H3C SecPath V100-S Security Gateway

Transcription

1 Hangzhou H3C Technologies Co., Ltd. Manual Version: T F C-1.02

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice Technical Support The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. To obtain the latest information, please access: h3c.com customer_service@h3c.com h3c.com

3 About This Manual Related Documentation In addition to this manual, each H3C SecPath Series Security Products documentation set includes the following: Manual H3C SecPath Series Security Products Operation Manual H3C SecPath Series Security Products Command Manual H3C SecPath Series Security Products Web-Based Configuration Manual Description It introduces the functional features, principles and guide to configuration and operation for H3C SecPath Series Security Gateways/Firewalls. It discusses all commands available in the configuration and operation on H3C SecPath Series Security Gateways/Firewalls. The details include command name, complete command form, parameter, operation view, usage description and configuration example. It directs users to configure the H3C SecPath Series Firewalls in Web mode. Organization H3C SecPath V100-S Series Security Gateways is organized as follows: Chapter 1 Product Introduction 2 Installation Preparations 3 Installing the SecPath V100-S 4 Booting and Configuring the SecPath V100-S Contents Profiles the system characteristics and applications. Product appearance and system description are also available in this chapter. Focuses on environment requirements for system installation, precautions before and during installation. Installation tools are also listed in this chapter. Elaborates on mechanical installation, physical connection of power cords, Console cables and Ethernet cables. Presents fundamentals on system booting and configuration, including booting the SecPath V100-S, powering up the SecPath V100-S and initializing the system file.

4 Chapter 5 Software Maintenance 6 Troubleshooting Contents Discusses system software maintenance, including software upgrade and configuration file loading. Lists common system failures during installation and specific locating methods. Conventions The manual uses the following conventions: I. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Description The keywords of a command line are in Boldface. Command arguments are in italic. Items (keywords or arguments) in square brackets [ ] are optional. Alternative items are grouped in braces and separated by vertical bars. One is selected. Optional alternative items are grouped in square brackets and separated by vertical bars. One or none is selected. Alternative items are grouped in braces and separated by vertical bars. A minimum of one or a maximum of all can be selected. Optional alternative items are grouped in square brackets and separated by vertical bars. Many or none can be selected. The argument(s) before the ampersand (&) sign can be entered 1 to n times. # A line starting with the # sign is comments.

5 II. GUI conventions Convention Description < > [ ] / Button names are inside angle brackets. For example, click <OK>. Window names, menu items, data table and field names are inside square brackets. For example, pop up the [New User] window. Multi-level menus are separated by forward slashes. For example, [File/Create/Folder]. III. Symbols Convention Warning Caution Note Description Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means a complementary description. Environmental Protection This product has been designed to comply with the requirements on environmental protection. For the proper storage, use and disposal of this product, national laws and regulations must be observed.

6 Table of Contents Table of Contents Chapter 1 Product Introduction Overview Hardware Features Appearance System Specifications LEDs Fixed Interface Attributes Chapter 2 Installation Preparations General Site Requirements Temperature and Humidity Cleanness ESD Prevention Electromagnetic Compatibility Lightning Protection Checking the Rack Safety Precautions Unpacking Check Installation Tools, Meters and Equipment Chapter 3 Installing the SecPath V100-S Installation Flow Mounting the SecPath V100-S Free-Standing Rack Mounting Connecting the Grounding Cable Connecting to the Console Terminal Connecting to the Ethernet Interface Connecting the Power Cord Verifying Installation Chapter 4 Booting and Configuring the SecPath V100-S Booting Setting Up a Configuration Environment Powering Up the SecPath V100-S Startup Process Configuration Fundamentals Basic Configuration Procedures Command Line Interface i

7 Table of Contents Chapter 5 Software Maintenance Boot Menu Upgrading Application and Boot ROM Using XModem Backing Up and Restoring the Extended Segment of the Boot ROM Upgrading the Application Program Using TFTP Uploading/Downloading Application/File Using FTP Password Lost Chapter 6 Troubleshooting Troubleshooting PSU Troubleshooting Configuration System Troubleshooting Application Upgrading ii

8 List of Figures List of Figures Figure 1-1 Front panel of the SecPath V100-S Figure 1-2 Rear panel of the SecPath V100-S Figure 3-1 Installation flow Figure 3-2 Rack-mounting the SecPath V100-S Figure 3-3 Console cable assembly Figure 3-4 Ethernet cable assembly Figure 4-1 Local configuration through the console port Figure 4-2 Setting up a new connection Figure 4-3 Setting the connection port Figure 4-4 Setting communication parameters Figure 4-5 Setting the terminal type Figure 5-1 The Send File dialog box Figure 5-2 The Sending File interface Figure 5-3 Setting up the local upload/download environment Figure 5-4 Setting up the local upload/download environment iii

9 List of Tables List of Tables Table 1-1 SecPath V100-S system specifications Table 1-2 LEDs on the front panel of the SecPath V100-S Table 1-3 Attributes of the console port Table 1-4 Attributes of the console port Table 1-5 Attributes of the Ethernet interfaces Table 2-1 Temperature/humidity requirements in the equipment room Table 2-2 Limits on the dust particles in the equipment room Table 2-3 Harmful gas limits in the equipment room Table 3-1 Dimensions of the SecPath V100-S iv

10 Chapter 1 Product Introduction Chapter 1 Product Introduction 1.1 Overview (referred to as the SecPath V100-S throughout the manual) is new-generation network security device intended for enterprise users. These enterprises have increasing demands for establishing secure, reliable private networks which can meet specific QoS requirements over public networks. The H3C SecPath V100-S can act as convergence and access gateways. The SecPath V100-S provides one fixed Fast Ethernet (FE) interface (WAN interface) and four 10/100 Mbps auto-sensing switched Ethernet interfaces (LAN interfaces), and offers hardware encryption function. The SecPath V100-S supports multiple VPN services, such as layer 2 tunneling protocol (L2TP) VPN, IP security (IPsec) VPN, generic routing encapsulation (GRE) VPN and dynamic VPN. It can connect to remote users through dial-up, leased line, VLAN, or tunneling and set up Internet, intranet, and access VPNs. By integrating such technologies as the firewall, authentication, authorization and accounting (AAA), network address translation (NAT), and quality of service (QoS), the SecPath V100-S can guarantee high security and reliability for private networks over the Internet. The SecPath V100-S has the following features: I. IP VPN solution Networks benefit enterprises in many ways; company headquarters can send important information to its branch offices quickly and conveniently. To interconnect the intranets of a company over the Internet, however, you need VPN technologies. The SecPath V100-S provides abundant IP VPN services: L2TP and GRE provide Layer 2 and Layer 3 tunneling respectively, and IPsec provides tunnels encapsulated with a security protocol. II. Data security and reliability The security gateway supports: NAT. Besides the basic functions, the NAT can limit the number of concurrent connections for an individual user. This eliminates the malicious resource seizures without any negative impact on general network applications. In addition, its enhanced NAT application layer gateway (ALG) function provides NAT traversal for H.323, FTP, ICMP, and so on. NAT logging. By querying the NAT log, you can locate a specific access action precisely, which can improve network security which has been degraded by source IP address translation. NAT log can record streams of NAT data to allow 1-1

11 Chapter 1 Product Introduction administrators to get information about the address information before NAT translation, and query and track activities and operations on a network to improve network availability and security. AAA and RADIUS user authentication protocols. Packet filtering and application specific packet filter (ASPF) to prevent attacks from external networks. VPN (including GRE, L2TP, and MPLS) with the IPsec and IKE technologies to guarantee the security of private networks over the Internet. Virtual router redundancy protocol (VRRP) to provide communication line or equipment backup in case of failure. This effectively enhances network robustness and reliability. III. Online software upgrade You can upgrade the application and Boot ROM programs online to add features and extend functions. IV. Network management The SecPath V100-S supports the SNMPV3 network management and provides powerful device management functions. V. Regulatory compliance Designed according to the standards dominant in China, North America, Europe, Australia, and Japan, the SecPath V100-S complies with the requirements of these countries and regions for EMC, safety standard, and network access. 1-2

12 Chapter 1 Product Introduction 1.2 Hardware Features Appearance (15) (14) (9) (5) (13) (12)(11) (10) (6) (7) (4) (3) (2) (1) (8) (1) Reset button (RESET) (2) System LED (SYS) (3) Console port (CONSOLE) (4) Auxiliary port (AUX) (5) Three LEDs for the fixed WAN interface (6) Three LEDs for fixed LAN interface 3 (7) Three LEDs for fixed LAN interface 2 (8) Three LEDs for fixed LAN interface 1 (9) Three LEDs for fixed LAN interface 0 (10) Fixed WAN interface (WAN) (11) Fixed LAN interface 3 (LAN 3) (12) Fixed LAN interface 2 (LAN 2) (13) Fixed LAN interface 1 (LAN 1) (14) Fixed LAN interface 0 (LAN 0) (15) Power LED (PWR) Figure 1-1 Front panel of the SecPath V100-S (2) (1) (1) Grounding screw (2) Power socket Figure 1-2 Rear panel of the SecPath V100-S System Specifications Table 1-1 SecPath V100-S system specifications Item Specification Fixed interface Processor Four 10/100 Mbps Ethernet interfaces One 10/100 Mbps WAN interface One auxiliary port One console port 79RC

13 Item Chapter 1 Product Introduction Specification Boot ROM SDRAM Flash Dimensions (W D H) Weight Power input Max. power consumption 512 Kbps 128 Mbps 8 Mbps mm ( in.) (excluding rubber feet) 2 kg (4.4 lb.) Rated voltage: 100 VAC to 240 VAC, 50Hz or 60 Hz Rated current: 0.2 A 9 W Operating temperature 0 o C to 40 o C (32 o F to 104 o F) Operating humidity (noncondensing) 10% to 90% Note: Synchronous dynamic random access memory (SDRAM) stores the communication data of the running system with the CPU. Flash is the major file storing medium where application files, traps, and configuration files are stored. Boot read only memory (Boot ROM) stores the bootstrap program files LEDs See Table 1-2 for the meaning of the LEDs on the front panel of SecPath V100-S. Table 1-2 LEDs on the front panel of the SecPath V100-S LED PWR SYS LINK/ACT Meaning Power supply unit (PSU) LED: OFF means the PSU is not supplying power to the device. ON means the PSU is supplying power to the device. System operating status LED: Blinking means the system is operating normally. OFF means the system is operating abnormally. OFF means no link is present. ON means a link is present. Blinking means packets are being transmitted/received. 1-4

14 Chapter 1 Product Introduction 100M FULL LED Meaning OFF means packets are being transmitted/received at 10 Mbps on the interface. ON means packets are being transmitted/received at 100 Mbps on the interface. OFF means the interface is operating in half-duplex mode. ON means the interface is operating in full-duplex mode. Note: The three LEDs corresponding to each Ethernet interface are (top-down order): LINK/ACT LED, 100M LED, and FULL LED Fixed Interface Attributes I. Console port (CONSOLE) Table 1-3 Attributes of the console port Attribute Description Connector Interface standard Baud rate Function RJ45 RS bps (default) to bps Connection to an ASCII terminal Connection to a serial port on a local PC to run terminal emulation program on the PC Command line interface II. Auxiliary port (AUX) Table 1-4 Attributes of the console port Attribute Description Connector Interface standard Baud rate Function RJ45 RS to bps Modem dial-up Backup 1-5

15 Chapter 1 Product Introduction III. Ethernet interface The SecPath V100-S provides five 10/100 Mbps auto-sensing FE interfaces. The following table lists their attributes. Table 1-5 Attributes of the Ethernet interfaces Attribute Description Connector Interface standard Frame format Operating mode RJ45 All Ethernet interfaces on the SecPath V100-S support MDI/MDIX autosensing. Ethernet_II Ethernet_SNAP 10/100 Mbps auto-sensing Full-duplex/Half-duplex Note: Media-dependent interface (MDI) is often used on general network adapters; media-dependent interface cross-over (MDIX), is usually used on Hubs or LAN switches. 1-6

16 Chapter 2 Installation Preparations Chapter 2 Installation Preparations 2.1 General Site Requirements The SecPath V100-S must be used indoors. To guarantee normal operation and longevity of your device, its installation site should meet the requirements described in this chapter Temperature and Humidity The equipment room must maintain proper humidity to prevent poor insulation, electricity creepage and corrosion accompanying high humidity, or washer contraction and electrostatic discharge accompanying low humidity. In dry environments where the relative humidity is very low, electrostatic discharge (ESD) is more likely to happen causing the complementary metal-oxide-semiconductor (CMOS) circuitry to fail. The following table lists the temperature and humidity requirements. Table 2-1 Temperature/humidity requirements in the equipment room Temperature Relative humidity 0 C to 40 C (32 o F to 104 o F) 10% to 90% (noncondensing) Cleanness Dust is hazardous to the operating safety of your device. Dust buildup on the chassis may result in static absorption, causing poor contact of metal components or points. When indoor humidity is extremely low, this is more likely to happen to shorten the useful life of the device and cause communication failures. The equipment room must be free of explosion hazards and the electrical and magnetic conductible dust as well. The following table lists the limits on dust particles: Table 2-2 Limits on the dust particles in the equipment room Mechanical active material Unit Content Dust particle particle/m³ 3 x 10 4 (No visible dust on desk in three days) Note: Dust particles diameter 5µm 2-1

17 Chapter 2 Installation Preparations Besides, the equipment room should meet the rigorous limits on salt, acid and sulfide to eliminate corrosion and premature aging of some parts, as shown in the following table. Table 2-3 Harmful gas limits in the equipment room Gas Maximum (mg/m 3 ) SO H 2 S NH Cl ESD Prevention By design, the SecPath V100-S is ESD preventative; but excessive buildup of static electricity can still damage the card circuitry and even the entire device. On the communication network connected to the SecPath V100-S, static electricity is primarily introduced from the outside electrical fields, such as the outdoor high-voltage power cabling and lightning, and from the inside system, such as indoor environment, floor material and the equipment frame. To avoid damage, ensure that: The equipment is well connected to earth. The equipment room is dust-proof. Maintain adequate temperature and humidity. Wear an ESD-preventive wrist strap and clothes when contacting the circuit board. Place the removed circuit board upward on the ESD-preventive workbench, or into a static shielded bag. Hold the circuit board by its edge when observing or moving it, avoiding direct contact with the elements on it Electromagnetic Compatibility All interference sources, from the outside or from the inside of the device/application system, adversely affect the SecPath V100-S in the conduction patterns of capacitance coupling, inductance coupling, electromagnetic wave radiation, and common impedance (including grounding system) coupling. To prevent the interference, do the following: Take effective measures against interference from the power grid. Use a grounding system or lightning protection grounding different from that for the power supply equipment and keep them as far as possible. Keep the device far away from strong power wireless launchers, radar launchers and high frequency and high-current equipment. Use electromagnetic shielding when necessary. 2-2

18 Chapter 2 Installation Preparations Lightning Protection By design, the SecPath V100-S is lightning protective; but excessive lightning may still damage the device. To protect the device better, you are recommended to: Ensure the PGND of the chassis is securely connected to the earth ground. Ensure the earth point of the power socket is securely connected to the earth ground. Add a lightning arrester onto the front end of the power input to better protect the power supply from lightning strikes Checking the Rack When installing the SecPath V100-S, observe the following: Reserve adequate clearance at the air intake exhausting vents for adequate ventilation inside the chassis. Make sure that the rack has a good ventilation system. Make sure that the rack is stable enough to support the weight of the device and the installation accessories. Make sure that the rack is well-grounded. 2.2 Safety Precautions When reading this manual, pay adequate attention to the following. Warning appears in operation procedures that, if performed incorrectly, might cause bodily injury to the operators or damage the device. Caution appears throughout this manual in procedures that, if performed incorrectly, might affect the operation of the device. When installing or working on the SecPath V100-S, you are recommended to: Keep the SecPath V100-S far away from the heat sources and water/liquid. Make sure that the SecPath V100-S has been correctly grounded. Wear an ESD-preventive wrist strap in installation and maintenance, making sure that the strap has good skin contact. Do not hot swap the console cable or AUX cable. Adopt uninterrupted power supply (UPS). 2.3 Unpacking Check Check the arrived shipment contents against the packing list, making sure all the items are included and in good condition. Contact your agent for shortage or wrong delivery. 2-3

19 Chapter 2 Installation Preparations 2.4 Installation Tools, Meters and Equipment I. Tools Phillips screwdriver ESD-preventive wrist strap Static shielding bag II. Cables Grounding wire and power cord Console cable Optional cables III. Meters and other equipment Hub or LAN switch Console terminal (it could be a PC) Multimeter Note: The SecPath V100-S was not shipped with any installation tools, meters, or other equipment. You must make sure that they are available. 2-4

20 Chapter 3 Installing the SecPath V100-S Chapter 3 Installing the SecPath V100-S 3.1 Installation Flow Start Install the rack (optional) Mount the security gateway Connect the PGND Connect the power cord Connect the security gateway to the console terminal Verify the installation Power up the security gateway Troubleshooting OK? YES Turn off the power switch and remove the power cord NO Power down the security gateway Install MIMs (optional) Connect the security gateway to the Ethernet interface Verify the installation Connect the power cord and power up End Figure 3-1 Installation flow 3-1

21 Chapter 3 Installing the SecPath V100-S Caution: Before you install the SecPath V100-S, make sure that you have read Chapter 2 Installation Preparations carefully and have satisfied all the requirements. 3.2 Mounting the SecPath V100-S You can mount your device on a workbench or in a standard 19-inch rack Free-Standing Place the security gateway on a clean and flat workbench. To prevent any damage, observe the following: Ensure the workbench is stable enough. Allow 10 cm (3.9 inches) of clearance around the ventilation openings. Do not place any heavy object on the device Rack Mounting The SecPath V100-S is designed to be mounted in 19-inch standard racks. The following table shows its physical dimensions. Table 3-1 Dimensions of the SecPath V100-S Model SecPath V100-S (H W D) Dimensions 42 x mm (1.7 x in.) (excluding rubber feet) Follow these steps to install the SecPath V100-S: Step 1: Ensure that the rack is stable enough and properly grounded. Attach the rack-mounting ears to the front of the chassis with screws. Step 2: Place the SecPath V100-S on a shelf in the rack and slide it to a proper position along the guide rails. Step 3: Fix the rack-mounting ears to the rack posts with suitable antirust pan-head screws. Make sure that the device is placed horizontally and securely fixed. 3-2

22 Chapter 3 Installing the SecPath V100-S (1) (3) (2) (1) Screws (four) (2) Rack-mounting ear (3) Guide rail Figure 3-2 Rack-mounting the SecPath V100-S 3.3 Connecting the Grounding Cable Caution: Before installing or using your security gateway, properly connect the grounding cable to protect the device against lightning and other interference sources. The SecPath V100-S provides on its rear panel a grounding screw (with a grounding symbol, see Figure 1-2), which must be grounded properly to safely channel the faradic current and leakage current to the ground and to make the device less susceptible to electromagnetic interference (EMI). Connect this screw to the ground using a PGND cable. The grounding resistance should not be greater than 5 ohm. If the security gateway is mounted in a 19-inch rack, the rack should also be connected to the ground. Caution: Lightning strikes may damage your security gateway and the connected device as well. For secure lightning protection, make sure that your security gateway has been grounded properly during its operation. 3-3

23 Chapter 3 Installing the SecPath V100-S 3.4 Connecting to the Console Terminal I. Console port The security gateway provides one RS232 asynchronous serial console port, through which you can configure the device. For the attributes of the console port, refer to the section Fixed Interface Attributes. II. Console cable The console cable is an 8-core shielded cable. At one end of the cable is an RJ45 connector that can be plugged to the console port of the security gateway; at the other end is a DB9 (female) connector, which can be plugged to the serial port of the console terminal. Figure 3-3 illustrates a console cable. A X3 A Figure 3-3 Console cable assembly III. Connecting the console cable Before configuring the security gateway through a console terminal, follow these steps to connect the console cable: Step 1: Select a console terminal. (The console terminal can be either a PC or a standard ASCII terminal with an RS232 serial port.) Step 2: Power down the console terminal and security gateway. Step 3: Connect the RS232 serial port on the console terminal to the console port on the security gateway through the console cable. Verify the connection and power up the security gateway and console terminal. The console terminal shows the startup information of the security gateway if the connection is correct. For details, see Chapter 4 Booting and Configuring the SecPath V100-S. 3.5 Connecting to the Ethernet Interface I. Ethernet interface The SecPath V100-S provides four fixed 10/100 Mbps auto-sensing FE interfaces in downstream direction. These four Ethernet interfaces can switch packets to one another. The SecPath V100-S provides one fixed 10/100 Mbps auto-sensing FE interface in upstream direction for connecting routers and switches. 3-4

24 Chapter 3 Installing the SecPath V100-S II. Ethernet cable The SecPath V100-S uses category-5 twisted-pair cables to match its Ethernet interfaces (the cables can be either straight-through cables or and crossover cables since the interfaces are MDI/MDIX auto-sensing), as shown in Figure 3-4. Figure 3-4 Ethernet cable assembly Note: When preparing network cables, it is recommended to use shielded cables for the sake of electromagnetic compatibility. III. Connecting the Ethernet cable Take the LAN0 interface on the front panel of the SecPath V100-S for example. Follow these steps to connect its Ethernet cable: Caution: Read the mark above the interface carefully to avoid misconnection. Step 1: Connect one end of the Ethernet cable to the security gateway and the other end to the peer device. Step 2: Check that the LINK/ACT LED corresponding to LAN0 is on. ON means a link is present on the interface. OFF means no link is present on the interface and you should check the connection. 3.6 Connecting the Power Cord The SecPath V100-S has AC-powered model. I. AC power supply AC input: 100 VAC to 240 VAC, 50 Hz or 60 Hz 3-5

25 Chapter 3 Installing the SecPath V100-S Figure 1-2 shows the power socket on an AC-powered model. II. Recommended AC power socket You are recommended to use a three-terminal, single-phase power socket with neutral point which must be grounded reliably. Normally, the neutral point of the power supply system in a building was buried in the ground during construction and cabling. You must make sure that the power supply system in the building has been well grounded before connecting the AC power cord. III. Connecting the AC power cord Step 1: Make sure that the PGND on the chassis is securely connected to the ground. Step 2: Make sure that the power switch is placed in the OFF position. Connect one end of the AC power cord to the AC-input socket (100 VAC to 240 VAC) on the right of the rear panel and the other end to the AC mains supply. Step 3: Place the power switch in the ON position. Step 4: Check that the PWR LED on the front panel is on. ON means the power connection is correct. Step 5: Check that the SYS LED on the front panel is blinking. Blinking means the hardware system is operating normally. 3.7 Verifying Installation Each time you power up the SecPath V100-S during installation, verify that: Enough clearance has been reserved around the ventilation openings of the device and the workbench/rack is stable enough. Proper power supply is used. The grounding cable has been correctly connected. The security gateway has been correctly connected to other devices, such as a console terminal. Note: Installation verification is extremely important, because operations of the security gateway depend on its stability, proper grounding, and right power supply. 3-6

26 Chapter 4 Booting and Configuring the SecPath V100-S Chapter 4 Booting and Configuring the SecPath V100-S 4.1 Booting You can only configure the SecPath V100-S through the console port when you use it for the first time Setting Up a Configuration Environment I. Connecting the security gateway to a console terminal Connect the RJ45 connector of the console cable to the console port on the security gateway and the DB9 connector to the serial port on the PC (see Figure 4-1). RS232 serial interface H3C SecPath V100-S PC Console port Console cable Figure 4-1 Local configuration through the console port II. Setting terminal parameters Step 1: Start the PC and select [Start/Programs/Accessories/Communications/ HyperTerminal]. Step 2: The HyperTerminal window displays the [Connection Description] dialog box, as shown in Figure

27 Chapter 4 Booting and Configuring the SecPath V100-S Figure 4-2 Setting up a new connection Step 3: Enter the name of the new connection in the [Name] field and click <OK>. The dialog box as shown in Figure 4-3 pops up. Step 4: Select the serial port to be used from the Connect Using drop-down list. The serial port selected here must be the one connected to the console cable. Figure 4-3 Setting the connection port Step 5: Click <OK>. The [Settings] tab appears as shown in Figure 4-4, and you can set the serial port parameters. Set the following parameters: Bits per second = 9600 Data bits = 8 Parity = none 4-2

28 Chapter 4 Booting and Configuring the SecPath V100-S Stop bits = 1 Flow control = none Figure 4-4 Setting communication parameters Step 6: Click <OK>. The HyperTerminal dialog box appears. Step 7: Select Properties. Step 8: In the [Properties] dialog box, select the [Settings] tab, as shown in Figure 4-5. Figure 4-5 Setting the terminal type 4-3

29 Chapter 4 Booting and Configuring the SecPath V100-S Step 9: Select VT100 or Auto detect in the Emulation drop-down menu. Step 10: Click <OK> Powering Up the SecPath V100-S I. Checking before power-up Before powering up the security gateway, check that: Both the power cord and the grounding cable are correctly connected. Proper power supply is used. The console cable is correctly connected. The console terminal (or PC) has been started and the related parameters have been set on it. Caution: Locate the power switch of the power supply in the equipment room before powering up the security gateway. Then, if an accident occurs, you can quickly shut off the power. II. Powering up the SecPath V100-S Place the power switch of the power supply in the ON position. Place the power switch on the security gateway in the ON position. III. Checking/Operating after power-up After powering up the SecPath V100-S, check that: The LEDs on the front panel are in normal state. Refer to section LEDs for the LED description. The console terminal display is correct. After powering up the device, you can see the startup interface on the console terminal (see section Startup Process ). After the system passes power-on self-test (POST), press <Enter> as prompted. When <H3C> is displayed, you can proceed to configure the security gateway Startup Process After being powered up, the SecPath V100-S first runs the Boot ROM program. The terminal screen displays the following system information. 4-4

30 Chapter 4 Booting and Configuring the SecPath V100-S Note: The contents displayed on the terminal may vary for different Boot ROM versions. ************************************************ * * * H3C SecPath Series Gateway Boot ROM V1.00 * * * ************************************************ Copyright(C) by Hangzhou H3C Technologies CO., LTD. Compiled at Wed Apr 12 17:39:36 CST Testing memory...ok! 128M bytes DDR SDRAM 8192K bytes flash memory Hardware Version is MTR 1.0 CPLD Version is CPLD 0.0 Press Ctrl-B to enter Boot Menu Press <Ctrl+B> now to enter the Boot Menu. Otherwise, the system starts decompressing the program. Note: To enter the Boot Menu, you must press <Ctrl+B> within three seconds after the prompt Press Ctrl-B to Enter Boot Menu appears. The system starts decompression and initialization, and displays: System is starting... Number 1 memory block start from address 0x ,length 0xd User interface Con 0 is available. Press ENTER to get started Press <Enter>, and the system displays (if login authentication is not enabled): <H3C> 4-5

31 Chapter 4 Booting and Configuring the SecPath V100-S The prompt indicates that the security gateway enters user view and is ready for configuration. 4.2 Configuration Fundamentals Basic Configuration Procedures Following are the basic steps that you can follow to configure the SecPath V100-S. Step 1: Figure out detailed networking requirements, including networking objectives, the role of the security gateway in the network, transmission medium, security policy, and network reliability. Step 2: Draw a networking topology based on the requirements. Step 3: Configure IP addresses for the interfaces on the security gateway. Step 4: Configure routes, and if a dynamic routing protocol is enabled, set parameters for the protocol. Step 5: Configure security features as required. Step 6: Configure reliability features as required. For more information on the configuration of protocols and functions for the security gateway, see H3C SecPath Series Security Products Operation Manual Command Line Interface I. Features of the command line interface (CLI) The CLI offers a series of configuration commands. It allows you to: Configure the device locally through the console port. Telnet to configure the security gateway locally or remotely, and then telnet to access and manage other security gateways. Get on-line help whenever you enter <?>. Test network connectivity quickly with network diagnostic tools, such as tracert and ping. Have detailed debugging information for troubleshooting your network. Enter the conflict-free keyword portion instead of the whole command, because the CLI supports command prompting. For example, you simply need to enter dis for the display command. II. CLI In system view, all the commands are put into groups for the convenience of management, each being associated to a view. (Refer to H3C SecPath Series Security Products Operation Manual for details.) You can switch between the views by executing some particular commands. Under normal circumstances, you can only execute the commands appropriate to the view that you access. However, you are 4-6

32 Chapter 4 Booting and Configuring the SecPath V100-S allowed to execute some common commands (such as ping, display, current-configuration, and interface) in any view. 4-7

33 Chapter 5 Software Maintenance Chapter 5 Software Maintenance The security gateway contains three types of files: Boot ROM program files Application program files Configuration files Software maintenance mainly involves upgrading/downloading Boot ROM/application program files and uploading/downloading configuration files. Caution: Because Flash memory has fixed space, you are recommended to use the options in Boot menu to upgrade the software of a security gateway. If you choose to upload files, you need to upload system files and http.zip files separately instead of uploading the whole file. You can detach the http.zip files by using the detach command. 5.1 Boot Menu This section introduces the Boot menu that you use in maintaining the software of the security gateway. Set up a configuration environment (see Figure 4-1) and then boot the security gateway. Press <Ctrl+B> when the system prompts Press Ctrl-B to enter Boot Menu. Then the system displays: Please input Boot ROM password : Caution: Press <Ctrl+B> within three seconds after the prompt Press Ctrl-B to Enter Boot Menu... appears to access the Boot Menu. Otherwise, the system starts decompressing the program. If you want to access the Boot menu after the system starts decompressing the program, you need to reboot the security gateway. 5-1

34 Chapter 5 Software Maintenance Type the correct password and press <Enter>. (If no Boot ROM password has been set, just press <Enter>.) The system accesses the Boot Menu shown as follows: I. Boot menu of the SecPath V100-S Boot Menu: 1: Download application program with XMODEM 2: Download application program with NET 3: Display file in flash 4: Delete file from flash 5: Start up and ignore configuration 6: Enter debugging environment 7: Boot Rom Operation Menu 8: Do not check the version of the software 9: Exit and reboot Enter your choice(1-9): Further description is given for the option 8: 8: Ignore the software version of Boot ROM program, its extended segment, and application program for backward compatibility during version upgrade. If you fail to upgrade the software and the system prompts invalid version although you use the correct software version, you can select this option to ignore the version check during software upgrade. Note that this option works only once when you select it. The system resumes version check after you reboot the security gateway. II. Boot ROM operation menu of the SecPath V100-S As mentioned previously, you can select <6> in the Boot menu to enter the Boot ROM operation menu as follows: Boot ROM Operation Menu: 1: Download Boot ROM with XModem 2: Download Extended Segment of Boot ROM with XModem 3: Restore Extended Segment of Boot ROM from FLASH 4: Backup Extended Segment of Boot ROM to FLASH 5: Exit to Main Menu Enter your choice(1-5): The menu provides approaches to upgrade, back up, and restore the Boot ROM program. See the sections 5.2 Upgrading Application and Boot ROM Using XModem and 5.3 Backing Up and Restoring the Extended Segment of the Boot ROM for details. 5-2

35 Chapter 5 Software Maintenance Caution: You are recommended to upgrade the software under the guidance of technical support engineers. When upgrading the security gateway, make sure that the version of the Boot ROM software is consistent with the application program. 5.2 Upgrading Application and Boot ROM Using XModem You can use XModem through the console port to upgrade the software even without setting up a configuration environment. I. Upgrading the application program Step 1: Enter the Boot Menu (see 5.1 Boot Menu ) and select <1> to download an application program using XModem. The security gateway supports these downloading speeds: Downloading application program from serial... Please choose your download speed: 1: 9600 bps 2: bps 3: bps 4: bps 5: bps 6: Exit to Main Menu Enter your choice(1-6): Step 2: Select an appropriate downloading speed, (for example, bps by entering <5>). The system displays: Download speed is bps. Change the terminal's speed to bps, and select XModem protocol. Press ENTER key when ready. Step 3: Change your terminal s baud rate (see Figure 4-4) to the same baud rate for software downloading ( bps in this example). After that, disconnect the terminal ([Dial-in/Disconnect]), reconnect it ([Dial-in/Dialing]), and press <Enter> to start downloading. Then the system displays: Downloading... CCCCC 5-3

36 Chapter 5 Software Maintenance Note: The new baud rate takes effect only after you disconnect and reconnect the terminal emulation program. Step 4: Select [Transmit/Send File] in the terminal window. The following dialog box pops up: Figure 5-1 The Send File dialog box Step 5: Click <Browse>, select the application file to be downloaded, set protocol to XModem, and click <Send>. The following interface pops up: Figure 5-2 The Sending File interface Step 6: After completing the downloading, the system begins writing data to the Flash memory and then displays the following information in the terminal window, indicating the completion of the downloading: Download completed. Writing to flash memory

37 Chapter 5 Software Maintenance Please wait, it may take a long time ######################################################## Writing FLASH Success. Please use 9600 bps.press <ENTER> key to reboot the system. Restore the speed of the console terminal to 9600 bps as prompted, and then disconnect and reconnect the terminal. The system starts up normally. II. Upgrading the entire Boot ROM program Step 1: Enter the Boot Menu (see section 5.1 Boot Menu ), and select <7> to enter the Boot ROM operation menu. Step 2: Select <1> in the Boot ROM operation menu to download the Boot ROM program using XModem. The security gateway provides several speed options. The subsequent operation steps are the same as those described in section 5.2 I. Upgrading the application program. Caution: If you fail to upgrade the entire Boot ROM program, you cannot restore it on site. Therefore, you can only upgrade the entire Boot ROM program under the direction of technical support engineers and when it is urgently necessary. III. Upgrading the extended segment of the Boot ROM program Step 1: Enter the Boot Menu (see section 5.1 Boot Menu ), and select <7> to enter the Boot ROM operation menu. Step 2: Select <2> in the Boot ROM operation menu to upgrade the extended segment of Boot ROM program through XModem. The security gateway provides several speed options. The subsequent operation steps are the same as those described in section 5.2 I. Upgrading the application program. Note: This upgrade approach is used to upgrade only a portion of the Boot ROM program, so you may make a second attempt once an error occurs. 5-5

38 Chapter 5 Software Maintenance 5.3 Backing Up and Restoring the Extended Segment of the Boot ROM I. Backing up the extended segment of Boot ROM to Flash Follow these steps to back up the Boot ROM program. Step 1: Enter the Boot Menu (see section 5.1 Boot Menu ), and select <7> to enter the Boot ROM operation menu. Step 2: Select <4> in the Boot ROM operation menu to copy the current extended segment of the Boot ROM program to Flash. Backup Extended Segment, are you sure?[y/n] Enter <Y> and the system starts backing up the extended segment. If the backup attempt is successful, the following message appears: Writing to FLASH.Please wait...#### Backuping Boot ROM program to FLASH successed! Step 3: When the Boot ROM operation menu appears again, select <5> to exit and reboot the security gateway. II. Restoring the extended segment of Boot ROM from the Flash If faults occur to the extended segment of the Boot ROM program or you upgrade it by mistake, you can restore the extended segment saved in the Flash to the Boot ROM by following these steps: Step 1: Enter the Boot Menu (see section 5.1 Boot Menu ), and select <7> to enter the Boot ROM operation menu. Step 2: Select <3> in the Boot ROM operation menu to restore the extended segment of the Boot ROM program from the Flash. The system displays the following message: Restore Extended Segment, are you sure?[y/n] Enter <Y>, and the system starts restoring the extended segment. If the operation is successful, the system displays: Writing to Boot ROM. Please wait...###### Restoring Boot ROM program successed! Step 3: When the Boot ROM operation menu appears again, select <5> to exit and reboot the security gateway. 5-6

39 Chapter 5 Software Maintenance 5.4 Upgrading the Application Program Using TFTP The application program is downloaded using TFTP through the Ethernet interface. In this case, the security gateway acts as the client and must be connected to the TFTP server through one of its fixed Ethernet interfaces. Caution: The TFTP server program is not delivered with the SecPath V100-S. You need to purchase and install it by yourself. The SecPath V100-S can only act as the TFTP client, so you can only upgrade the application program using TFTP in these steps: 1) Start the TFTP server Start the TFTP server on the PC that is connected to the security gateway through the Ethernet interface, and set the directory of the file to be downloaded. 2) Configure the security gateway Step 1: Start the security gateway and enter the Boot menu (see section 5.1 Boot Menu ). Select <2> to enter the Net Port Download Menu, shown as follows: Net Port Download Menu: 1: Change Net Parameter 2: Download From Net 3: Exit to Main Menu Enter your choice(1-3): 1 Step 2: Select <1> in the Net Port Download Menu to set parameters for the Ethernet interface on the security gateway (including the interface in use, IP address and subnet mask of the interface) and parameters for the TFTP server (including IP address of the Ethernet interface on the PC and the name of the application program). Change Download parameter Download device :WAN0 Download file(max 60 char) :system IP address of WAN0 : Subnet mask for WAN0 : IP address of the server : IP address of the gateway :

40 Chapter 5 Software Maintenance Caution: The upgrade should be performed through the WAN interface on the security gateway. The field IP address of the server: [ ] must be set to the IP address of the TFTP server connected to the Ethernet interface on the security gateway. You are recommended to configure the IP address of the TFTP server network interface and that of the WAN interface on the security gateway into the same network segment. Step 3: After you input the last parameter value, the system displays the following message and returns to the Net Port Download Menu: Saving config, please wait...ok! Net Port Download Menu: 1: Change Net Parameter 2: Download From Net 3: Exit to Main Menu Enter your choice(1-3): 2 3) Download application program using TFTP Select <2> to download the application program through TFTP. The system displays the following message: Starting the TFTP download TFTP download completed... File length = [ ] Writing program code to FLASH... Please wait,it needs a long time.please wait... ######################################################## Writing FLASH Success. Press <ENTER> key to reboot the system. The downloading is successful. Press <Enter> to reboot the system. 5.5 Uploading/Downloading Application/File Using FTP The SecPath V100-S offers FTP Server function, which provides you another way of updating configuration files, and upgrading application and Boot ROM program. Any FTP client, local or remote, only needs to connect to the security gateway. When you 5-8

41 Chapter 5 Software Maintenance pass the authentication, you can upload and download configuration files or applications. Note: Upload: to transfer files from PCs running FTP client to security gateway, namely the put operation. Download: to transfer files from security gateway to PCs running FTP client, namely the get operation. I. Setting up an upload/download environment Setting up the local upload/download environment H3C SecPath V100-S (FTP Server ) /24 PC (FTP Client) LAN Ethernet interface /24 Figure 5-3 Setting up the local upload/download environment Step 1: Connect the PC through the Ethernet port of SecPath V100-S. Step 1: Configure the IP address of the Ethernet port of SecPath V100-S. Here suppose it is Step 3: Configure the IP address of the PC. Here suppose it is Step 4: Copy the application, Boot ROM program or configuration files to a specific path. Here suppose the path is C:\ version. Caution: The network port IP address of the PC must be in the same network segment with that of the Ethernet port of the security gateway. Setting up the remote upload/download environment 5-9

42 Chapter 5 Software Maintenance /24 H3C SecPath V100-S (FTP Server) PC (FTP Client) Router WAN Ethernet interface /24 Figure 5-4 Setting up the local upload/download environment Step 1: Connect the PC through WAN to any interface of the security gateway. The IP addresses of the PC and the security gateway can be in different network segments. Step 2: Copy the application, Boot ROM program or configuration files to a specific path. Here suppose the path is C:\ version. II. Booting FTP server Ask for the cooperation of the service personnel at the security gateway side and perform the following configuration: Step 1: Configure authentication mode. Note: You can perform AAA authentication configuration as needed. See the AAA and RADIUS configuration part in H3C SecPath Series Security Products Operation Manual for details. Step 2: Add a user name and the password. [SecPath] local-user SecPathGateway password simple 123 SecPathGateway represents the user name, and 123 represents the password. Step 3: Add service type. [SecPath] local-user NATGateway service-type ftp Step 4: Add the authority level. [SecPath] local-user NATGateway level 3 Step 5: Specify FTP directory. [SecPath] local-user NATGateway ftp-directory flash Step 6: Boot FTP server. [SecPath] ftp-server enable 5-10

43 Chapter 5 Software Maintenance After the above operation, the FTP server is enabled on the security gateway, and a user is set. Then, any FTP client program can access FTP server using this user name and its password. III. Uploading/downloading application, configuration files and uploading Boot ROM program Step 1: Enter the path of the files or applications in DOS window, perform FTP command, and create the FTP connection to the security gateway, for example: C:\version\ftp If the connection is made, the system displays the following message (taking Windows98 as an example): Connected to FTP server ready on SecPathGateway at User( :(none)): Step 2: Access FTP server using the configured user name and password. User( :(none)): SecPath Gateway Enter the user name 331 Password required for ftp Password: Enter the password and it will not be displayed on the screen 230 User ftp logged in ftp> At the prompt of ftp>, you can upload or download files. Step 3: Upload/download applications, configuration files, or upload Boot ROM programs. Note: By default, the application name of the security gateway side is system, the filename is config.cfg, Boot ROM filename extension is bootrom, and the whole Boot ROM filename is bootromfull. Upload application, Boot ROM program, or configuration files. ftp> put Enter put to upload files. local file Input the application, Boot ROM program, or filename name to be uploaded remote file Input the name of the files to be saved after upload. 5-11