H3C SecPath PFC User manual

H3C SecPath PFC
Quick Start
New H3C Technologies Co., Ltd.
http://www.h3c.com
Document version: 6PW110-20220323

Copyright © 2007-2022, New H3C Technologies Co., Ltd. and its
licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by
any means without prior written consent of New H3C Technologies Co.,
Ltd.
Trademarks
Except for the trademarks of New H3C Technologies Co., Ltd., any
trademarks that may be mentioned in this document are the property of
their respective owners.
Notice
The information in this document is subject to change without notice. All
contents in this document, including statements, information, and
recommendations, are believed to be accurate, but they are presented
without warranty of any kind, express or implied. H3C shall not be liable for
technical or editorial errors or omissions contained herein.
Environmental protection
This product has been designed to comply with the environmental
protection requirements. The storage, use, and disposal of this product
must meet the applicable national laws and regulations.

Preface
Organization
H3C SecPath PFC Quick Start is organized as follows:
Chapter
Contents
1 Product Overview Introduces the overview, work mechanism,
hardware specifications and appearance of PFC.
2 Installing PFC
Introduces the guidelines and procedure of PFC
hardware installation, and the interface cards
supported by PFC and installation of the interface
cards.
3 Connecting Cables Introduces how to connect different types of PFC
cables.
4 Debugging the PFC Introduces how to debug PFC.
5 Configuration Guidelines Introduces the requirements and configuration
guidelines when applying PFC to a device.
This preface includes the following topics about the documentation:
•
Audience.
•
Conventions.
•
Documentation feedback.
Audience
This documentation is intended for:
•
Network planners.
•
Field technical support and servicing engineers.
•
Network administrators working with H3C SecPath PFC.

Conventions
The following information describes the conventions used in the
documentation.
Command conventions
Convention
Description
Boldface Bold text represents commands and keywords that you
enter literally as shown.
Italic Italic
text represents arguments that you replace with actual
values.
[ ] Square brackets enclose syntax choices (keywords or
arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated
by vertical bars, from which you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices
separated by vertical bars, from which you select one or
none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax
choices separated by vertical bars, from which you select a
minimum of one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax
choices separated by vertical bars, from which you select
one choice, multiple choices, or none.
&<1-n>
The argument or keyword and argument combination before
the ampersand (&) sign can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention
Description
Boldface Window names, button names, field names, and menu
items are in Boldface. For example, the New User window
opens; click OK.
> Multi-level menus are separated by angle brackets. For
example, File > Create > Folder.

Symbols
Convention
Description
WARNING!
An alert that calls attention to important information that
if not understood or followed can result in personal
injury.
CAUTION:
An alert that calls attention to important information that
if not understood or followed can result in data loss,
data corruption, or damage to hardware or software.
IMPORTANT:
An alert that calls attention to essential information.
NOTE: An alert that contains additional or supplementary
information.
TIP:
An alert that provides helpful information.
Network topology icons
Convention
Description
Represents a generic network device, such as a router,
switch, or firewall.
Represents a routing-capable device, such as a router or
Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3
switch, or a router that supports Layer 2 forwarding and
other Layer 2 features.
Represents an access controller, a unified wired-WLAN
module, or the access controller engine on a unified
wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
T
T
T
T

Convention
Description
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM,
multiservice security gateway, or load balancing device.
Represents a security module, such as a firewall, load
balancing, NetStream, SSL VPN, IPS, or ACG module.
Examples provided in this document
Examples in this document might use devices that differ from your device
in hardware model, configuration, or software version. It is normal that the
port numbers, sample output, screenshots, and other information in the
examples differ from what you have on your device.
Documentation feedback
You can e-mail your comments about product documentation to
[e-mail].
We appreciate your comments.

i
Table of Contents
Product Overview···················································1
Overview ································································································ 1
How PFC Works····················································································· 2
Hardware Specifications········································································· 4
Appearance···························································································· 4
Front Panel····················································································· 4
Rear Panel······················································································ 5
Installing PFC·························································6
Safety Precautions ················································································· 6
Installation Guidelines············································································ 6
Installing PFC to the Specified Position ················································· 7
Installing PFC into a Standard 19-Inch Rack·································· 7
Placing the PFC on a Workbench·················································· 9
Installing the Interface Card ································································· 10
Introduction to Interface Cards····················································· 10
Installing the Interface Card·························································· 11
Connecting Cables···············································12
Connecting the Cables of the 8EPM ···················································· 12
Connecting the Optical Fibers of the 4FPM ········································· 12
Connecting the USB Cable ·································································· 14
Debugging the PFC··············································17
Configuration Guidelines······································18

1
Product Overview
Overview
The H3C SecPath Power Free Connector (PFC) is developed by New H3C
Technologies Co., Ltd. (hereinafter referred to as H3C) to provide
power-failure protection for Intrusion Prevention System (IPS) and Firewall
(FW). Hereinafter, the H3C SecPath PFC is called PFC, and the IPS and
FW are both called device for short.
During device operation, uncontrollable causes can affect the network
stability. To solve the problem, you can deploy a PFC in the network, then:
•
If a power failure, reboot, or interface down occurs, the PFC takes
over the traffic to be processed by the device immediately and directly
forwards the traffic to the next hop.
•
After the device is powered on and rebooted, or the interface becomes
up, the PFC switches traffic to the device.
Because the PFC switchover interval is very short, the network stability is
ensured effectively.

2
How PFC Works
Figure 1 Work mechanism of PFC
As shown in Figure 1, the PFC interface card (take an 8EPM electrical
interface card for example) has eight interfaces, which are NET A, A, B,
and NET B in each of the two rows. Each row of interfaces protects a
segment.
•
NET A connects to the external network interface.
•
A connects to the interface added to the external zone of the device.
•
B connects to the interface added to the internal zone of the device.
•
NET B connects to the internal network interface.
The traffic direction differs with circumstances:
1. The solid line in Figure 1 shows the traffic direction when the device is
operating correctly. The external traffic enters the device through NET
A, and passes through interface A, the internal zone and external zone
of the device. Then it enters PFC through interface B and then flows to
NET B. Finally, it reaches the internal network.
2. If a power failure, reboot, or interface down occurs on the device, NET
A and NET B are connected directly, and traffic will pass through NET
PFC electrical interface card (8EPM)
(Connects the external
network interface)(Connects the external zone)(Connects the internal zone)(Connects the internal network interface)
External
traffic
Device
(Added to the internal zone)(Added to the external zone)
Interface C Interface D
NET A ABNET B
NET A ABNET B
Internal
traffic

3
A to NET B directly without passing through A, B, C and D. The
dashed line in Figure 1 indicates the traffic direction.
Note that:
•
To make sure the PFC can work normally when the device is working
abnormally, enable external securityservice bypass on the device. For
details, see the Layer 2—LAN Switching configuration guide for the
PFC.
•
Interfaces NET A and A have peering relationship with interfaces NET
B and B, that is, they can be deployed in the reverse sequence. For
more information, see Table 1.
Table 1 Traffic direction in the PFC
Device
status Traffic direction
The device is
operating
correctly
External network interface > NET A > A > interface added to the
external zone of the device > interface added to the internal
zone of the device > B > NET B > internal network interface
(follows the direction indicated by the solid line)
or
External network interface > NET B > B > interface added to the
external zone of the device > interface added to the internal
zone of the device > A > NET A > internal network interface (in
the reverse direction as indicated by the solid line).
A power
failure,
reboot, or
interface
down occurs
External network interface > NET A > NET B > internal network
interface (follows the direction indicated by the dashed line)
or
External network interface > NET B > NET A > internal network
interface (in the reverse direction as indicated by the dashed
line)
•
If the device is configured with two segments and is connected to the
PFC, the interface down event of one segment will trigger the PFC to
perform a traffic switchover. Power failure and link state changes can
cause a working mode change of the PFC.

4
Hardware Specifications
Table 2 PFC hardware specifications
Item Description
Physical dimensions (H
× W × D) 43.6 × 440 × 260 mm (1.72 × 17.32 × 10.24 in)
Weight 5 kg (11.02 lb)
Voltage 5 VDC (inputted through the USB interface)
Operating environment
Operating temperature: 0°C to 40°C (32°F to 104°F)
Storage temperature: –20°C to +70°C (–4°F to
+158°F)
Operating humidity: 10% to 85% (noncondensing)
Storage humidity: 5% to 90% (noncondensing)
USB interface (type A
connector)
When PFC starts to work, it needs to be connected to
the device through a USB cable to obtain power
supply.
Appearance
Front Panel
Figure 2 Front panel of PFC
The front panel of PFC has a power LED (PWR), which indicates the
current working state of the PFC. Table 3 gives the LED description.

5
Table 3 PWR LED description
Status Description
On The PFC is operating correctly.
Blinking The PFC is not operating or operating incorrectly.
Off The PFC is not operating or operating incorrectly.
Rear Panel
As shown in Figure 3, the real panel of PFC has one USB interface and
four slots. PFC obtains power supply by connecting to the device through a
USB cable at initial startup. The four slots, which are used for interface
expansion, support 4FPM and 8EPM interface cards. You can select any
type of interface card as needed. For more information about the 4FPM
and 8EPM interface cards, see "Introduction to Interface Cards."
Figure 3 Rear panel of the PFC
(1) USB interface
(2) to (5) four slots
In Figure 3, one 4FPM and three 8EPM interface cards are installed in
PFC.
1 2 3 5
4
1 2 3 5
4

6
Installing PFC
Safety Precautions
WARNING
!
Installation and removal of th
e unit and its accessories must be
carried out by qualified personnel. You must read all of the Safety
Instructions supplied with your device before installation and
operation.
Installation Guidelines
NOTE:
Do not remove the dismantlement
-preventive seal on PFC without
permission.
If you want to dismantle it, you should contact the local
agent of H3C for permission. Otherwise, H3C shall not be held liable
for any consequence caused thereby.
To avoid any device impairment and bodily injury caused by improper use,
observe these rules:
•
Wear an ESD wrist strap (not provided with the device) and ensure a
good skin contact.
•
Keep the PFC away from high-power radio transmitters, radars, and
high-frequency heavy-current devices. Use electromagnetic shielding
when necessary.
•
Ensure good ventilation and heat dissipation for the PFC.
•
Place no objects on the PFC to avoid damage to the PFC or impact to
dissipation efficiency.
•
To stack PFCs, keep a vertical distance of 1.5 cm (0.59 in) between
devices for the sake of ventilation and heat dissipation.

7
Installing PFC to the Specified Position
After preparation, start installing the PFC.
Depending on the installation sites, PFC can be installed:
•
In a standard 19-inch rack
•
On a workbench
Installing PFC into a Standard 19-Inch Rack
You can install PFC in a standard 19-inch rack. According to the installation
position of the mounting brackets, you have the following two installation
options:
•
Installing the mounting brackets to the front part of PFC
•
Installing the mounting brackets to the middle part of PFC
Introduction to mounting brackets
The mounting bracket provided with the PFC is as shown in Figure 4.
Figure 4 Appearance of the mounting bracket
(1) Screw hole for fixing the mounting bracket to PFC
(2) Screw hole (for M6 screw) for fixing the mounting bracket to the rack
(1)
(2)

8
Installing the PFC
The procedures for installing the mounting brackets to the font part and
middle part of the PFC are similar. Follow these steps to install the
mounting brackets to the front part of the PFC.
1. Wear the ESD wrist strap, check the grounding and stability of the
chassis, and prepare the screws provided with the mounting brackets.
2. Use the screws to fix the left and right mounting brackets to the two
sides of the front panel, as shown in Figure 5.
Figure 5 Install the mounting brackets to the chassis
3. Place the PFC to a proper place of the rack and use the screws and
nuts to fix the mounting brackets to the square holes of the rack. Make
sure that the PFC is fixed horizontally and firmly.

9
Figure 6 Install the PFC to the rack
Placing the PFC on a Workbench
Without a standard 19-inch rack, you can place the PFC on a clean
workbench. Make sure that:
•
The workbench is long and wide enough to hold the PFC. See Table 2
for the physical dimensions of PFC.
•
The workbench is sturdy and well grounded.
•
The workbench is firm enough to support the weight of the PFC and
other installation accessories.
•
There is a clearance of 10 cm (3.94 in.) around the chassis for heat
dissipation.

10
Installing the Interface Card
Introduction to Interface Cards
PFC supports the following two types of interface cards:
•
Optical interface card (4FPM)
•
Electrical interface card (8EPM)
Figure 7 and Figure 8 show the appearance of the two interface cards.
Figure 7 Appearance of the 4FPM interface card
Figure 8 Appearance of the 8EPM interface card
Table 4 shows the specifications of the 4FPM and 8EPM.
Table 4 Specifications of the 4FPM and 8EPM
Item 4FPM 8EPM
Interface type LC RJ-45
Interface number 4 8

11
Item 4FPM 8EPM
Segment number 1 2
Hot swapping Supported Supported
Cable requirements 850nm/1310nm
multimode optical fiber
Category 5 or higher
shielded twisted pair
(STP)
Installing the Interface Card
No interface card is shipped with PFC by default. You can select interface
cards as needed.
Before installation, prepare tools such as Phillips screwdriver and ESD
wrist strap.
Follow these steps to install an interface card:
1. Wear the ESD wrist strap correctly.
2. Use the Phillips screwdriver to remove the filler panel from the slot to
be used (the first slot is not installed with a filler panel by default).
3. Gently push the interface card horizontally along the guide rails until it
touches the backplane of the PFC.
4. Fix the captive screws on the interface card.

12
Connecting Cables
CAUTION:
Do not connect
the
PFC to an operating device. Otherwise, the device
may work abnormally.
Connecting the Cables of the 8EPM
The PFC does not provide interface cables. You need to prepare them
(network cables) by yourself.
The connections between the PFC and interfaces of the device are as
shown in How PFC Works. One connection method is: Interfaces NET A
and NET B are connected to the external and internal network interfaces of
the user network, respectively; interfaces A and B are connected to the
interfaces added to the external and internal zones, respectively. The other
connection method is: Interfaces NET A and NET B are connected to the
internal and external network interfaces of the user network, respectively;
interfaces A and B are connected to the interfaces added to the internal
and external zones, respectively.
Connecting the Optical Fibers of the
4FPM
Each optical interface of the 4FPM needs two optical fibers for the
directions Tx and Rx respectively. When connecting the optical fibers of
4FPM, pay attention to the sequence of the optical fibers to avoid
misconnection.
The connection method is as shown in Figure 9.

13
Figure 9 Connect the optical fibers of the 4FPM
Both single-mode and multimode optical interfaces can be connected to
the optical interfaces of 4FPM, but the wavelength provided by the peer
interface card must be 850 nm or 1310 nm. Additionally, the attributes of
the optical interfaces on the device must be consistent with those on the
peer device. Otherwise, the link connectivity may be unavailable. In this
sense, the PFC is transparent to the device and the peer device.
The attributes of optical interfaces include the following:
•
Optical transmit power
•
Receive sensitivity
•
Overload optical power
•
Central wavelength
•
Maximum transmission distance
•
Fiber type
PFC optical interface card
(4FPM)
NET A NET BBA
AB AB
AB AB
RxTx
Internal network
interface
RxTx
External network
interface
RxTx
External zone
RxTx
Internal zone
Device