3Com SECPATH U200-CS User manual

H3C SecPath U200 Series Unified Threat
Management Products
Installation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Manual Version: 5PW101-20090520

Copyright © 2009, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Technical Support
[e-mail]
http://www.h3c.com

About This Manual
Organization
H3C SecPath U200 Series Unified Threat Management Products Installation Manual is organized as
follows:
Chapter Contents
1 Product Overview Briefly introduces the product specifications, as well as the features
and applications of the H3C SecPath U200 series UTM devices.
2 Interface Modules Describes the interface cards and interface modules supported by
the H3C SecPath U200 series UTM devices.
3 Preparing for Installation Describes the site requirements for installing the H3C SecPath U200
series UTM devices, safety recommendations before and during
installation, and required tools.
4 Installing the U200 Series
Device
Introduces how to install an H3C SecPath U200 series UTM device,
as well as how to connect the power cable, console cable, Ethernet
cable, and interface cable.
5 Starting and Configuring
the U200 Series Device
Describes how to boot and configure an H3C SecPath U200 series
UTM device, including device startup, power-on, and initialization of
system files.
6 Maintaining Software Introduces how to maintain software of the H3C SecPath U200
series UTM devices, including upgrading software and updating
configuration files.
7 Maintaining Hardware Introduces how to maintain hardware of the H3C SecPath U200
series UTM devices.
8 Troubleshooting Describes some problems you may encounter during installation and
startup of an H3C SecPath U200 series UTM device and how to
solve them.
Appendix Compliance and
Safety Manual
This section introduces part of the compliance and safety
precautions that should be followed during the installation and
maintenance of the equipment.
Conventions
The manual uses the following conventions:
Command conventions
Convention Description
Boldface The keywords of a command line are in Boldface.
italic Command arguments are in italic.
[ ] Items (keywords or arguments) in square brackets [ ] are optional.
{ x | y | ... }
Alternative items are grouped in braces and separated by vertical bars.
One is selected.
[ x | y | ... ]
Optional alternative items are grouped in square brackets and
separated by vertical bars. One or none is selected.
{ x | y | ... } *
Alternative items are grouped in braces and separated by vertical bars.
A minimum of one or a maximum of all can be selected.

Convention Description
[ x | y | ... ] *
Optional alternative items are grouped in square brackets and
separated by vertical bars. Many or none can be selected.
&<1-n> The argument(s) before the ampersand (&) sign can be entered 1 to n
times.
# A line starting with the # sign is comments.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in
Boldface. For example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File >
Create > Folder.
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause
bodily injury.
Means reader be careful. Improper operation may cause data loss or
damage to equipment.
Means a complementary description.
Related Documentation
In addition to this manual, each H3C SecPath Series Security Products documentation set includes the
following:
Manual Description
H3C SecPath Series Security
Products User Manual
Describes the features, operation fundamentals, and configuration
commands of the H3C SecPath series security products, guides
you to make configuration, and provides configuration examples.
Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at this URL:
http://www.h3c.com.
The following are the columns from which you can obtain different categories of product documentation:
[Products & Solutions]: Provides information about products and technologies.
[Technical Support & Document > Technical Documents]: Provides several categories of product
documentation, such as installation, configuration, and maintenance.
[Technical Support & Document > Software Download]: Provides the documentation released with the
software version.

Documentation Feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.
Environmental Protection
This product has been designed to comply with the requirements on environmental protection. For the
proper storage, use and disposal of this product, national laws and regulations must be observed.

i
Table of Contents
1 Product Overview······································································································································1-1
Introduction ·············································································································································1-1
Features ··········································································································································1-1
Physical Description································································································································1-2
U200-A ············································································································································1-2
U200-M············································································································································1-3
U200-S ············································································································································1-4
Technical Specifications··························································································································1-5
Processor and Storages··················································································································1-5
Dimensions and Weight···················································································································1-5
Fixed Interfaces and Slots···············································································································1-6
Power Input ·····································································································································1-6
Operating Environment Specifications ····························································································1-6
Components············································································································································1-7
Processor and Storages··················································································································1-7
Front Panel LEDs ····························································································································1-7
Fixed Interfaces ·······························································································································1-8
AC Power Input ·····························································································································1-14
Clock··············································································································································1-14
Port Lightning Arrester (Optional)··································································································1-14
Power Lightning Arrester (Optional) ······························································································1-15
Signal Lightning Arrester (Optional) ······························································································1-15
System Software ···························································································································1-16

1-1
1 Product Overview
Introduction
The H3C SecPath U200 Series Unified Threat Management Products are new-generation UTM devices
designed for enterprise users.
The U200 series comprises three models:
zU200-A: Designed for large- and medium-sized enterprise users
zU200-M: Designed for medium-sized enterprise users
zU200-S: Designed for small- and medium-sized enterprise users
In addition to traditional firewall functions, the U200 series protect network security by providing a wide
range of functions including virtual firewall, security zone, intrusion detection and protection, gateway
anti-virus, anti-spam, P2P traffic control, and URL filtering. With the application specification packet filter
(ASPF) technology, a U200 series device can monitor connection setup processes and illegal
operations, and dynamically filter packets based on ACLs. Moreover, the U200 series support multiple
VPN services including IPSec VPN, L2TP VPN, and GRE VPN, and thereby can be used for
constructing a variety of VPN networks. The series deliver abundant routing capabilities and support
RIP and OSPF. Adopting a high-performance multi-core CPU, the U200-A, U200-M and U200-S can
support up to 10, 8, and 7 GE interfaces respectively, delivering high scalability for user investment
protection.
The U200 series are available with AC power supply to ensure high reliability, fully satisfy requirements
for network maintenance, update, and optimization, support detection of chassis internal temperature,
support network management, and provide a Web management interface.
The U200-A provides two MIM expansion slots for future service expansion. Currently, the slots support
the NSQ1GT2UA0 and NSQ1GP4U0 MIM modules.
The U200-M provides one MIM expansion slot and currently supports the same MIM as the U200-A
does.
The U200-S provides a mini expansion slot for future service expansion. Currently, the device supports
the 2-GE and NSQ1WLAN0 interface modules.
Features
The U200 series deliver the following features:
Powerful hardware platform
The U200 series perfectly fit in enterprise networks thanks to the adoption of MIPS64-based CPUs and
integrated high-performance hardware-based VPN accelerators.
Abundant security protection functions
zSecurity zone management: You can create security zones based on physical interfaces, logical
interfaces, Layer-2 Ethernet interfaces, or combinations of Layer-2 Ethernet interfaces and VLANs.
Interfaces belonging to the same security zone share the same security requirements in security

1-2
policy control. With security zones, security administrators can classify interfaces with different
security requirements into different zones. This simplifies policy maintenance and separates
network services and security services.
zPacket filtering: Applies standard or extended ACL rules between security zones to implement
packet filtering based on UDP or TCP port information. You can also implement packet filtering
based on time ranges.
zApplication specific packet filter (ASPF): Dynamically determines whether to forward or drop a
packet by checking its application layer protocol information (such as FTP, HTTP, SMTP, RTSP, or
any other application layer protocol carried on TCP/UDP), monitoring the status of
connection-oriented application layer protocols, and maintaining status information for each
connection.
zP2P traffic control: Performs in-depth packet inspection to identify and manipulate P2P traffic. With
various control policies, a U200 series device controls P2P traffic flexibly.
zVirtual firewall: You can create multiple virtual firewalls, each implementing a separate security
policy. These virtual firewalls are isolated from one another and thus can be managed separately.
zDiverse attack prevention functions: Guards against attacks including Land, Smurf, Fraggle,
WinNuke, Ping of Death, Tear Drop, IP Spoofing, IP fragment, fragment, TCP flag invalid, large
ICMP packet, IP Sweep, port scan, and DDoS attacks such as SYN Flood, UDP Flood, and ICMP
Flood.
zPacket filtering: Blocks specified URLs to better utilize network resources.
Powerful VPN functions
zIPSec and GRE
zIKE and PKI
zA built-in hardware-based VPN encryption engine, ensuring high-performance VPN processing
Physical Description
U200-A
Front view
Figure 1-1 U200-A front view
(1) 10/100/1000 Mbps electrical Ethernet
interface 0
(2) 10/100/1000 Mbps electrical Ethernet
interface 1
(3) 10/100/1000 Mbps electrical Ethernet
interface 2
(4) 10/100/1000 Mbps electrical Ethernet
interface 3
(5) 10/100/1000 Mbps electrical Ethernet
interface 4
(6) 10/100/1000 Mbps electrical Ethernet
interface 5
(7) Console port (CONSOLE) (8) USB interface
(9) CF card ejector button (10) CF card slot
(11) System LED (SYS) (12) Slot 2 LED (SLOT2)
(13) Slot 1 LED (SLOT1) (14) Power LED (PWR)
(15) CF card LED (CF)

1-3
Rear view
Figure 1-2 U200-A rear view
(1) (2) (3) (4) (5) (6)
(1) Grounding screw and symbol (2) OPEN BOOK symbol
(3) AC power switch (ON/OFF) (4) AC power socket
(5) Slot 1 (with an NSQ1GT2UA0 module
installed)
(6) Slot 2 (with an NSQ1GT2UA0 module
installed)
The open book symbol is used to remind the operator to read the relevant chapters when performing
any of these operations on the U200-A:
zConnecting the ESD-preventive wrist strap
zInstalling the device on a workbench or in a rack
zConnecting the PGND cable or the AC power cord
zConnecting the power lightning arrester, signal lightning arrester, or port lightning arrester
zConnecting the console cable, AUX cable, or Ethernet cables
zOpening and closing the chassis cover
zInstalling or removing the mini card (available only on the U200-S), MIM module (available only on
the U200-A and U200-M), or CF card
U200-M
Front view
Figure 1-3 U200-M front view
(1) 10/100/1000 Mbps electrical Ethernet
interface 0
(2) 10/100/1000 Mbps electrical Ethernet
interface 1
(3) 10/100/1000 Mbps electrical Ethernet
interface 2
(4) 10/100/1000 Mbps electrical Ethernet
interface 3
(5) 10/100/1000 Mbps electrical Ethernet
interface 4
(6) 10/100/1000 Mbps electrical Ethernet
interface 5
(7) Console port (CONSOLE) (8) USB interface
(9) CF card ejector button (10) CF card slot
(11) System LED (SYS) (12) Slot 1 LED (SLOT1)
(13) Power LED (PWR) (14) CF card LED (CF)

1-4
Rear view
Figure 1-4 U200-M rear view
(1) Grounding screw and symbol (2) OPEN BOOK symbol
(3) AC power switch (ON/OFF) (4) AC power socket
(5) Slot 1 (with an NSQ1GT2UA0 module installed)
For detailed description of the OPEN BOOK symbol, refer to the note under Figure 1-2.
U200-S
Front view
Figure 1-5 U200-S front view
(1) 10/100/1000 Mbps electrical Ethernet
interface 0
(2) 10/100/1000 Mbps electrical Ethernet
interface 1
(3) 10/100/1000 Mbps electrical Ethernet
interface 2
(4) 10/100/1000 Mbps electrical Ethernet
interface 3
(5) 10/100/1000 Mbps electrical Ethernet
interface 4 (6) Console port (CONSOLE)
(7) USB interface (8) CF card ejector button
(9) CF card slot (10) System LED (SYS)
(11) Slot LED (SLOT) (12) Power LED (PWR)
(13) CF card LED (CF)

1-5
Rear view
Figure 1-6 U200-S rear view
(1) AC power socket (2) Slot (with 2GE)
(3) OPEN BOOK symbol (4) Grounding screw and sign
For detailed description of the open book symbol, refer to the note under Figure 1-2.
Technical Specifications
Processor and Storages
Table 1-1 Processor and storages of the U200 series
Description
Item U200-A U200-M U200-S
Processor RMI XLS208 750 MHz RMI XLS404 800 MHz
Flash 32 MB
Memory type and size DDR2 SDRAM
1 GB by default
DDR2 SDRAM
512 MB by default
External CF card 256 MB, 512 MB, or 1 GB
Dimensions and Weight
Table 1-2 Dimensions and weight of the U200 series
Description
Item U200-A U200-M U200-S
Dimensions (H × W × D),
excluding feet and
mounting brackets 44.2 × 442 × 400 mm (1.74 × 17.40 × 15.75 in.)
43.6 × 300 × 260
mm (1.72 × 11.81 ×
10.24 in.)
Weight (fully configured) 5.9 kg (13.01 lb) 5.5 kg (12.13 lb) 2.22 kg (4.89 lb)

1-6
Fixed Interfaces and Slots
Table 1-3 Interface (fixed) and slot specifications
Description
Item U200-A U200-M U200-S
Console port 1 (9600 bps to 115200 bps, 9600 bps by default)
USB
interface 1 (host mode, reserved without software support)
6 (GE0 to GE5) 5 (GE0 to GE4)
GE
interfaces 10/100/1000 Mbps electrical interfaces, MDI/MDIX autosensing
CF card slot 1 external CF card slot (256 MB, 512 MB, or 1 GB)
Slots
2 MIM expansion slots
Available interface module:
NSQ1GT2UA0 and
NSQ1GP4U0
1 MIM expansion slot
Available interface module:
NSQ1GT2UA0 and
NSQ1GP4U0
1 Mini expansion slot
Available interface
module: 2GE and
NSQ1WLAN0
Power Input
Table 1-4 Input voltage specifications
Description
Item U200-A U200-M U200-S
Rated voltage range 100 VAC to 240 VAC; 50 Hz or 60 Hz
Maximum input current 1.6 A 0.6 A
Maximum power 100 W 54 W
Operating Environment Specifications
Table 1-5 Operating environment specifications
Description
Item U200-A U200-M U200-S
Operating temperature 0°C to 45°C (32°F to 113°F)
Operating humidity
(noncondensing) 10% to 95%
Operating altitude –60 to 3000 m (–196.85 to +9842.52 ft.) –60 to 2000 m (–196.85
to +6561.68 ft.)

1-7
Components
Processor and Storages
Processor
A U200 series device uses a multi-core microprocessor as its data forwarding and service processing
engine.
Flash
A U200 series device uses a 32 MB flash for storing BootWare and APP.
Memory
The memory temporarily stores data for the running system and buffering data to be forwarded. By
default, the U200-A and U200-M are equipped with a 1 GB memory while the U200-S has a 512 MB
memory.
Front Panel LEDs
Figure 1-7 U200-A front panel LEDs
Figure 1-8 U200-M front panel LEDs
Figure 1-9 U200-S front panel LEDs
Table 1-6 Description of the front panel LEDs
LED Status Description
Off No CF card is in position or the CF card cannot be
identified.
On A CF card is in position and has passed the test. It can
be removed in this state.
CF (green)
Blinking The system is accessing the CF card. Do not unplug
the card in this state.

1-8
LED Status Description
Off The system is powered off or faulty.
Slow blinking (at 1 Hz) The interface module is operating normally as
configured.
SYS (green)
Fast blinking (at 8 Hz) Software is being loaded or the system is not working.
Off The power module is not working or faulty.
PWR (green)
On The power module is supplying power normally.
Off No interface module is in the slot or the interface
module is faulty.
SLOT1/SLOT2/
SLOT (green)
On An interface module is in the slot and operating
normally.
Fixed Interfaces
Table 1-7 Description of the fixed interfaces
Interface Description
Console port 1
USB interface 1 Host mode, reserved without software support
U200-A 6 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE5
U200-M 6 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE5
GE
interfaces
U200-S 5 10/100/1000 Mbps electrical Ethernet interfaces: GE0 to GE4
CF card slot 1
Three CF card options of different memory sizes are available:
z256 MB
z512 MB
z1 GB
Console port
1) Introduction
A U200 series device provides an RS232 asynchronous serial console port (Console), which can be
connected to a computer for system debugging, configuration, maintenance, management, and
software loading.
2) Specifications
Table 1-8 Technical specification of the console port
Attribute Description
Connector type RJ-45
Interface standard Asynchronous EIA/TIA-232
Baud rate 9600 bps (default) to 115200 bps
Maximum transmission distance 15 m (49.21 ft.)

1-9
Attribute Description
Services
Connection to an ASCII terminal
Connection to the serial interface of a local PC to run the
terminal emulation program
Command line interface
3) Console cable
The console cable is an 8-core shielded cable. The RJ-45 connector at one end of the cable is for the
console port on the UTM device, and the DB-9 female connector at the other end is for the serial port on
a configuration terminal.
Figure 1-10 illustrates the console cable.
Figure 1-10 Console cable
Table 1-9 Console cable pinouts
RJ-45 Signal direction DB9 Signal
1 Æ8 CTS
2 Æ6 DSR
3 Æ2 RXD
4 Å1 DCD
5 — 5 GND
6 Å3 TXD
7 Å4 DTR
8 Å7 RTS
For how to connect the console cable, refer to the “Connecting the Console Cable” section in Chapter 4
“Installing the U200 Series Device.”
Ethernet interfaces
1) Introduction
A UTM series device provides fixed 10/100/1000Base-T Ethernet interfaces on its front panel, the
number of which depends on the device model. Each fixed Ethernet interface (RJ-45) uses two built-in

1-10
LEDs in the upper corners to indicate its status.
Table 1-10 Description of Ethernet interface LEDs
Status Description
Off No link is present.
LINK
On A link is present.
Off No data is being received or transmitted.
ACT
Blinking Data is being received or transmitted.
2) Specifications
Table 1-11 Technical specifications of the Ethernet interfaces
Item Description
Connector type RJ-45
Interface type Autosensing (Ethernet does not support MDI/MDIX autosensing when
working in the forced mode)
Frame format Ethernet_II
Ethernet_SNAP
10 Mbps (autosensing) Half-/full-duplex auto-negotiation
100 Mbps (autosensing) Half-/full-duplex auto-negotiation
Rate and negotiation
mode
1000 Mbps (autosensing) Full-duplex auto-negotiation
The media dependent interface (MDI) standard is typically used for the Ethernet interfaces of network
adaptors. The media dependent interface crossover (MDI-X) standard is typically used on hubs or LAN
switches.
3) RJ-45 connector
The 10/100/1000Base-T Ethernet interfaces of the U200 series use RJ-45 connectors and support
MDI/MDIX autosensing. Category-5 twisted pair cables are used for RJ-45 connectors. Figure 1-11
shows an RJ-45 connector.
Figure 1-11 RJ-45 connector

1-11
When working in the forced mode, Ethernet does not support MDI/MDIX autosensing.
4) Cable connecting electrical Ethernet interfaces
Ethernet electrical interfaces usually use category-5 twisted pair cables. Ethernet cables fall into two
categories:
zStandard cables: Also known as straight-through cables. At both ends of a standard cable, wires
are crimped in the RJ-45 connectors in the same sequence. A straight-through cable is used for
connecting a terminal (for example, a PC or UTM device) to a hub or LAN switch. Straight-through
cables are shipped with the U200 series.
zCrossover cables: At both ends of a crossover cable, wires are crimped in the RJ-45 connectors in
different sequences. A crossover cable is used for connecting two terminals (for example, two PCs
or UTM devices). You can make crossover cables yourself as needed.
Figure 1-12 Ethernet cable
Table 1-12 Straight-through cable connector pinouts
RJ-45 Signal Category-5
twisted pair Signal direction RJ-45
1 TX+ White (Orange) Æ1
2 TX- Orange Æ2
3 RX+ White (Green) Å3
4 — Blue — 4
5 — White (Blue) — 5
6 RX- Green Å6
7 — White (Brown) — 7
8 — Brown — 8
Table 1-13 Crossover cable connector pinouts
RJ-45 Signal direction Category-5
twisted pair Signal direction RJ45
1 TX+ White (Orange)
Æ3
2 TX- Orange
Æ6
3 RX+ White (Green)
Å1

1-12
RJ-45 Signal direction Category-5
twisted pair Signal direction RJ45
4 — Blue — 4
5 — White (Blue) — 5
6 RX- Green
Å2
7 — White (Brown) — 7
8 — Brown — 8
zYou can refer to the tables above when trying to identify or preparing the two types of Ethernet
cables.
zWhen preparing Ethernet cables, follow the color pairings in the tables. Otherwise, communication
quality will be affected even if the two devices at both ends can communicate.
zWhen preparing Ethernet cables, use shielded cables preferentially for electromagnetic
compatibility.
USB interface
USB interfaces can connect multiple types of devices and provide higher data transfer rates than
common parallel interfaces and serial interfaces.
The U200 series support USB 2.0 to provide important storage and security functions. For example,
with USB interfaces, you can provide large flash memory space for application programs, configuration
files, and VPN certificates for setting up secure VPN connections and, secure distribution of
configuration files.
In addition, USB interfaces provide a backup CF card mechanism to make file backup and restoration
easy and reliable.
Figure 1-13 USB interface
The USB interface provided by a U200 series device is a USB 2.0 type-A interface. Serving as a host, it
can connect an external USB device to expand the device's storage space for storing files and logs and
in addition, facilitate file transfer.

1-13
zAt present, the USB interface provided on a U200 series device is a reserved module without
software support.
zUse the USB flash drives provided by H3C only, because the U200 series may be incompatible
with other USB flash drives.
zAvoid removing the USB flash drive when its LED is flashing. Doing so may cause the file system
on the drive to get corrupted.
CF card
1) Introduction
A compact flash (CF) card is used for storing logs, host files, and configuration files.
A U200 series device provides an external CF card slot for expanding storage space.
Three CF card options of different memory sizes are available:
z256 MB
z512 MB
z1 GB
Use the CF cards provided by H3C only, because the U200 series may be incompatible with other CF
cards.
2) CF card slot
Figure 1-14 CF card
(1) Ejector button (2) CF card slot
(3) CF card LED (CF)
3) CF card LED
For description of the CF card LED, see Table 1-6.

1-14
The CF card is hot-swappable. When the device is reading from or writing to the CF card or performing
any other file system related operation, the CF card LED blinks. Do not unplug the CF card in this state
because doing so can corrupt the file system in it.
AC Power Input
Table 1-14 lists the AC power specifications for the U200 series.
Table 1-14 AC power specifications
Description
Item U200-A U200-M U200-S
Rated voltage range 100 VAC to 240 VAC; 50 Hz or 60 Hz
Maximum input current 1.6 A 0.6 A
Maximum power 100 W 54 W
Clock
The U200 series are designed with a clock module for providing system time. You can set the system
time at the command line interface.
The clock module can work despite power failure to ensure that the system time is correct at reboot.
With the device powered off, the clock module can work for at least 10 years.
Note that:
zNever replace the clock module battery when power is present on the device.
zThe system time gets lost once the clock module battery is removed. You can set it at the
command line interface.
You can use three commands including clock datetime, ock summer-time one-off (or clock
summer-time repeating), and clock timezone to complete setting the system time. See the
accompanying documentation for how to do that.
Port Lightning Arrester (Optional)
Before connecting an outdoor Ethernet cable to an Ethernet port, install a port lightning arrester to
protect the device against lightning strikes.
The port lightning arresters available for the U200 series feature these: