gbps 7 6 to 0 9 9 to 2 4 400 m 1312 34 ft 8 Appendix B LEDs Front pane...

Page 59: ... 100 1000BA SE T Flashing green The port is receiving or sending data Steady green A link is present Off No link is present Ethernet fiber port LED combo interface 1000BASE X Flashing green The port is receiving or sending data at 1000 Mbps Steady green A 1000 Mbps link is present Off No link is present Interface module LEDs Table8 2 Interface module LED description LED Mark Status Description Rea...

Page 60: ...ndix C Cables Console cable A console cable is an 8 core shielded cable with a crimped RJ 45 connector at one end and a DB 9 female connector at the other end The RJ 45 connector is for connecting to the console port of the firewall and the DB 9 female connector is for connecting to the serial port on the configuration terminal Figure9 1 Console cable Table9 1 Console cable connection RJ 45 Signal...

Page 61: ...nly used Table9 2 Description for commonly used Ethernet twisted pair cables Type Description Category 5 Suitable for data transmission at a maximum speed of 100 Mbps Category 5e Suitable for data transmission at a maximum speed of 1000 Mbps Category 6 Suitable for data transmission at a speed higher than 1 Gbps Based on whether a metal shielding is used Ethernet twisted pair cables can be classif...

Page 62: ... pin 8 brown solid Ethernet twisted pair cables can be classified into straight through and crossover cables based on their pinouts Straight through The pinouts at both ends are T568B compliant as shown in Figure9 3 Crossover The pinouts are T568B compliant at one end and T568A compliant at the other end as shown in Figure9 4 Figure9 3 Straight through cable Straight through cable white orange ora...

Page 63: ...C 5 Reserved N A BIDC Bi directional data cable C 6 Rx Receives data BIDB Bi directional data cable B 7 Reserved N A BIDD Bi directional data cable D 8 Reserved N A BIDD Bi directional data cable D Table9 4 RJ 45 MDIX port pinouts Pin 10Base T 100Base TX 1000Base T Signal Function Signal Function 1 Rx Receives data BIDB Bi directional data cable B 2 Rx Receives data BIDB Bi directional data cable ...

Page 64: ...ired length with the crimping tool 2 Strip off an appropriate length of the cable sheath The length is typically that of the RJ 45 connector 3 Untwist the pairs so that they can lay flat and arrange the colored wires based on the wiring specifications 4 Cut the top of the wires even with one another and insert the wires into the RJ 45 connector Make sure the wires extend to the front of the RJ 45 ...

Page 65: ...nectors Figure9 5 shows an LC connector Figure9 5 Appearance of an LC connector Follow these guidelines when you connect an optical fiber Before connecting an optical fiber make sure the connector and cable type match the interface module The fiber Ethernet port of the firewall supports only the LC connector Fiber connectors are fitted with dust caps Keep the dust caps secure when the fiber connec...

Search results

Summary of Contents for SecPath F5000-AI-20

Reviews:

Related manuals for SecPath F5000-AI-20

Brands by name

Popular brands

H3C SecPath F5000-AI-20, Installation Manual

Search results

Summary of Contents for SecPath F5000-AI-20

Reviews:

Related manuals for SecPath F5000-AI-20

Brands by name

Popular brands