Forcepoint 3400 Series Installation instructions

Next Generation
Firewall
3400 Series
Hardware Guide
Models 3401, 3405, and 3410
Revision A

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Contents
•Introduction on page 2
•Find product documentation on page 2
•Series 3400 features on page 3
•Indicator lights on page 4
•Ethernet port indicators on page 5
•SFP+ port indicators on page 5
•SSD indicators on page 6
•Ethernet port names for appliances with interface modules on page 6
•Supported interface modules on page 6
•Precautions on page 13
•Install the appliance on page 14
•Maintenance on page 24
Introduction
Thank you for choosing a Forcepoint appliance.
Familiarize yourself with the appliance ports and indicators and learn how to install the appliance safely.
Find product documentation
On the Forcepoint support website, you can find information about a released product, including product
documentation, technical articles, and more.
You can get additional information and support for your product on the Forcepoint support website at
https://support.forcepoint.com. There, you can access product documentation, Knowledge Base articles,
downloads, cases, and contact information.
2

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Series 3400 features
The figures and tables show the appliance components and features.
Front panel
This panel has the following parts.
8
4 96 7
5
1 2
3
1VGA port
2SSD slots 1–2. Use the upper slot only.
3Interface module slots 1–8
4Power button and indicator lights
5IPMI port (usage not recommended)
6Fixed Ethernet port. The port name is eth0_0.
7Fixed SFP+ ports 1–2. The port names are eth0_1 and eth0_2.
8Console port (speed 115,200 bps)
9USB ports 1–2
3

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Back panel
This panel has the following parts.
2
1 3 4
1Power supply 1
When power is supplied to the appliance, the indicator light is green. The light is amber if a power cable
is not connected. The light flashes to indicate a warning.
An AC power supply is shown here, but also DC power supplies are supported.
2Fan bays 1–3
When the fan is on, the fan indicator light is green. The light flashes when the fan is starting up or if the
appliance detects that the fan has failed. The airflow is from the front of the appliance to the back.
3Power supply 2
When power is supplied to the appliance, the indicator light is green. The light is amber if a power cable
is not connected. The light flashes to indicate a warning.
An AC power supply is shown here, but also DC power supplies are supported.
4Grounding nut
5mm (3/16") diameter.
Indicator lights
Indicator lights show the status of the appliance and any fixed Ethernet ports.
Icon Indicator Color Description
Warning Amber System failure detected.
UID
UID N/A This indicator light is not supported.
Power Green The appliance is in running state.
4

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Ethernet port indicators
Ethernet port indicators show the status and speed of the network ports.
1 2
1Link speed indicator
2Activity/link indicator
Indicator Color Explanation
Activity/link indicator Green Link OK, flashes on activity.
Unlit No link.
Amber 100 Mbps link.
Link speed indicator
Green 1 Gbps link.
SFP+ port indicators
SFP+ port indicators show the status and speed of the network ports.
12
1Link speed indicator
When green, the link speed is 10 Gbps.
2Link activity/status indicator
When green, the link is OK. Flashes on activity.
5

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
SSD indicators
SSD indicators show the status of the SSDs.
2
1
1Disk indicator
Flashes green when there is disk activity.
2Power indicator
When lit blue, an SSD is in the slot.
Ethernet port names for appliances with
interface modules
Ethernet port names are based on the slot and port numbers.
The first number in the name represents the slot on the appliance. The second number represents the port on the
slot. For example, eth2_0 is located on port 0 of slot 2.
Component Slot number Port numbers
Fixed Ethernet ports 0 eth0_0, eth0_1, and eth0_2
Interface modules 1–8. The slot numbers for the interface
modules start from 1 and increase from left
to right starting from the top row.
The port numbers start from 0 and increase
from left to right. For example, the port
farthest to the left in slot 1 is eth1_0.
Supported interface modules
Forcepoint NGFW appliances support the following types of interface modules. For a list of all available interface
modules and compatibility information, see Knowledge Base article 10245.
Note: Do not remove any stickers from modules — they contain important information.
Copper modules
Module Identifier Appliance models
8 port gigabit Ethernet RJ45 MODG8 3401, 3405, and 3410
6

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
SFP modules
Module Identifier Appliance models
2 port 40 gigabit Ethernet QSFP MOD40F2 3401, 3405, and 3410
4 port 10 gigabit Ethernet SFP+ MOD10F4 3401, 3405, and 3410
8 port gigabit Ethernet SFP MODGF8 3401, 3405, and 3410
8 port 10 gigabit Ethernet SFP+ MOD10F8 3401, 3405, and 3410
The interface module slots are processed by different CPUs. For optimal performance, balance the modules
between the two CPUs.
1 2
1Interface module slots 1-2 and 5-6 are processed by CPU1.
2Interface module slots 3-4 and 7-8 are processed by CPU0.
7

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
MODG8 module
The MODG8 module is an 8 port gigabit Ethernet RJ45 module.
1
3 4
2
1Thumbscrews
You must unfasten the thumbscrews to replace or remove the module.
2Fastening screw
You must remove this screw to replace or remove the module.
3Activity/link indicators
When green, the link is OK. Flashes on activity.
4Link speed indicators
When green, the speed is 1 Gbps.
When amber, the speed is 100 Mbps.
8

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
MOD40F2 module
The MOD40F2 module is a 2 port 40 gigabit Ethernet QSFP module.
1
2
3
1Thumbscrews
You must unfasten the thumbscrews to replace or remove the module.
2Fastening screw
You must remove this screw to replace or remove the module.
3Activity/link indicators
The indicators are labeled with the port that is represented.
When green, the link is OK. Flashes on activity.
9

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
MOD10F4 module
The MOD10F4 module is a 4 port 10 gigabit Ethernet SFP+ module.
1
2
3
1Thumbscrews
You must unfasten the thumbscrews to replace or remove the module.
2Fastening screw
You must remove this screw to replace or remove the module.
3Activity/link indicators
The indicators are labeled with the port that is represented.
When green, the link is OK. Flashes on activity.
10

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
MODGF8 module
The MODGF8 module is an 8 port gigabit Ethernet SFP module.
2
3
1
1Thumbscrews
You must unfasten the thumbscrews to replace or remove the module.
2Fastening screw
You must remove this screw to replace or remove the module.
3Activity/link indicators
The indicators are labeled with the port that is represented.
When green, the link is OK. Flashes on activity.
11

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
MOD10F8 module
The MOD10F8 module is an 8 port 10 gigabit Ethernet SFP+ module.
1
2
3
1Thumbscrews
You must unfasten the thumbscrews to replace or remove the module.
2Fastening screw
You must remove this screw to replace or remove the module.
3Link status and speed indicators
1 2
3 4
1Link speed indicator for the upper port
When green, the link speed is 10 Gbps.
2Link status indicator for the upper port
When blue, the link is OK.
3Link speed indicator for the lower port
When green, the link speed is 10 Gbps.
4Link status indicator for the lower port
When blue, the link is OK.
12

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Precautions
The precautions provide safety guidance when working with Forcepoint appliances and electrical equipment.
CAUTION: Forcepoint appliances cannot be serviced by end users. Never open the appliance
covers for any reason. Doing so can lead to serious injury and void the hardware warranty.
For additional safety information, see the Forcepoint Product Safety and Regulatory Compliance Guide.
General safety precautions
Read the safety information and follow these rules to ensure general safety whenever you are working with
electronic equipment.
•Keep the area around the appliance clean and free of clutter.
•When lifting the appliance, two people at each end should lift slowly with their feet spread out to distribute the
weight. Always keep your back straight and lift with your legs.
•Use a regulating uninterruptible power supply (UPS) to keep your system operating if there is a power failure
and to protect the appliance from power surges and voltage spikes.
•If you need to turn off or unplug the appliance, always wait at least five seconds before turning on or plugging
in the appliance again.
Operating precautions
Follow these precautions when operating the appliance.
•Do not open the power supply casing. Only the manufacturer's qualified technician is allowed to service power
supplies.
Electrical safety precautions
Follow basic electrical safety precautions to protect yourself from harm and the appliance from damage.
•Know the locations of the power on/off button and the emergency turn-off switch, disconnection switch, or
electrical outlet for the room. If an electrical accident occurs, you can quickly turn off power to the system.
•When working with high-voltage components, do not work alone.
•Turn off the system and disconnect the power before removing or installing system components that are not
hot-swappable.
•When working with electrical equipment that is turned on, use only one hand. This is to avoid making a
complete circuit, which causes an electric shock. Use extreme caution when using metal tools, which can
easily damage any electrical components or circuit boards the tools come into contact with.
•Do not use mats designed to decrease electrostatic discharge as protection from electric shock. Instead, use
rubber mats that have been designed as electrical insulators.
•If the power supply cable includes a grounding plug, the plug must be plugged into a grounded electrical
outlet.
•Use only the power cable or cables supplied with the appliance.
13

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
•To avoid injury, do not open the enclosures of power supplies or solid-state drives (SSDs).
Note: On appliances that have two power supplies, we recommend that you use both power
supplies for redundancy.
AC power supply safety precautions
The appliance power inlet is the disconnect device on the appliance.
DC power supply safety precautions
Follow these precautions for DC power supplies.
•The appliance must be used in a restricted access location and users must be well trained to operate it.
•The outlet for the appliance must be installed near the appliance and be easily accessible.
•The appliance must be protected against electric shock.
•We recommend using a power switch between the appliance and the main power source.
•We recommend using a 20A fuse.
•The appliance must have, at minimum, a 12 AWG wire provided for the DC power supply.
•The case of the appliance must be grounded using the power connector pin or the grounding nut. We
recommend using both grounding methods.
•The mains supply plug on the power supply cable is the disconnect device on the appliance. To disconnect the
appliance, you must first disconnect the mains, then disconnect the ground.
Note: Standby power is supplied to the appliance even when the appliance is turned off.
Install the appliance
There are several tasks that must be completed before the appliance is installed.
These tasks and the installation of the appliance might be done by the same person or by different persons:
•The Security Management Center (SMC) administrator is responsible for the tasks that are needed before the
appliance is installed.
•The on-site installer is responsible for installing the appliance.
For more information, see the Forcepoint Next Generation Firewall Installation Guide.
To prepare for the appliance installation, the SMC administrator must do the following:
1) If the SMC has not yet been installed, install the SMC.
Important: Do not install the SMC on the NGFW appliance.
The SMC can manage many NGFW appliances.
2) In the Management Client component of the SMC, create and configure the NGFW Engine element that
represents the appliance.
14

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
3) In the Management Client component of the SMC, save the initial configuration.
The SMC administrator must either:
•Upload the initial configuration to the Installation Server for plug-and-play configuration of the appliance.
Note: There are additional requirements for plug-and play configuration. See Knowledge
Base article 9662.
•Give the on-site installer a USB drive that contains an initial configuration file for each appliance.
The on-site installer must do the following:
1) Inspect the appliance, delivery box, and all components included in the shipment.
Important: Do not use damaged appliances or components.
2) Connect all necessary power and network cables and other components, then turn on the appliance.
If the plug-and-play configuration method is not used, the on-site installer must use the USB drive that
contains the initial configuration files to configure the NGFW Engine software.
3) When you have finished installing the appliance, inform the SMC administrator so that the administrator can
check the status of the appliance in the Management Client.
Rack-mount the appliance
The rack-mounting procedure varies depending on the type of rack unit. If needed, see the documentation for
your rack unit.
Important: Read the safety precautions before you rack-mount the appliance. Do not install the
appliance upside down.
Determine the placement of each component in the rack.
•Install the heaviest components on the bottom of the rack first. Install components from the bottom to the top.
•The appliance must be connected to a grounded power outlet.
•Use a UPS to protect the appliance from power surges and voltage spikes, and to keep your system operating
if there is a power failure.
•To maintain proper cooling, always keep the front door of the rack and all panels and components on the
appliances closed when not servicing.
Install the appliance in a four-post rack using
fixed brackets
Use the supplied long fixed brackets to install the appliance in a four-post rack.
Steps
1) Attach a long bracket to each of the back posts of the rack.
15

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
2) Attach three screws to each side of the appliance.
3) Lift the appliance into the rack, and guide the screws in the side of the appliance into the groove of the
bracket.
The bracket is used to support the appliance when setting the depth of the appliance in the rack.
4) Attach the front panel to the front posts of the rack with four screws in each post.
Result
Install the appliance in a four-post rack using
sliding brackets
Use the supplied sliding brackets to install the appliance in a four-post rack.
Steps
1) Locate the brackets for the rack installation.
2) Remove the handle brackets attached to each side of the front of the appliance.
16

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
3) Detach the inner rails from the outer rails. Press down the locking tab to pull out the inner rail.
1
2
3
1Inner rail
2Locking tab
3Outer rail
4) Attach an inner rail to each side of the appliance using three screws for each rail.
•The inner rails are marked with "LH" for left and "RH" for right.
•The outer rails are marked with "Front" for the front end and "Rear" for the rear end.
•When looking at the appliance from the front, the outer rail that was attached to the inner rail marked
"LH" must be attached to the left side of the rack, and the outer rail that was attached to the inner rail
marked "RH" must be attached to the right side of the rack.
5) Slide the outer rail onto the inner rail.
17

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
6) Release the safety lock on the front end of the outer rail by pulling it back.
7) Insert the outer rail into the rack.
If the ends of the outer rails do not fit into the holes in the rack, use the adapter brackets included in the
delivery.
8) Push the safety lock forward to secure the rail into the rack.
9) Insert the other outer rail into the rack.
10) Line up the rear of the inner rails with the front of the outer rails.
11) Slide the inner rails into the outer rails, keeping the pressure even on both sides. You might have to press
the locking tabs when inserting.
The rails lock into the rack when the appliance is pushed completely into the rack.
Install the appliance in a two-post rack
Use the supplied short fixed brackets to install the appliance in a two-post rack.
18

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Steps
1) Attach a short bracket to each side of the appliance with eight screws.
2) Attach the brackets to the rack with three screws through the holes in the front of the brackets.
Result
Install an interface module
If you have interface modules, install them in the appliance.
Before you begin
Read the safety precautions and make sure any interface modules you install are the correct type for
your appliance.
CAUTION: To avoid damaging the modules or the appliance, do not install or remove any interface
modules if the appliance is turned on.
19

Next Generation Firewall Hardware Guide | Models 3401, 3405, and 3410
Important: You must install an interface module or a placeholder module in each slot before
making the appliance operational.
Note: We recommend fastening a grounding strap to your wrist so that it contacts your bare skin
and attaching the other end of the strap to the appliance.
Steps
1) Locate the slot to install the module in.
2) If the interface slot is covered with a plate, unfasten the thumbscrews that attach the plate to the interface
module slot.
2
1
1Thumbscrews
2Fastening screw
3) Use a screwdriver to remove the fastening screw.
4) Remove the plate.
Store the plate for later use in case you want to use the appliance without an interface module.
5) Push the module into the slot.
The module is seated correctly when the front panel of the module is even with the front panel of the
appliance.
Note: If the module has a sticker, make sure that the sticker faces up.
Important: Do not insert the module in the wrong orientation. Inserting the modules incorrectly
might damage the appliance and the modules and voids the warranty.
6) Push and hold the thumbscrews on the module, then tighten them to secure the module in place.
7) Use a screwdriver to reattach the fastening screw.
20