H3C SecPath F50X0 Series User manual

i
H3C SecPath
Quick Deployment Guide
Document version: 6W100-20230724
Copyright © 2023 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New
H3C Technologies Co., Ltd.
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document
are the property of their respective owners.
The information in this document is subject to change without notice.

i
Contents
About the firewall quick deployment guide·····················································1
F5000 series ······················································································································································1
F1000 series ······················································································································································1
F100 series ························································································································································2
Chassis views································································································2
Front panel·························································································································································2
Rear panel··························································································································································3
Mechanism of firewalls ··················································································3
About firewalls····················································································································································3
Interfaces and security zones ····························································································································3
Security policy····················································································································································5
Configuring basic firewall settings··································································5
Obtaining the factory default settings·················································································································5
Application scenario-based networking ·············································································································6
Logging in to the Web interface ·························································································································6
Internet access in routing mode·······················································································································12
Internet access through a specific IP address ·························································································12
Internet access through DHCP ················································································································16
Internet access through PPPoE···············································································································19
Internet access in transparent mode················································································································23
Configuring signature library upgrade··············································································································24
Configuring automatic signature library upgrade ·····················································································25
Triggering a signature library upgrade·····································································································28
Performing a manual signature library upgrade·······················································································32
Activating and installing a license for the first time···························································································32
Configuring a security policy····························································································································32
Restoring the factory defaults ··························································································································34
Upgrading software··········································································································································36
Performing maintenance and diagnostics········································································································36
Advanced features·······················································································37
NAT··································································································································································37
Remote office through IPsec····························································································································38
Remote office through SSL VPN ·····················································································································38
Hot backup·······················································································································································38

1
About the firewall quick deployment guide
This guide helps you to have a preliminary understanding of the use of a firewall and complete the
basic settings of the firewall, including the following:
•
Common networking methods of the firewall.
•
Quickly connect the firewall to the Internet.
•
Quickly provide the security protection for enterprise networks.
•
Common operation and maintenance measures of the firewall.
If you want to further understand and use more abundant security protection functions of the firewall,
refer to the manual of the corresponding product.
This guide uses the feature 8590P06 version of the F100-C-A1 device as an example. The
configuration interfaces and configurations might differ depending on the hardware model or
software version.
This guide applies to the following models and versions:
F5000 series
F5000 series
Model
F50X0 series F5010, F5020, F5040, F5030, F5030-6GW, F5030-6GW-G, F5060, F5080, F5000-M,
F5000-A, F5000-C, F5000-S
F5000-AI series F5000-AI-15, F5000-AI-20, F5000-AI-40
F1000 series
F1000 series
Models
F1000-AI-X0
series
F1000-AI-03, F1000-AI-10, F1000-AI-20, F1000-AI-30, F1000-AI-50, F1000-AI-60,
F1000-AI-70, F1000-AI-80, F1000-AI-90
F1000-AI-X5
series
F1000-AI-05, F1000-AI-15, F1000-AI-25, F1000-AI-35, F1000-AI-55, F1000-AI-65,
F1000-AI-75
F1000-X-G3 series F1000-A-G3, F1000-C-G3, F1000-E-G3, F1000-S-G3
F10X0 series F1003-C, F1003-M, F1003-S, F1005, F1010, F1020, F1030, F1050, F1060, F1070,
F1080, F1090

2
F100 series
F100 series
Models
F100-C-A series F100-C-A6-WL, F100-C-A5-W, F100-C-A3-W, F100-C-A6, F100-C-A5, F100-C-A3,
F100-C-A1, F100-C-A2
Chassis views
The chassis views vary by firewall model. For more information about the chassis views, see the
installation guide for the product. This section uses the F100-C-A1 firewall as an example.
Front panel
The F100-C-A1 firewall provides the following ports on the front panel:
•
Two 1000BASE-X Ethernet fiber ports.
•
Five 10/100/1000BASE-T autosensing Ethernet copper ports (including one management
Ethernet port).
•
One USB port.
•
One console port.
•
One Micro SD card slot.
Figure 1 Front panel
(1) 10/100/1000BASE-T copper ports
(2) 1000BASE-X fiber ports
(3) Console port
(4) USB port (host mode, Type A)
(5) Micro SD card slot
(6) Reset button
(7) DC-input power receptacle (8) Micro SD card, system status (SYS), and power
status (PWR) LEDs
(9) 1000BASE-X fiber port LED
(10) 10/100/1000BASE-T Ethernet copper port LED
(11) Management Ethernet port (MGMT)
NOTE:

3
T
he reset button restarts the firewall. It does not restore the factory defaults.
Rear panel
Figure 2 Rear panel
(1) Grounding screw
Mechanism of firewalls
About firewalls
A firewall is a network security device typically located at the network perimeter to isolate networks
with different security levels as needed, protecting one network against attacks and intrusions from
another network. You can configure the firewall to permit valid traffic and deny invalid traffic.
A firewall controls network traffic mainly based on security zones and security policies.
Interfaces and security zones
As shown in Figure 3, you can configure security zones to implement security zone-based security
management. A security zone is a logical concept that indicates a collection of interfaces that have
the same security requirements.
1

4
Figure 3 Security zones
A firewall device provides default security zones Local, Management, Trust, DMZ, and Untrust.
Default security zones cannot be deleted. The function and application scenario of each default
security zone are as follows:
•
Local—Refers to the device itself. You cannot add interfaces to security zone Local. For
communication between a non-Management security zone and the device, you must configure
a security policy to permit the packets between the corresponding security zone and security
zone Local.
•
Management—Refers to the security zone used for managing the device. The device permits
packets between security zones Management and Local by default and you do not need to
configure a security policy. By default, the device management interface belongs to security
zone Management. You can log in to the device management interface to configure the device
from a PC.
•
Trust—Refers to the trusted security zone. You can assign the interface connected to the
internal network to security zone Trust and configure a security policy to perform threat
detection on incoming packets from other security zones. In this way, you can protect internal
hosts and strictly control outgoing packets destined for other security zones to prevent data
leakage.
•
DMZ—A demilitarized zone is an isolated security zone that typically incorporates the
interfaces connected to various public services or resources (such as Web servers or FTP
servers). You can configure a security policy to audit packets sent to security zone DMZ from
other security zones, so as to protect the servers from attacks and prevent data theft.
•
Untrust—Refers to the untrusted network security zone. You can assign the interface
connected to the Internet to security zone Untrust and configure a security policy to strictly
detect packets sent to other security zones, so as to block external attacks and threats such as
viruses.

5
Security policy
As shown in Figure 4, a security policy filters packets based on the specified filtering conditions
such as source/destination security zone, source IP/MAC address, destination IP address, service,
application, terminal, user, and time period. It processes matched packets according to the pre-set
policy action. If a packet does not match any policy, it will be discarded. If no filtering conditions are
configured in the security policy, the policy matches all packets.
Figure 4 Packet processing of security policy
Configuring basic firewall settings
Obtaining the factory default settings
Table 1 shows the factory default settings of the device. You can also obtain the default username
and password of the device through the nameplate on the device.
Table 1 Factory default settings of the device
Item
Default
Remarks
Username admin N/A
Password admin N/A
Login type •Device login from the Web interface
•Device login from the console port
Configure other login types
as needed.
IP address of
the Ethernet
management
interface
•Interface: GigabitEthernet 1/0/0 or
M-GigabitEthernet 1/0/0
•IP address: 192.168.0.1/24
The management interface
varies by device model. For
more information, see the
product manuals or the
nameplate on the device.

6
Application scenario-based networking
As shown in Figure 5, connect the management interface, internal interface GE 1/0/2, and external
interface GE 1/0/1 of the device. The internal interface acts as a LAN port and is typically added to
the Trust security zone to connect the intranet host. The external interface acts as a WAN port and
is typically added to the Untrust security zone to connect the carrier network for external
communication.
To configure the device from the CLI, use the console cable to connect the serial port on the
management PC to the console port on the device for first login.
Figure 5 Connecting cables
Logging in to the Web interface
Restrictions and guidelines
As a best practice, using the following browsers:
•
Chrome 40 and higher
•
Firefox 19 and higher.
•
Internet Explorer 10 and higher.
GE1/0/1
202.0.0.1
MGE1/0/0
192.168.0.1 GE1/0/2 176.16.1.254
Untrust
ISP
Web server
www.example.com
Management Trust
Administrator Host Intranet Host

7
To access the Web interface, you must use the following browser settings:
•
Accept the first-party cookies (cookies from the site you are accessing).
•
Enable active scripting or JavaScript, depending on the Web browser.
•
If you are using an Internet Explorer browser, you must enable the following security settings:
Script ActiveX controls marked safe for scripting.
Run ActiveX controls and plug-ins.
•
To ensure correct display of webpage contents after software upgrade or downgrade, clear
data cached by the browser before you log in.
Procedure

8

9

10

11

12
Internet access in routing mode
Internet access in routing mode indicates that the device in the network is deployed in Layer 3 mode.
That is, the uplink and downlink service interfaces of the device operate in Layer 3 mode. In this
mode, the device typically serves as the gateway of the enterprise that connects the internal
network and the Internet, and performs security monitoring and control of network traffic. In this
mode, the device supports abundant routing and security features. To adapt to various network
environments, the device provides the following methods to fast access the Internet:
•
Specified IP address—Obtains a fixed public network IP address from the carrier. Users in
the internal network must use this public network IP address to access the Internet.
•
DHCP—The device dynamically obtains a public network IP address through the DHCP
service provided by the carrier to access the Internet.
•
PPPoE—The user can access the Internet through a PPPoE access authentication account
obtained from the carrier.
Internet access through a specific IP address
This access method indicates obtaining a fixed public network IP address from the carrier. Users in
the internal network must use this public network IP address to access the Internet. The
configuration procedure is as follows:

13

14

15

16
Internet access through DHCP
The device dynamically obtains a public network IP address through the DHCP service provided by
the carrier to access the Internet. The configuration procedure is as follows:

17

18