H3C SecPath F5000-A5 User manual

H3C SecPath F5000-A5 Firewall
Installation Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Document version: 6PW109-20141225

Copyright © 2008-2014, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,
SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Environmental protection
This product has been designed to comply with the environmental protection requirements. The storage,
use, and disposal of this product must meet the applicable national laws and regulations.

Preface
The H3C SecPath F5000-A5 Firewall Installation Guide includes eight chapters, which describe the
product overview, preparing for installation, installing the firewall, installing FRUs, accessing the firewall
for the first time, replacement procedures, hardware management and maintenance, and
troubleshooting.
This preface includes:
•Audience
•Conventions
•About the H3C SecPath F5000-A5 documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the H3C SecPath F5000-A5 Firewall
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.

Convention Descri
p
tion
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or
load-balancing device.
Represents a security card, such as a firewall, load-balancing, NetStream, SSL VPN, IPS,
or ACG card.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.


About the H3C SecPath F5000-A5 documentation
set
The H3C SecPath F5000-A5 documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Product description and
specifications Marketing brochures Describe product specifications and benefits.
Hardware specifications
and installation
Compliance and safety
manual
Provides regulatory information and the safety
instructions that must be followed during installation.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Card manuals Provide the hardware specifications of cards.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.
Configuration examples Describe typical network scenarios and provide
configuration examples and instructions.
Operations and
maintenance
Release notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software
upgrading.
FAQ Provides frequently asked questions about the
firewall.
Obtaining documentation
Access the most up-to-date H3C product documentation on the World Wide Web at
http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents]—Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions]—Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download]—Provides the documentation released with the
software version.
Technical support
servic[email protected]
http://www.h3c.com

Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
Preparing for installation ············································································································································· 1
Safety recommendations ··················································································································································1
Safety symbols ··························································································································································1
General safety recommendations···························································································································1
Electricity safety ························································································································································1
Laser safety································································································································································2
Handling safety ························································································································································2
Examining the installation site ·········································································································································2
Weight support·························································································································································2
Temperature and humidity·······································································································································3
Cleanness··································································································································································3
Cooling······································································································································································4
ESD prevention ·························································································································································4
EMI·············································································································································································6
Lightning protection··················································································································································6
Rack installation························································································································································6
Power supply·····························································································································································7
Installation tools (user-supplied) ·······································································································································7
Accessories ········································································································································································7
Checklist before installation ·············································································································································8
Installing the firewall··················································································································································10
Confirming installation preparations···························································································································· 10
Installing the firewall in a 19-inch rack ······················································································································· 11
Installing cage nuts to the rack ···························································································································· 11
Attaching the mounting brackets to the chassis ································································································· 12
Mounting the firewall to the rack························································································································· 14
Grounding the firewall ·················································································································································· 15
Connecting the grounding cable ························································································································· 16
Installing an MPU ··························································································································································· 17
Installing a CF card························································································································································ 19
Installing an interface module······································································································································· 19
Installing a fan tray ························································································································································ 21
Installing a power module············································································································································· 23
Connecting interface cables ········································································································································· 24
Connecting the management Ethernet port ········································································································ 24
Connecting the HA port········································································································································ 24
Connecting Ethernet cables·································································································································· 25
Connecting a power cord ············································································································································· 26

ii
Connecting an AC power cord ··························································································································· 26
Connecting a DC power cord······························································································································ 27
Verifying the installation················································································································································ 29
Installing FRUs ····························································································································································30
Installing an air filter ······················································································································································ 30
Installing a lightning protector for a network port ······································································································ 31
Connecting the AC power supply to a power strip with lightning protection ························································· 34
Logging in and performing basic configurations·····································································································35
Logging in to the CLI through the console port ··········································································································· 35
Connecting the terminal to the firewall ··············································································································· 35
Configuring communication parameters on the terminal·················································································· 36
Powering on the firewall······································································································································· 40
Verifying the firewall boot information ··············································································································· 40
Logging in to the CLI by using Telnet ··························································································································· 41
Logging in to the Web interface··································································································································· 42
Logging in to the CLI through the AUX port ················································································································ 42
Performing basic configurations ··································································································································· 43
Performing basic configurations at the CLI ········································································································· 43
Performing basic configurations in the Web interface······················································································ 44
Replacement procedures ···········································································································································51
Precautions······································································································································································ 51
Installing and removing a filler panel ·························································································································· 51
Removing a filler panel········································································································································· 52
Installing a filler panel··········································································································································· 53
Replacing an MPU ························································································································································· 54
Replacing an interface module····································································································································· 56
Replacing a CF card······················································································································································ 57
Replacing a transceiver module ··································································································································· 58
Replacing a power module··········································································································································· 59
Replacing a fan tray ······················································································································································ 60
Hardware management and maintenance ··············································································································62
Displaying software and hardware version information ··························································································· 62
Displaying running status data ····································································································································· 63
Displaying detailed information about cards·············································································································· 63
Displaying the electrical label data······························································································································ 64
Displaying CPU usage statistics···································································································································· 64
Displaying memory usage statistics······························································································································ 65
Displaying information about the CF card ·················································································································· 65
Displaying the operating states of fans ······················································································································· 66
Displaying power module information ························································································································ 66
Managing interfaces and transceiver modules··········································································································· 67
Managing combo interfaces ································································································································ 67

iii
Verifying and diagnosing transceiver modules·································································································· 68
Troubleshooting system exceptions ······························································································································ 68
Configuring the exception handling methods ···································································································· 68
Displaying the exception handling method ········································································································ 69
Rebooting your firewall ················································································································································· 69
Troubleshooting··························································································································································71
MPU failures ··································································································································································· 71
Symptom 1 ····························································································································································· 71
Symptom 2 ····························································································································································· 71
Symptom 3 ····························································································································································· 72
Service module failures ················································································································································· 72
Symptom 1 ····························································································································································· 72
Symptom 2 ····························································································································································· 72
Power supply system failures ········································································································································ 73
Symptom 1 ····························································································································································· 73
Symptom 2 ····························································································································································· 73
Fan failures ····································································································································································· 74
Symptom 1 ····························································································································································· 74
Symptom 2 ····························································································································································· 74
Configuration system failures········································································································································ 74
No display on the configuration terminal··········································································································· 75
Garbled characters on the configuration terminal····························································································· 75
Console port failure··············································································································································· 75
Password loss ································································································································································· 76
Cooling system failures·················································································································································· 76
Software upgrade failures············································································································································· 77
No response from the serial port of the MPU····································································································· 77
Failure to upgrade through TFTP·························································································································· 77
Failure to upgrade through FTP···························································································································· 78
Application file missing errors ······································································································································ 79
Appendix A Chassis views and technical specifications ························································································80
Chassis views ································································································································································· 80
Main processing unit ····················································································································································· 81
Interface modules ··························································································································································· 82
NSQ1GT8C40······················································································································································ 82
NSQ1XP20···························································································································································· 82
NSQ1GT8P40······················································································································································· 83
Power modules ······························································································································································· 83
AC power module················································································································································· 83
DC power module ················································································································································· 84
Fan tray ··········································································································································································· 84
Technical specifications················································································································································· 85
Dimensions and weight ········································································································································ 85

iv
Power module ························································································································································ 85
Fan tray ·································································································································································· 86
MPU ········································································································································································ 86
Interface modules ·················································································································································· 87
Lightning protector for a network port (optional)········································································································ 90
Power strip with lightning protection (optional) ·········································································································· 90
Appendix B LEDs························································································································································91
MPU LEDs········································································································································································ 91
Interface module LEDs···················································································································································· 93
NSQ1GT8C40······················································································································································ 93
NSQ1XP20···························································································································································· 93
NSQ1GT8P40······················································································································································· 94
Power module LEDs························································································································································ 95
Fan tray LEDs ·································································································································································· 96
Appendix C Arranging slots and numbering interfaces··························································································97
Arranging slots ······························································································································································· 97
Numbering interfaces ···················································································································································· 97
Examples········································································································································································· 98
Appendix D Cables ···················································································································································99
Ethernet twisted pair cable············································································································································ 99
Introduction ···························································································································································· 99
Making an Ethernet twisted pair cable·············································································································102
Optical fiber ·································································································································································103
Precautions···························································································································································104
Appendix E Cabling recommendations ················································································································ 105
General cabling requirements ····································································································································105
Cable management requirements ······························································································································105
Cabling examples ························································································································································108
Index ········································································································································································ 110

1
Preparing for installation
Safety recommendations
To avoid possible bodily injury and equipment damage, read all safety recommendations carefully
before installation. Note that the recommendations do not cover every possible hazardous condition.
Safety symbols
When reading this document, note the following symbols:
WARNING means an alert that calls attention to important information that if not understood or
followed can result in personal injury.
CAUTION means an alert that calls attention to important information that if not understood or
followed can result in data loss, data corruption, or damage to hardware or software.
General safety recommendations
•Make sure the ground is dry and flat and anti-slip measures are in place.
•Keep the chassis and installation tools away from walk areas.
•Make sure the installation site is correctly grounded, and lightning protection and ESD-prevention
are provided.
•Only trained and qualified personnel are allowed to install or service the firewall.
•Keep accessories, installation tools, and documentation safe.
•Avoid bodily injury. Do not touch any power plug when it is connected.
•Clean up the packaging materials after installation to avoid fire hazard.
Electricity safety
•Locate the emergency power-off switch in the room before installation. Shut the power off at once in
case accident occurs.
•Make sure the firewall has been correctly grounded.
•Do not open and close the chassis cover when the firewall has power.
•Use an uninterrupted power supply (UPS).
•If there are two power inputs, disconnect the two power inputs to power off the firewall.

2
•Do not work alone when the firewall has power.
Laser safety
The firewall is a Class 1 laser product.
W
ARNING!
•Do not stare into any fiber port when the firewall has power. The laser li
g
ht emitted from the optical fibe
r
may hurt your eyes.
•Use a fiber test equipment, rather than a microscope or magnifier to observe an operating fiber
connector or port when you test link connectivity or system parameters.
Handling safety
CAUTION:
Do not hold the handle of the fan tray, power module, or back cover of the chassis, or the air vents of
chassis. Any attempt to move the firewall with these parts mi
g
ht cause equipment dama
g
e and even bodil
y
injury.
When you move an F5000-A5 firewall, follow these guidelines:
•Remove all external cables, including the power cords, before moving the chassis.
•Moving the chassis requires at least two persons.
•Lift and put down the chassis slowly and never move suddenly.
•Hold the handles on the chassis.
•If the firewall needs to be moved over a long distance, remove all field-replaceable units (FRUs),
such as interface modules, put them separately in antistatic bags, and install the filler panels
supplied with firewall.
•If the firewall needs to be moved over a short distance, make sure all FRUs are securely seated in
slot and the screws are fastened.
•Make sure the accessories of the firewall are not lost or damaged during firewall moving.
Examining the installation site
The H3C F5000-A5 firewalls must be used indoors. To ensure normal operation and long service life of
your firewall, the installation site must meet the requirements in this section.
Weight support
Make sure the floor can support the total weight of the rack, chassis, cards, power modules, and all other
components. For more information, see "Appendix A Chassis views and technical specifications"

3
Temperature and humidity
Maintain appropriate temperature and humidity in the equipment room.
•Lasting high relative humidity can cause poor insulation, electricity creepage, mechanical property
change of materials, and metal corrosion.
•Lasting low relative humidity can cause washer contraction and ESD and bring problems including
loose captive screws and circuit failure.
•High temperature can accelerate the aging of insulation materials and significantly lower the
reliability and lifespan of the firewall.
Table 1 Temperature and humidity requirements
Ambient tem
p
erature Ambient relative humidit
y
•Operating
0°C to 45°C (32°F to 113°F)
•Nonoperating and storage
–40°C to +70°C (–40°F to +158°F)
•Operating
10% to 95%, noncondensing
•Nonoperating and storage
5% to 95%, noncondensing
Cleanness
Dust buildup on the chassis may result in electrostatic adsorption, which causes poor contact of metal
components and contact points, especially when indoor relative humidity is low. In the worst case,
electrostatic adsorption can cause communication failure.
Table 2 Dust concentration limit in the equipment room
Substance Concentration limit (
p
articles/cu m)
Dust particles 3 x 104
(No visible dust on desk in three days)
NOTE:
Dust particle diameter 5 m
The equipment room must also meet strict limits on salts, acids, and sulfides to eliminate corrosion and
premature aging of components, as shown in Table 3.
Table 3 Harmful gas limits in an equipment room
Gas Max. (m
g
/m3)
SO20.2
H2S 0.006
NH30.05
Cl20.01

4
Cooling
The F5000-A5 firewalls adopt left to right airflow for heat dissipation. Plan the installation site for
adequate ventilation.
•Leave at least 10 cm (3.94 in) of clearance at the inlet and outlet air vents.
•The installation site has a good cooling system.
Figure 1 Airflow through the F5000-A5 chassis
ESD prevention
CAUTION:
•Check the resistance of the ESD wrist strap for safety. The resistance readin
g
should be in the ran
g
e of
1 to 10 megohm (Mohm) between human body and the ground.
•The F5000-A5 does not provide any ESD wrist strap. Prepare it yourself.
To prevent electrostatic discharge (ESD), follow these guidelines:
•Make sure the firewall and rack are correctly grounded.
•An anti-static floor is installed and correctly grounded.
•Maintain the humidity and temperature at a compliant range in the equipment room. For more
information, see "Temperature and humidity."
•Always wear an ESD wrist strap and ESD cloth when touching a circuit board, interface module, or
transceiver module.

5
•Place the removed MPU, CF card, or service card on an antistatic workbench, with the face upward,
or put it into an antistatic bag.
•Touch only the edges, instead of electronic components when observing or moving a removed MPU,
CF card, or service card.
Make sure the rack is correctly grounded before you wear an ESD wrist strap.
To attach the ESD wrist strap:
1. Wear the wrist strap on your wrist.
2. Lock the wrist strap tight around your wrist to keep good contact with the skin.
3. Insert the ESD plug into the ESD socket in the chassis.
4. Make sure the wrist strap is correctly grounded.
Figure 2 Attaching an ESD wrist strap
(1) ESD wrist strap (2) Lock
(3) ESD socket (4) ESD plu
g

6
EMI
The EMI might be coupled from the source to the firewall through the following coupling mechanisms:
•Capacitive coupling
•Inductive coupling
•Radiative coupling
•Common impedance coupling
•Conductive coupling
To prevent EMI, take the following actions:
•Take measures against interference from the power grid.
•Do not use the firewall together with the grounding equipment or lightning-prevention equipment of
power equipment, and keep the firewall far away from them.
•Keep the firewall far away from high-power radio launchers, radars, and equipment with high
frequency or high current to make sure the EMI levels do not exceed the compliant range.
•Use electromagnetic shielding when necessary.
Lightning protection
To protect the firewall from lightning better, do as follows:
•Make sure the chassis is correctly grounded.
•Make sure the grounding terminal of the AC power receptacle is correctly grounded.
•Install a lightning protector at the input end of the power supply to enhance lightning protection
capability.
•Install a surge lightning protector at the input end of outdoor signal lines to which interface modules
of the firewall are connected to enhance the lightning protection capability.
Rack installation
•Install the chassis in an open rack. To install the chassis in an enclosed cabinet, make sure the
cabinet has good ventilation system.
•Install the chassis on a rack that has rack shelves.
•The rack is sturdy enough to support the chassis and the accessories.
•Reserve at least 0.8 m (2.62 ft) of clearance between the rack and walls or other devices.
•The equipment room is at least 3 m (9.84 ft) high.
•Rack dimensions are sufficient for the chassis.

7
Power supply
Make sure the power source of the installation site is steady and can satisfy the input requirements of the
power modules and parameters such as rated voltage. For the power module specifications, see "Power
module."
Installation tools (user-supplied)
The tools in the table might be used for installing the firewall.
Flat-blade
screwdriver Phillips screwdriver Needle-nose pliers Wire-stripping pliers Diagonal pliers
RJ-45 crimping
pliers Marker Multimeter Network cable tester Hot air blowing gun
Accessories
Console cable (supplied
with firewall)
3 m (9.84 ft) grounding
cable (supplied with
firewall)
AC power cord (supplied
with firewall)
Mounting brackets
(supplied with firewall)
ESD wrist strap (supplied
with firewall) Cable tie (user-supplied) M6 screw (user-supplied) Cage nuts (user-supplied)
Insulation sheath
(user-supplied)
Ring terminal
(user-supplied)
ESD gloves
(user-supplied)


8
Checklist before installation
Table 4 Checklist before installation
Item Re
q
uirements Result
Installation site
Weight support
The floor can support the total weight of the rack,
chassis, cards, power modules, and all other
components.
Operating ambient
temperature 0°C to 45°C (32°F to 113°F)
Operating ambient
relative humidity 10% to 95% (noncondensing)
Cleanness
•Dust concentration 3 × 104particles/m3
•No dust on desk within three days
Ventilation
•There is a minimum clearance of 10 cm (3.94 in)
around the inlet and exhaust vents for heat
dissipation of the firewall chassis.
•A ventilation system is available at the installation
site.
ESD prevention
•The equipment and floor are well grounded.
•The equipment room is dust-proof.
•The humidity and temperature are at a compliant
range.
•Wear an ESD wrist strap and uniform when
touching a circuit board.
•Place the removed MPU, service card, and CF
card on an antistatic workbench, with the face
upward, or put it into an antistatic bag.
•Touch only the edges, instead of electronic
components when observing or moving a
removed MPU, CF card, or service card.
EMI prevention
•Take effective measures to protect the power
system from the power grid system.
•Separate the protection ground of the firewall from
the grounding device or lightning protection
grounding device as far as possible.
•Keep the firewall far away from radio stations,
radar and high-frequency devices working in high
current.
•Use electromagnetic shielding when necessary.
Lightning
protection
•The grounding cable of the chassis is well
grounded.
•The grounding terminal of the AC power
receptacle is well grounded.
•A lightning protector for a network port is
installed. (Optional)
•The AC power supply has been connected to a
power strip with lightning protection. (Optional)

9
Item Re
q
uirements Result
Electricity safety
•Equip an uninterrupted power supply (UPS).
•In case of emergency during operation, switch off
the external power switch.
Rack-mounting
requirements
•Install the firewall in an open rack if possible. If
you install the firewall in a closed cabinet, make
sure the cabinet is equipped with a good
ventilation system.
•The rack is sturdy enough to support the weight of
the firewall and installation accessories.
•The size of the rack is appropriate for the firewall.
•The front and rear of the rack are at least 0.8 m
(2.62 ft) away from walls or other devices.
Tools
•Installation accessories supplied with the firewall
•User supplied tools
Reference
•Documents shipped with the firewall
•Online documents

10
Installing the firewall
IMPORTANT:
Keep the packages of the firewall and the components for future use.
Figure 3 F5000-A5 firewall installation flow
Confirming installation preparations
Before you install the firewall, verify that: