3Com H3C SECPATH F5000-A5 ADVANCED VPN FIREWALL 12-PORT GIGABIT ETHERNET... User manual

H3C SecPath F5000-A5 Firewall
Installation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Manual Version: 5PW101-20090424

Copyright © 2008-2009, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Technical Support
[e-mail]
http://www.h3c.com

About This Manual
Organization
H3C SecPath F5000-A5 Firewall Installation Manual is organized as follows:
Chapter Contents
1 Firewall Overview Briefly introduces the product specifications, as well as the features and applications of the H3C
SecPath F5000-A5.
2 Arranging Slots and Numbering Interfaces Introduces the slots and numbering rules of the
H3C SecPath F5000-A5.
3 Preparing for Installation Describes the requirements on installation site, the
safety recommendations before and during
installation, and the required tools.
4 Installing the Firewall Introduces how to install the F5000-A5, as well as
how to connect the power cable, console cable,
and Ethernet cable.
5 Starting and Configuring the Firewall
Helps you get familiar with the basic knowledge of
how to boot and configure the F5000-A5, including
device startup, power-on, and initialization of
system files, and so on.
6 Maintaining Software Introduces how to maintain the software of the
F5000-A5, including upgrading the software and
configuration files.
7 Maintaining Hardware Introduces how to maintain the hardware of the
F5000-A5.
8 Troubleshooting Describes some problems that may occur during installation and startup of the firewall and how to
solve them.
9Appendix
Provides the details of regulatory compliance
information and the safety information in Chinese,
comprising general warning, warnings on
installation, and safety with electricity.
Conventions
The manual uses the following conventions:
Command conventions
Convention Description
Boldface The keywords of a command line are in Boldface.
italic Command arguments are in italic.
[ ] Items (keywords or arguments) in square brackets [ ] are optional.
{ x | y | ... }
Alternative items are grouped in braces and separated by vertical bars.
One is selected.
[ x | y | ... ]
Optional alternative items are grouped in square brackets and
separated by vertical bars. One or none is selected.

Convention Description
{ x | y | ... } *
Alternative items are grouped in braces and separated by vertical bars.
A minimum of one or a maximum of all can be selected.
[ x | y | ... ] *
Optional alternative items are grouped in square brackets and
separated by vertical bars. Many or none can be selected.
&<1-n> The argument(s) before the ampersand (&) sign can be entered 1 to n
times.
# A line starting with the # sign is comments.
GUI conventions
Convention Description
< > Button names are inside angle brackets. For example, click <OK>.
[ ] Window names, menu items, data table and field names are inside
square brackets. For example, pop up the [New User] window.
/ Multi-level menus are separated by forward slashes. For example,
[File/Create/Folder].
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause
bodily injury.
Means reader be careful. Improper operation may cause data loss or
damage to equipment.
Means an action or information that needs special attention to ensure
successful configuration or good performance.
Means a complementary description.
Means techniques helpful for you to make configuration with ease.
Related Documentation
In addition to this manual, each H3C SecPath F5000-A5 Firewall documentation set includes the
following:
Manual Description
H3C SecPath Series Security Products User
Manual
Describes the features, working principles, and
configuration and operation instruction of the
H3C SecPath series security products. It guides
you through configuring and operating the
SecPath series products through Web interfaces
and configuring some functions through the CLI.

Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at this URL:
http://www.h3c.com.
The following are the columns from which you can obtain different categories of product documentation:
[Products & Solutions]: Provides information about products and technologies, as well as solutions.
[Technical Support & Document > Technical Documents]: Provides several categories of product
documentation, such as installation, configuration, and maintenance.
[Technical Support & Document > Software Download]: Provides the documentation released with the
software version.
Documentation Feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.
Environmental Protection
This product has been designed to comply with the requirements on environmental protection. For the
proper storage, use and disposal of this product, national laws and regulations must be observed.

i
Table of Contents
1 Firewall Overview ······································································································································1-1
Introduction ·············································································································································1-1
Physical Description································································································································1-2
Front View ·······································································································································1-2
Rear View ········································································································································1-3
System Specifications·····························································································································1-4
MPU–NSQ1MPUA0 ························································································································1-4
LPU–NSQ1GT8C40 ························································································································1-7
LPU–NSQ1XP20·····························································································································1-9
Dimensions and Weight·················································································································1-10
Voltage and Current ······················································································································1-10
Fan Tray ········································································································································1-11
Operating Environment··················································································································1-11
Components··········································································································································1-11
MPU–NSQ1MPUA0 ······················································································································1-11
LPU–NSQ1GT8C40 ······················································································································1-17
LPU–NSQ1XP20···························································································································1-22
Power Supply Module····················································································································1-23
Port Lightning Arrester (Optional)··································································································1-25
Power Lightning Arrester (Optional)······························································································1-25
Signal Lightning Arrester (Optional) ······························································································1-26
System Software ···························································································································1-26

1-1
1 Firewall Overview
Introduction
The H3C SecPath F5000-A5 firewall (hereinafter referred to as the F5000-A5) is a high-end core
firewall product developed by Hangzhou H3C Technologies Co., Ltd. (hereinafter referred to as H3C) to
deliver extremely high-performance security solutions for large-sized enterprises, carriers and data
center networks.
The F5000-A5 delivers the following features based on its powerful multi-core processor and
FPGA-based hardware acceleration technologies:
zAdopts dual-power input, passive backplane, switch architecture, and distributed modular
architecture.
zSeparates the control plane from the data plane: At the control plane, a powerful multi-core
processor is used for service scheduling and application identification. At the data plane, a
dedicated field programmable gate array (FPGA) is used for rapid forwarding of data streams.
Moreover, additional service cards can be used to expand the process capability at the data plane.
zIn addition to traditional firewall functions, the F5000-A5 supports virtual firewall, attack defense,
and content filtering, thus delivering more effective network protection.
zUses the application specific packet filter (ASPF) status detection technology to monitor
connection processes, detect illegal operations, and implement dynamic packet filtering with ACLs.
zSupports server load balancing and link load balancing functions.
zSupports high-performance virtual private network (VPN) services, such as IPSec VPN, GRE, and
L2TP.
zProvides abundant routing capabilities and supports multiple routing protocols including Routing
Information Protocol (RIP), Open Shortest Path First (OSPF), and Border Gateway Protocol
(BGP).
zSupports Web-based configuration and management.
zCollects and conducts statistics of audit information such as NAT and security events through
H3C’s audit systems (e.g. SecCenter, Xlog, and QuidView).
zConforms to both international and national standards to ensure interoperability with products of
different manufacturers at every layer.

1-2
Physical Description
Front View
Figure 1-1 Front view of the F5000-A5
(1) (2) (3)
(7) (5)(8)(9)(10)
(13)
(6)
(15)
(14)
(12)
(11)
(4)
(1) Left mounting bracket (2) Main processing unit (MPU)
(3) Right mounting bracket (4) Chassis handle
(5) Weight-bearing warning label (50 kg/110.2 lb.) (6) Fan tray
(7) AC power module (PWR1) (8) Blank panel for PoE PSU (reserved PoE
slot)
(9) Blank panel for DC power module (PWR2) (10) ESD socket and silkscreen
(11) Blank panel for LPU (Slot 4) (12) Blank panel for LPU (Slot 3)
(13) Blank panel for LPU (Slot 2) (14) Blank panel for LPU (Slot 1)
(15) Cable management bracket
Currently, the device does not support power over Ethernet (PoE).

1-3
Rear View
Figure 1-2 Rear view of the F5000-A5
(2)
(1)
(4)
(6)
(7)
(8)(9)
(3)
(5)
(1) Warning label (2) Handle on the rear chassis panel
(3) Upper slide rail for the air filter (optional) (4) Air filter (optional)
(5) Lower slide rail for the air filter (optional) (6) Chassis handle
(7) Weight-bearing warning label (50 kg/110.2 lb.) (8) Grounding screw and sign
(9) Vents
Do not hold the handle indicated by (2) in Figure 1-2 on the rear chassis panel to move the chassis
because it is designed for the convenience of the rear chassis panel removal, but not for bearing the
chassis weight.

1-4
System Specifications
MPU–NSQ1MPUA0
Front view
Figure 1-3 Front view of the MPU
(1) Link status LED of the management
Ethernet port (LINK)
(2) Data reception/transmission LED of the
management Ethernet port (ACT)
(3) Link status LED of the HA port (LINK) (4) Data reception/transmission LED of the HA port
(ACT)
(5) CF card eject button (CF CARD) (6) CF card slot
(7) CF card LED (CF) (8) Run LED (RUN)
(9) Active LED of the MPU (ACT) (10) Alarm LED (ALM)
(11) Reset button (RESET) (12) USB interface 1 LED (USB1)
(13) USB interface 1 (1) (14) USB interface 0 (0)
(15) AUX port (AUX) (16) Console port (CONSOLE)
(17) HA port-10/100/1000BASE-T (HA) (18) Management Ethernet port-10/100/1000BASE-T
(MANAGEMENT)
(19) Ejector lever (20) Captive screw
Currently, the device supports only one MPU and the MPU must be inserted in Slot 0.
Technical specifications
Table 1-1 Technical specifications of the MPU
Item Specification
Processor RMI XLR732 1 GHz
Processor cores 8
Flash 4 MB
Memory type and size
DDR2 SDRAM
2 memory slots
2 GB (default)
Memory modules must be used in pairs with the same size.
Console port 1 (9600 bps to 115200 bps, 9600 bps by default)

1-5
Item Specification
AUX port 1 (9600 bps to 115200 bps, 9600 bps by default)
Management Ethernet port 1 (10Base-T/100Base-TX/1000Base-T)
HA port 1 (10Base-T/100Base-TX/1000Base-T)
CF card z256 MB by default for the built-in CF card
z256 MB, 512 MB, or 1 GB for an optional external CF card
USB interfaces
2 (USB 0: operating in the host mode; USB 1: operating in the device
mode)
Reserved for future use
Reset button 1
zThe flash is used for storing the boot file—the BootWare program.
zThe memory is used for storing system data during operation and caching data in data forwarding.
zA CF card is used for storing the software system and configuration files of the device.
LEDs
Figure 1-4 LEDs on the MPU
(1)
(2)
(3)
(4)
(5)
(9)
(6)
(7)
(8)
(1) Link status LED of the management
Ethernet port (LINK)
(2) Data reception/transmission LED of the
management Ethernet port (ACT)
(3) Link status LED of the HA port (LINK) (4) Data reception/transmission LED of the HA port
(ACT)
(5) CF card LED (CF) (6) Run LED (RUN)
(7) Data reception/transmission LED of the management Ethernet port/HA port (ACT)
(8) Alarm LED (ALM) (9) USB interface 1 LED
1) Device status LEDs

1-6
Table 1-2 Description of the device status LEDs
LED Status Description
OFF No power input or the MPU is faulty.
Slow blinking (1 Hz) The MPU is operating normally.
Fast blinking (8 Hz)
The application software is being loaded (in this state, never
power off the device or hot-swap the MPU; otherwise the
MPU may be damaged), or the MPU is not working.
RUN (green)
Reset The RUN LED goes off after the system is reset and flashes
fast on system startup.
OFF The MPU is in the standby state or there is no power input.
ACT (yellow) ON The MPU is in the active state.
OFF The system is operating normally with no alarms.
ON A fault has occurred to the system. In this state, check the
system log immediately.
ALM (red)
Fast blinking (8 Hz) A critical fault has occurred to the system. In this state,
handle the fault immediately.
2) Management Ethernet port/HA port LEDs
Table 1-3 Description of the management Ethernet port/HA port LEDs
LED Status Description
OFF No link is present on the port.
LINK (green) ON A link is present on the port.
OFF No data is being transmitted or received on the port.
ACT (yellow) ON Data is being transmitted or received on the port.
3) USB interface LED
Table 1-4 Description of the USB interface LED
LED Status Description
OFF No host is connected to the device-mode USB interface.
ON A host is in connection with the device-mode USB interface. The
USB cable can be unplugged in this state.
USB (green)
Blinking Data is being transmitted or received through the device-mode
USB interface. Do not unplug the USB cable in this state.
USB interfaces are reserved for future use.

1-7
4) CF card LED
Table 1-5 Description of the CF card LED
LED Status Description
OFF No CF card is present or the CF card is not recognizable.
ON A CF card is in position and has been detected.
CF (green)
Blinking The system is accessing the CF card. Do not remove the CF
card in this state.
Do not remove the CF card when the CF LED is blinking. Otherwise, the files stored on the CF card will
be damaged.
LPU–NSQ1GT8C40
Introduction
An NSQ1GT8C40 line processing unit (LPU) provides eight electrical interfaces and four Combo
interfaces, delivering high-speed service process capabilities. Note that:
zAn NSQ1GT8C40 LPU can be inserted in slot 1, 2, 3, or 4 of the F5000-A5.
zAn F5000-A5 needs to be equipped with an MPU and at least one LPU to work normally.
Figure 1-5 Front view of NSQ1GT8C40
(1) GE interface 1 (2) GE interface 3
(3) GE interface 5 (4) GE interface 7
(5) GE interface 9 (6) SFP interface 9
(7) SFP interface 9 LED (SFP9) (8) SFP interface 8 LED (SFP8)
(9) GE interface 11 (10) SFP interface 11
(11) SFP interface 11 LED (SFP11) (12) SFP interface 10 LED (SFP10)
(13) LPU LED (RUN) (14) SFP interface 10
(15) GE interface 10 (16) SFP interface 8
(17) GE interface 8 (18) GE interface 6
(19) GE interface 4 (20) GE interface 2
(21) GE interface 0 (22) Eject lever
(23) Captive screw

1-8
Technical specifications
Table 1-6 Technical specifications of NSQ1GT8C40
Item Description
Memory type and size
DDR2 SDRAM
1 memory slot
512 MB (default), 1 GB (maximum)
8
10 Mbps, half/full duplex
100 Mbps, half/full duplex
Electrical interfaces
1000 Mbps, full duplex
4 (electrical/optical)
10 Mbps, half/full duplex
100 Mbps, half/full duplex
Electrical interfaces
1000 Mbps, full duplex
Combo interfaces
Optical interfaces 1000 Mbps, full duplex
Power consumption monitoring Supported
zA Combo interface is comprised of an electrical interface and a small form-factor pluggable (SFP)
interface.
zFor an optical/electrical Combo interface, the default operating interface is the electrical interface.
zFor a Combo interface, either the electrical interface or the optical interface can operate at one time.
You can use the combo enable { copper | fiber } command in interface view to switch between the
electrical and optical interfaces. For details about the combo enable { copper | fiber } command,
refer to H3C SecPath Series Security Products User Manual.
LEDs
Table 1-7 Description of the LEDs on NSQ1GT8C40
LED Status Description
OFF No power input or the LPU is faulty.
Slow blinking (1 Hz) The LPU is operating normally.
Fast blinking (8 Hz)
The application software is being loaded (in this state,
never power off the device or hot-swap the LPU; otherwise
the LPU may be damaged), or the LPU is not working.
RUN
(green)
Reset The RUN LED goes off after the system is reset and
flashes fast on system startup.

1-9
LED Status Description
OFF No link is present on the corresponding interface.
Solid green A 1000 Mbps link is present on the interface.
Blinking green Data is being transmitted or received at 1000 Mbps.
Solid yellow A 10/100 Mbps link is present on the interface.
GE0 through
GE11
(yellow/green)
Blinking yellow Data is being transmitted or received at 10/100 Mbps.
OFF No fiber link is present on the interface.
Solid green A fiber link is present on the interface.
Blinking green Data is being transmitted or received at 1000 Mbps.
SFP8 through
SFP11
(yellow/green)
Solid yellow The optical module fails to be detected.
LPU–NSQ1XP20
Introduction
An NSQ1XP20 provides two Ten-gigabit small form-factor pluggable (XFP) interfaces, delivering
high-speed service process capabilities. The front panel of the LPU provides one LED for each interface.
Currently, this LPU supports only the LAN PHY mode, but not the WAN PHY mode. Note that:
zNSQ1XP20 can be inserted in slot 1, 2, 3, or 4 of the F5000-A5.
zThe F5000-A5 needs to be equipped with an MPU and at least one LPU to work normally.
Figure 1-6 Front view of NSQ1XP20
(1) Captive screw (2) Eject lever
(3) XFP interface 0 (4) XFP interface 0 LED (XFP0)
(5) XFP interface 1 (6) XFP interface 1 LED (XFP1)
(7) LPU LED (RUN)
Technical specifications
Table 1-8 Technical specifications of NSQ1XP20
Item Description
Memory type and size
DDR2 SDRAM
1 memory slot
512 MB (default), 1 GB (maximum)
XFP interfaces 2
10GBASE-R
Power consumption monitoring Supported

1-10
LPU LEDs
Table 1-9 Description of the LEDs on NSQ1XP20
LED Status Description
OFF No power input or the LPU is faulty.
Slow blinking (1 Hz) The LPU is operating normally.
Fast blinking (8 Hz)
The application software is being loaded (in this state,
never power off the device or hot-swap the LPU; otherwise
the LPU may be damaged), or the LPU is not working.
RUN (green)
Reset The RUN LED goes off after the system is reset and
flashes fast on system startup.
OFF No link is present on the interface.
ON A link is present on the interface.
XFP0 (green)
Blinking Data is being transmitted or received on the interface.
OFF No link is present on the interface.
ON A link is present on the interface.
XFP1 (green)
Blinking Data is being transmitted or received on the interface.
Dimensions and Weight
Table 1-10 Dimensions and weight of the F5000-A5
Item Description
Dimensions without feet and mounting brackets
(H × W × D) 308 × 436 × 476 mm (12.13 × 17.17 × 18.74 in.)
Weight (full configuration) 50 kg (110.23 lb.)
Voltage and Current
Table 1-11 Specifications of the voltage and current
Item Description
Rated voltage range AC powered: 100 VAC to 240 VAC; 50/60 Hz
DC powered: –48 VDC to –60 VDC
Maximum input current AC powered: 10 A
DC powered: 25 A
Maximum power consumption 650 W

1-11
Fan Tray
Table 1-12 Technical specifications of the fan tray
Item Specification
Rated voltage 12 VDC
Total fan power consumption 50 W
Dimensions (H × W × D) 227 × 31 × 413.3 mm (8.94 ×1.22 × 16.27 in.)
Table 1-13 Description of the fan tray LEDs
LED Status Description
RUN (green) ON The fan tray is working normally.
ALM (red) ON The fan tray is faulty.
The F5000-A5 supports automatic fan speed adjustment but not hot-swapping of the fan tray.
Operating Environment
Table 1-14 Operating environment specifications
Item Description
Operating temperature 0°C to 45°C (32°F to 113°F)
Operating humidity 10% to 95%, noncondensing
Altitude –60 m to +4 km (–196.85 ft. to +2.49 miles)
Components
MPU–NSQ1MPUA0
Processor
The NSQ1MPUA0 is an MPU that uses an RMI XLR732 1 GHz processor as the route processing
engine.
Flash
The flash size is 4 MB, of which 1 MB is used for storing the boot file—BootWare and the remaining
space for BootWare backup and storing important system parameters.

1-12
Memory module
The memory module is used for storing data exchanged between the system and the CPU. The default
memory size of the MPU is 2 GB, which is the maximum memory size supported by the MPU. The MPU
provides two memory slots for memory modules of the same size.
You can use DDR2 SDRAM-1GB for the MPU of the device.
CF card
1) Introduction
A compact flash (CF) card is used for storing logs, host files, and configuration files.
The F5000-A5 is equipped with a 256 MB built-in CF card, which is identified with cfa0. In addition, the
device provides an external CF card slot to extend the local storage space. A CF card inserted into the
CF card slot is identified with cfb0.
The CF cards supported by the device are available in three sizes:
z256 MB
z512 MB
z1 GB
Use CF cards provided by H3C only. The device may be incompatible with other CF cards.
2) CF card and slot
Figure 1-7 CF card and the LED
(1) (2) (3)
(1) Eject button (CF CARD) (2) CF card slot
(3) CF card LED (CF)
3) CF card LED
For the description of the CF card LED, see Table 1-5.

1-13
The CF card is hot-swappable. When the CF LED is blinking, do not unplug the CF card. Otherwise, the
file system on the CF card may be damaged.
Console port
1) Introduction
The F5000-A5 provides an RS232 asynchronous serial console port, which can be connected to a
computer for system debugging, configuration, maintenance, management, and host software loading.
2) Technical specifications
Table 1-15 Technical specifications of the console port
Item Description
Connector type RJ-45
Compliant standards RS232
Baud rate 9600 bps to 115200 bps, 9600 bps by default
Maximum transmission distance 15 m (49.21 ft.)
Services
zConnection to an ASCII terminal
zConnection to the serial interface of a local PC to run
the terminal emulation program
zCommand line interface (CLI)
3) Console cable
The console cable is an 8-core shielded cable. The RJ-45 connector at one end of the cable is
connected to the console port on the device, and the DB-9 female connector at the other end is
connected to the serial port of a configuration terminal.
Figure 1-8 illustrates the console cable.
Figure 1-8 Console cable
Table 1-16 Console cable connector pinouts
RJ-45 pin Signal direction DB-9 Signal
1 Æ8 CTS
2 Æ6 DSR
3 Æ2 RXD

1-14
RJ-45 pin Signal direction DB-9 Signal
4 Å1 DCD
5 — 5 GND
6 Å3 TXD
7 Å4 DTR
8 Å7 RTS
For the connection of the console cable, refer to the section talking about connecting a console cable in
Chapter 4 “Installing the Firewall.”
AUX port
1) Introduction
The AUX port is an RS232 asynchronous serial port used for remote configuration or dialup backup.
You need to connect the local modem to the remote modem through the PSTN to reach the remote
device for remote system debugging, configuration, maintenance, and management. In case that the
console port is faulty, the AUX port can be connected to a terminal as a backup port of the console port.
For details, refer to Chapter 8 “Troubleshooting.”
2) Technical specifications
Table 1-17 Technical specifications of the AUX port
Item Description
Connector type RJ-45
Compliant standard RS232
Baud rate 9600 bps to 115200 bps, 9600 bps by default
Service Connection to the serial interface of a remote PC through a pair of
modems to establish a dial-up connection with the remote PC
3) AUX cable
The AUX cable is an 8-core shielded cable. The RJ-45 connector at one end of the cable is connected
to the AUX port on the firewall, and the DB-25 male connector or DB-9 male connector at the other end
is connected to the serial port on a modem as needed.