Clavister SG3200 Series User manual

Clavister SG3200 Series
Getting Started Guide
Clavister AB
Sjögatan 6J
SE-89160 Örnsköldsvik
SWEDEN
Phone: [phone]
Fax: [phone]
www.clavister.com
Published 2011-02-23
Copyright ©2011 Clavister AB

Clavister SG3200 Series
Getting Started Guide
Published 2011-02-23
Copyright ©2011 Clavister AB
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without the written consent of Clavister.
Disclaimer
The information in this document is subject to change without notice. Clavister makes no
representations or warranties with respect to the contents hereof and specifically disclaims any
implied warranties of merchantability or fitness for a particular purpose. Clavister reserves the
right to revise this publication and to make changes from time to time in the content hereof
without any obligation to notify any person or parties of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL CLAVISTER OR ITS SUPPLIERS BE LIABLE FOR DAMAGES OF
ANY CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE RESTORATION, WORK
STOPPAGE, LOSS OF SAVED DATA OR ANY OTHER COMMERCIAL DAMAGES OR LOSSES)
RESULTING FROM THE APPLICATION OR IMPROPER USE OF THE CLAVISTER PRODUCT OR
FAILURE OF THE PRODUCT, EVEN IF CLAVISTER IS INFORMED OF THE POSSIBILITY OF SUCH
DAMAGES. FURTHERMORE, CLAVISTER WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST
CUSTOMER FOR LOSSES OR DAMAGES. CLAVISTER WILL IN NO EVENT BE LIABLE FOR ANY
DAMAGES IN EXCESS OF THE AMOUNT CLAVISTER RECEIVED FROM THE END-USER FOR THE
PRODUCT.
2

Table of Contents
Preface................................................................................................................ 5
1.ProductOverview .............................................................................................. 7
1.1.UnpackingtheProduct ............................................................................ 7
1.2.InterfacesandPorts ................................................................................. 9
2.Installation ......................................................................................................12
2.1.InstallationGuidelines ............................................................................12
2.2.ConsolePortConnection .........................................................................14
2.3.ConnectingPower ..................................................................................16
3.CorePlusConfiguration .....................................................................................19
3.1.ManagementWorkstationConnection ......................................................19
3.2.WebInterfaceandWizardSetup ...............................................................24
3.3.ManualWebInterfaceSetup ....................................................................31
3.4.CLISetup ..............................................................................................46
3.5.TroubleshootingSetup ...........................................................................54
3.6.GoingFurtherwithCorePlus ....................................................................56
4.WarrantyService ..............................................................................................59
5.SafetyPrecautions ............................................................................................61
A.Specifications ..................................................................................................64
B.DeclarationsofConformity ................................................................................66
C.VistaIPSetup ...................................................................................................68
D.Windows7IPSetup ..........................................................................................70
E.AppleMacIPSetup ...........................................................................................72
3

List of Figures
1.1.AnUnpackedClavisterSG3200SeriesAppliance .................................................. 8
1.2.FrontViewoftheClavisterSG3200Series. ........................................................... 9
2.1.TheSG3200SeriesRS-232ConsolePort .............................................................14
2.2.RearViewofthe3200Aand3200B ....................................................................16
2.3.RearViewofthe3200C ...................................................................................16
4

Preface
Target Audience
The target audience for this guide is the administrator who has taken delivery of a packaged
Clavister SG3200 Series appliance and is setting it up for the first time. The guide takes the user
from unpacking and installation of the device through to power-up, including network
connections and initial CorePlus configuration.
The guide is for all models of the SG3200 Series. It covers the newer SG3200C as well as older
versions of the 3200.
Text Structure
The text is divided into chapters and subsections. Numbered subsections are shown in the table
of contents at the beginning of the document.
Notes to the main text
Special sections of text which the reader should pay special attention to are indicated by icons
on the left hand side of the page followed by a short paragraph in italicized text. There are the
following types of such sections:
Note
This indicates some piece of information that is an addition to the preceding text. It may
concern something that is being emphasised or something that is not obvious or
explicitly stated in the preceding text.
Tip
This indicates a piece of non-critical information that is useful to know in certain
situations but is not essential reading.
Caution
This indicates where the reader should be careful with their actions as an undesirable
situation may result if care is not exercised.
Important
This is an essential point that the reader should read and understand.
Warning
This is essential reading for the user as they should be aware that a serious situation
may result if certain actions are taken or not taken.
5

Text links
Where a "See section" link is provided in the main text, this can be clicked on to take the reader
directly to that reference. For example, see Section 3.5, “Troubleshooting Setup”.
Web links
Web links included in the document are clickable. For example, http://www.clavister.com.
Trademarks
Certain names in this publication are the trademarks of their respective owners.
CorePlus is the trademark of Clavister AB.
Windows,Windows XP,Windows Vista and Windows 7 are either registered trademarks or
trademarks of Microsoft Corporation in the United States and/or other countries.
Apple and Mac are trademarks of Apple Inc. registered in the United States and/or other
countries.
Preface
6

Chapter 1: Product Overview
• Unpacking the Product, page 7
• Interfaces and Ports, page 9
1.1. Unpacking the Product
This section details the unpacking of the SG3200 Series appliance. Open the packaging box used
for shipping and carefully unpack the contents. The delivered product packaging should contain
the following:
1. The Clavister SG3200 Series appliance.
2. A mounting kit for 19 inch racks.
3. An Ethernet cable.
4. A RS-232 null-modem cable.
5. A Power cord.
6. A CD-ROM containing:
• Clavister software.
• Product documentation in PDF format.
7. A printed guide for getting started.
7

Figure 1.1. An Unpacked Clavister SG3200 Series Appliance
Note: Missing items
If any items are missing from your package, please contact your reseller or distributor.
All documentation can be freely downloaded in PDF format from the Clavister website.
End of Life Treatment
The SG3200 Series appliance is marked with the European Waste Electrical and Electronic
Equipment (WEEE) directive symbol which is shown below.
The product, and any of its parts, should not be discarded of by means of regular refuse disposal.
At end-of-life, the product and parts should be given to an appropriate service that deals with
the removal of such specialist materials.
Chapter 1: Product Overview
8

1.2. Interfaces and Ports
This section is an overview of the SG3200 Series product's external design.
Note: Usage of the terms "interface" and "port"
The terms Ethernet interface and Ethernet port are often used interchangeably. In this
document, interface is used for Ethernet connections and port is used for non-Ethernet
connections.
Figure 1.2. Front View of the Clavister SG3200 Series.
The SG3200 features a number of connection ports:
• On the far left is a RS-232 port for direct console access.
• To the right of the console port are 2 USB ports which are not used in normal CorePlus
operation.
• To the right of the USB ports is an array of 6 x RJ45 Gigabit Ethernet interfaces with logical
interface names ge1 to ge6. These interfaces have equal operational capacity and are
capable of link speed auto-negotiation which means that they can operate with 10Base-T,
100Base-Tx or 1000Base-T.
All ge interfaces support Automatic MDI-X and do not require a crossover cable for direct
connection from another computer.
Interface Status LEDs
The front of the SG3200 Series has an two LEDs over each Ethernet interface which indicates its
status. LED illumination has the following meanings:
•Left LED - indicates activity.
•Right LED - indicates link status. This can be one of:
Chapter 1: Product Overview
9

i. Orange - Gigabit Ethernet link, 1000BaseT
ii. Green - Fast Ethernet link, 100BaseTx
iii. Dark - Ethernet link, 10BaseT
Chapter 1: Product Overview
10

Chapter 1: Product Overview
11

Chapter 2: Installation
• Installation Guidelines, page 12
• Console Port Connection, page 14
• Connecting Power, page 16
2.1. Installation Guidelines
Follow these guidelines when installing your Clavister SG3200 Series appliance:
•Safety
Take notice of the safety guidelines laid out in Chapter 5, Safety Precautions. These are
specified in multiple languages.
•Power
Make sure that the power source circuits are properly grounded and then use the power cord
supplied with the appliance to connect it to the power source.
•Using Other Power Cords
If your installation requires a different power cord than the one supplied with the appliance,
be sure to use a cord displaying the mark of the safety agency that defines the regulations for
power cords in your country. Such marks are an assurance that the cord is safe.
•Power Overload
Ensure that the appliance does not overload the power circuits, wiring and over-current
protection.
To determine the possibility of overloading the supply circuits, add together the ampere
ratings of all devices installed on the same circuit as the appliance and compare the total
with the rating limit for the circuit. The maximum ratings for the SG3200 Series are listed in
Appendix A, Specifications.
•Surge Protection
A third party surge protection device should be considered and is strongly recommended as
a means to prevent electrical surges reaching the appliance. This is discussed again in
Section 2.3, “Connecting Power”.
12

•Temperature
Do not install the appliance in an environment where the operating ambient temperature
could exceed the specified operating range (see Appendix A, Specifications).
The recommended operating temperature range is "room temperature". That is to say, the
temperature most commonly found in a modern office and in which humans feel
comfortable. This is usually considered to be between 20 and 25 degrees Celsius (68 to 77
degrees Fahrenheit). Special rooms for computer equipment may use a lower range.
•Airflow
Make sure that airflow around the sides and back of the appliance is not restricted.
The SG3200 Series is cooled by a bank of cooling fans built into the back of the unit. In
addition there is another cooling fan also located at the back which is dedicated to the power
supply. None of these fans are field replaceable.
•Dust
Do not expose the appliance to environments with elevated dust levels. This is particularly
important for the operation of the fans, both general cooling fans and the cooling fan found
in SG3200 Series power supplies. Elevated dust levels can significantly reduce the operating
lifetime of fans.
Note
Detailed information concerning power supply range, operating temperature range etc.
can be found at the end of this publication in Appendix A, Specifications.
Flat Surface Installation
The SG3200 Series can be mounted on any appropriate stable, flat, level surface that can safely
support the weight of the appliance and its attached cables.
Caution: Leave space around the appliance
Please ensure there is adequate space around the appliance for ventilation and access
to operating switches and cable connectors. No other objects should be placed on top of
the appliance.
Rack Installation
A rack mounted Clavister Security Gateway can be installed in most standard 19 inch equipment
racks. To do this, fasten the appliance with screws suitable for the kind of rack you are using. The
following mounting guidelines should be followed:
• A rack or cabinet used for mounting should be adequately secured to prevent it from
becoming unstable and/or falling over.
• Devices installed in a rack or cabinet should be mounted as low as possible, with the heaviest
devices at the bottom and progressively lighter devices installed above.
• Rear brackets should be used to support appliances at the rear.
Chapter 2: Installation
13

2.2. Console Port Connection
The serial console port is a physical RS-232 port on the SG3200 Series hardware.
This port allows direct management connection to the appliance, either from a separate
computer running console emulation software or from a console terminal. Serial console access
can then be used for both management of CorePlus with CLI commands or to enter the boot
menu in order to access SG3200 Series firmware loader options.
Tip: Skip this section for now if the web interface is used
This section can be initially skipped if initial CorePlus setup is done with the CorePlus
Web Interface since neither boot menu or CLI access will be needed.
Figure 2.1. The SG3200 Series RS-232 Console Port
Issuing CLI Commands
CLI commands can be issued via the RS-232 console port for both initial CorePlus setup as well as
for ongoing system administration.
Chapter 2: Installation
14

The RS-232 console port need not be used if setup is done through a web browser as described
in Section 3.2, “Web Interface and Wizard Setup”. If the RS-232 port is used for setup, no password
is initially needed and the CLI commands required are described in Section 3.4, “CLI Setup”.
Note: Setting a console password
A serial console password need not be set. If this is the case, anyone with physical access
to the serial console has full administrator rights.
If the SG3200 Series is not placed in a secure area, it is therefore advisable to set the
console password. This is done using the console boot menu and more detail on this
can be found in the CorePlus Administrators Guide.
An alternative to using the console port for CLI access is to connect via a physical Ethernet
interface and using a Secure Shell (SSH) client on the workstation to issue CLI commands.
Equipment Required for Console Connection
To use the console port, the following is needed:
• A terminal or a computer with a serial port and the ability to emulate a terminal (for instance,
the Hyper Terminal software included with some Microsoft Windows distributions could be
used).
• The terminal console should have the following settings:
• 9600 bps.
• No parity.
• 8 bits.
• 1 stop bit.
• No flow control.
• An RS-232 cable with appropriate terminating connectors. The SG3200 Series package
includes an RS-232 null-modem cable.
Connection Steps
To connect a terminal to the console port, follow these steps:
1. Check that the console connection settings are configured as described above.
2. Connect one of the connectors on the RS-232 cable supplied, directly to the console port on
the SG3200 Series.
3. Connect the other end of the cable to a console terminal or to the serial connector of a
computer running console emulation software.
Chapter 2: Installation
15

2.3. Connecting Power
This section describes connecting power to the SG3200 Series. Only an AC power source is
supported by the product.
Important
Please read the advisory information concerning electrical safety in Chapter 5, Safety
Precautions.
The Newer and Older 3200 Models are Different
There is a difference between the rear layout of the newer 3200C model and the older 3200A and
3200B models.
Figure 2.2. Rear View of the 3200A and 3200B
The newer Cmodel has the power supply on the opposite side and has no external On/Off
switch. Power becomes available to the whole appliance as soon as it is supplied via the power
socket.
Figure 2.3. Rear View of the 3200C
With all models of the 3200, CorePlus will boot-up as soon as power is made available to the
appliance.
Connecting AC Power
To connect power, follow these steps:
1. Plug one end of the power adapter's power cord into the power receptacle on the back
panel of the SG3200 Series.
Chapter 2: Installation
16

2. Plug the other end of the power cord into a power outlet. The next step depends on the
3200 model:
i. For older 3200 models, press the On/Off switch to apply power and begin boot up of
the hardware.
ii. For the newest 3200C model, there is no On/Off switch so the hardware will boot up
immediately power is supplied.
3. The SG3200 Series will boot up and CorePlus will start. After a brief period of time, CorePlus
will be running and the appliance will be ready for initial configuration from a management
workstation using either the Web Interface or the Command Line Interface (CLI) as the
management interface.
Initial configuration is discussed in detail in Section 3.1, “Management Workstation
Connection”.
Important: Protecting Against Power Surges
It is strongly recommended that the purchase and use of a separate surge protection
unit from a third party is considered. This is to ensure that computer hardware is
protected from damage by electrical power surges.
Surge protection is particularly important in locations where there is a heightened risk of
lightning strikes or where power grid spikes are more common.
Any surge protection unit should be installed exactly according to the manufacturer's
instructions since correct installation of such units is vital for them to be effective.
Chapter 2: Installation
17

Chapter 2: Installation
18

Chapter 3: CorePlus Configuration
• Management Workstation Connection, page 19
• Web Interface and Wizard Setup, page 24
• Manual Web Interface Setup, page 31
• CLI Setup, page 46
• Troubleshooting Setup, page 54
• Going Further with CorePlus, page 56
3.1. Management Workstation Connection
CorePlus Starts after Power Up
It is assumed you have now unpacked, positioned and powered up the SG3200 Series unit. If not,
you should refer to the earlier chapters in this manual before continuing.
Clavister's CorePlus network security operating system is preloaded on the hardware and will
automatically boot up after power is supplied.
The Default Management Interface
After first time startup, CorePlus makes management access available on a predefined Ethernet
interface and assigns the private IP address 192.168.1.1 to it.
For the SG3200 Series, the default management interface is the ge1 interface.
Alternative CorePlus Setup Methods
Initial CorePlus software configuration can be done in one of the following ways:
•Through a web browser.
A standard web browser running on a standalone computer (also referred to as the
management workstation) can be used to access the CorePlus Web Interface. This provides an
intuitive graphical interface for CorePlus management. When this interface is accessed for the
19

first time, a setup wizard runs automatically to guide a new user through key setup steps. The
wizard can be closed if the administrator wishes to go directly to the Web Interface to
perform setup manually.
The wizard is recommended for its simplification of initial setup and is described in detail in
Section 3.2, “Web Interface and Wizard Setup”.
•Through a terminal console using CLI commands.
The setup process can alternatively be performed using console CLI commands and this is
described in Section 3.4, “CLI Setup”. The CLI allows step by step control of setup and should
be used by administrators who fully understand both the CLI and setup process.
CLI access can be remote, across a network to a physical interface using a similar connection
to that used with the Web Interface. Alternatively, CLI access can be through a console
connected directly to the local RS-232 port on the SG3200 Series hardware. Direct console
connection is described in Section 2.2, “Console Port Connection”.
Network Connection Setup
For setup using the Web Interface via a web browser or the CLI via SSH, we must first connect an
Ethernet interface on an external workstation computer to an Ethernet interface on the SG3200
Series, as illustrated below.
The default management Ethernet interface for the SG3200 Series is ge1 and this should be
connected to the same network as the management workstation (or a network accessible from
the workstation via one or more switches). Typically the connection is made via a switch in the
network, as shown in the illustration above, using regular Ethernet cables.
For connection to the public Internet, another interface should be connected to your ISP and this
is referred to below and in the setup wizard as the WAN interface. In this guide, it is assumed that
the physical ge2 interface of the SG3200 Series is used for Internet connection although it could
be any other unused interface.
Chapter 3: CorePlus Configuration
20