H3C SECPATH 5080F-CMW710-R9628P2414 How to use

H3C SECPATH
5080F-CMW710-R9628P2414
Release Notes
Copyright © 2021 New H3C Technologies Co., Ltd. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any
means without prior written consent of New H3C Technologies Co., Ltd.
The information in this document is subject to change without notice.

i
Contents
Introduction·····················································································1
List of severe vulnerabilities································································1
Version information···········································································2
Version number ···························································································································2
Version history ····························································································································2
Hardware and software compatibility matrix ······················································································4
ISSU compatibility list ···················································································································5
Upgrade restrictions and guidelines·································································································6
Hardware feature updates··································································6
Hardware feature updates in E9628P05···························································································6
Hardware feature updates in E9628P03···························································································6
Software feature and command updates ···············································7
MIB updates····················································································7
Operation changes···········································································8
Restrictions and cautions···································································8
Open problems and workarounds ························································9
List of resolved problems ···································································9
Resolved problems in R9628P2414·································································································9
Resolved problems in R9628P2413·································································································9
Resolved problems in R9628P2412·······························································································10
Resolved problems in R9628P2410·······························································································10
Resolved problems in R9628P24··································································································10
Resolved problems in F9628P22 ··································································································10
Resolved problems in F9628P20 ··································································································10
Resolved problems in F9628P18 ··································································································10
Resolved problems in F9628P16 ··································································································10
Resolved problems in R9628P13··································································································11
Resolved problems in F9628P12 ··································································································11
Resolved problems in E9628P09 ·································································································· 11
Resolved problems in E9628P08 ·································································································· 11
Resolved problems in E9628P07 ·································································································· 11
Resolved problems in E9628P05 ·································································································· 11
Resolved problems in E9628P03 ·································································································· 11
Resolved problems in E9623········································································································ 11
Resolved problems in E9616P10 ·································································································· 12

ii
Related documentation····································································12
Obtaining documentation·································································12
Technical support···········································································12
Appendix A Feature list ···································································13
Hardware features······················································································································ 13
Software features·······················································································································14
Appendix B Upgrading software ························································17
Software images························································································································ 17
Software images types ········································································································· 17
Software release forms·········································································································17
Configuration files ······················································································································18
Upgrade methods ······················································································································ 18
Preparing for the upgrade············································································································ 18
Upgrading system software·········································································································· 19
Upgrading system software from the CLI ·················································································19
Upgrading system software from the Web interface ···································································26
Upgrading system software from BootWare menus····································································27
Upgrading the BootWare············································································································· 31
Upgrading the BootWare from the CLI····················································································· 31
Upgrading BootWare from BootWare menus ············································································ 32
Handling software upgrade failures································································································ 35
Appendix C Using BootWare menus···················································36
Overview·································································································································· 36
BootWare menus ················································································································36
BootWare shortcut keys········································································································36
Using the BASIC-BOOTWARE menu····························································································· 37
Accessing the BASIC-BOOTWARE menu················································································37
Modifying serial port parameters ···························································································· 38
Upgrading the extended BootWare segment ············································································38
Upgrading the entire BootWare······························································································ 38
Running the primary extended BootWare segment ····································································39
Running the backup extended BootWare segment····································································· 39
Accessing the BASIC ASSISTANT menu·················································································40
Testing the memory···················································································································· 40
Using the EXTENDED-BOOTWARE menu····················································································· 40
Accessing the EXTENDED-BOOTWARE menu ········································································40
Controlling the password recovery capability ············································································42
Running Comware images···································································································· 43

iii
Accessing the Serial submenu······························································································· 43
Accessing the Ethernet submenu ···························································································44
Managing files ····················································································································46
Restoring the factory-default configuration ··············································································· 57
Skipping the configuration file ································································································57
Accessing the BootWare Operation submenu··········································································· 58
Skipping console login authentication······················································································ 58
Managing storage media ······································································································ 59
Accessing the EXTEND ASSISTANT submenu·········································································59
Formatting the file system····································································································· 60

iv
List of tables
Table 1 Version history....................................................................................................................................................................2
Table 2 Hardware and software compatibility matrix.........................................................................................................4
Table 3 ISSU compatibility list......................................................................................................................................................5
Table 5 MIB updates ........................................................................................................................................................................ 7
Table 6 Firewall specifications....................................................................................................................................................13
Table 7 Firewall software features ............................................................................................................................................14
Table 8 Default login information ............................................................................................................................................26
Table 11 BootWare menus ..........................................................................................................................................................36
Table 12 BootWare shortcut keys .............................................................................................................................................36
Table 14 BASIC ASSISTANT menu options............................................................................................................................40
Table 16 Serial submenu options .............................................................................................................................................44
Table 19 File Control submenu options .................................................................................................................................46
Table 20 BootWare Operation submenu options...............................................................................................................58
Table 21 DEVICE CONTROL menu options ...........................................................................................................................59
Table 22 EXTEND ASSISTANT submenu options ................................................................................................................59

1
Introduction
This document describes the features, restrictions and guidelines, open problems, and workarounds
for version R9628P2414. Before you use this version on a live network, back up the configuration
and test the version to avoid software upgrade affecting your live network.
Use this document in conjunction with H3C SECPATH5080F-CMW710-R9628P2414Release Notes
(Software Feature Changes) and the documents listed in "Related documentation."
List of severe vulnerabilities
[HSVD-201709-002] CVE-2019-3855: An attacker can exploit this vulnerability to execute
unauthorized operations.
[HSVD-201903-017] CVE-2019-3855: An integer overflow flaw which could lead to an out of
bounds write was discovered in libssh2 in the way packets are read from the server. libssh2 is a
client-side C library implementing the SSH2 protocol. A remote attacker who compromises an
SSH server may be able to execute code on the client system when a user connects to the
server.
[HSVD-201904-001] TCP/IP SYN + FIN packet filtering vulnerability: A remote host does not
discard TCP SYN packets with the FIN flag set. An attacker might bypass the firewall,
depending on the type of firewall used.
[HSVD-201902-001] A remote host can exploit the TCP timestamp vulnerability to obtain the
online time.
[HSVD-201901-016] CVE-2019-0548: A Linux kernel vulnerability that can cause information
revealing.
[JavaScript library vulnerability]: Internal IP addresses in destination URLs might be revealed.
 [CVE-2020-10188]: utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to
execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the
netclear and nextitem functions.
 [Web JavaScript vulnerability]: A medium-risk vulnerability found during Web vulnerability
scanning.
[Web CSRF vulnerability]: An CSRF vulnerability was found on the SSL VPN Web login
interface.
[HTTP method vulnerability]: An attacker can use the OPTIONS method to determine the HTTP
methods allowed by each directory.
[CRLF injection vulnerability]: This vulnerability can be exploited when an HTTP request
contains a user-configured domain in the cookies or the request is GET
/enterdomain.cgi?domain=%0d%0aSomeCustomInjectedHeader:%0d%0aset-cookie:iamyy
HTTP1/1.
[CNVD-2019-38485] CVE-2019-1547: An attacker can exploit this vulnerability to obtain
sensitive information.
[CNVD-2019-38486] CVE-2019-1563: In situations where an attacker receives automated
notification of the success or failure of a decryption attempt, an attacker, after sending a very
large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption
key or decrypt any RSA encrypted message that was encrypted with the public RSA key.
[CNVD-2017-00450] CVE-2016-7056: A timing attack flaw was found in OpenSSL 1.0.1u and
before that could allow a malicious user with local access to recover ECDSA P-256 private
keys.

2
[CNVD-2018-06539] CVE-2018-0739: Constructed ASN.1 types with a recursive definition
(such as can be found in PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. This could result in a Denial Of Service attack.
[CNVD-2019-05906] CVE-2019-1559: An attacker can exploit this vulnerability to bypass
access controls and obtain sensitive information.
[CNVD-2018-09649] CVE-2018-0737: An attacker with sufficient access to mount cache timing
attacks during the RSA key generation process could recover the private key.
[CNVD-2018-12153] CVE-2018-0732: An attacker can exploit this vulnerability to launch a DoS
attack.
[CNVD-2019-27331] CVE-2019-1552: This vulnerability is related to OpenSSL. An attacker can
exploit this vulnerability to bypass security controls.
[CVE-2018-5407]: This vulnerability is related to OpenSSL. An attacker can exploit this
vulnerability to obtain sensitive information and launch more attacks.
[X-Frame-Options vulnerability]: A missing X-Frame-Options header can cause a clickjacking
attack.
[CVE-2011-1473]: SSL does not properly restrict client-initiated renegotiation, and SSL clients
can renegotiate successfully.
Version information
Version number
H3C Comware software, Version 7.1.064, Release 9628P2414
Note: You can see the version number with the display version command in any view. Please
see Note①.
Version history
IMPORTANT:
The software feature changes listed in the version history table for each version are not complete.
To obtain complete information about all software feature changes in each version, see the Software
Feature Changes document for this release notes.
Table 1 Version history
Version number
Last version
Release date
Release type
Remarks
R9628P2414
R9628P2413
2021-07-28
Release version
Released for resolved
problems and for the use
of technical support.
R9628P2413
R9628P2412
2021-06-28
Release version
Released for resolved
problems and for the use
of technical support.
R9628P2412
R9628P2410
2021-05-25
Release version
Released for resolved
problems and for the use
of technical support.
R9628P2410
F9628P24
2021-03-26
Release version
Released for resolved
problems and for the use
of technical support.

3
Version number
Last version
Release date
Release type
Remarks
R9628P24
F9628P22
2021-02-25
Release version
Released for resolved
problems and for the use
of technical support.
F9628P22
F9628P20
2021-01-12
Feature version
Release for resolved
problems.
Restricted to the use of
technical support.
F9628P20
F9628P18
2020-10-30
Feature version
Release for resolved
problems.
Restricted to the use of
technical support.
F9628P18
F9628P16
2020-08-31
Feature version
Release for resolved
problems.
Restricted to the use of
technical support.
F9628P16
R9628P13
2020-06-28
Feature version
Release for resolved
problems.
Restricted to the use of
technical support.
R9628P13
F9628P12
2020-03-24
Release version
Released for resolved
problems and for the use
of technical support.
F9628P12
E9628P09
2020-01-13
Feature version
Release for resolved
problems.
Restricted to the use of
technical support.
E9628P09
E9628P08
2019-10-25
ESS version
Released for resolved
problems and for the use
of technical support.
E9628P08
E9628P07
2019-09-26
ESS version
Release for resolved
problems.
Restricted to the use of
technical support.
E9628P07
E9628P05
2019-08-23
ESS version
Release for resolved
problems.
Restricted to the use of
technical support.
E9628P05
E9628
2019-06-26
ESS version
Release for resolved
problems.
Restricted to the use of
technical support.
E9628P03
E9623
2019-04-29
ESS version
Release for resolved
problems.
Restricted to the use of
technical support.
E9623
E9616P10
2018-09-30
ESS version
Release for resolved
problems.
Restricted to the use of
technical support.
E9616P10
First release
2018-08-30
ESS version
First release for the

4
Version number
Last version
Release date
Release type
Remarks
overseas market.
Restricted to the use of
technical support.
Hardware and software compatibility matrix
CAUTION:
To avoid an upgrade failure, use Table 2 to verify the hardware and software compatibility before
performing an upgrade.
Table 2 Hardware and software compatibility matrix
Item
Specifications
Hardware platform
F5030
F5030-6GW
F5000-M
F5000-AI-20
F5000-V30
F5060
F5000-A
F5000-AI-40
F5080
Memory
16 GB
32 GB
64 GB
Flash
eMMC flash: 4 GB
NAND flash: N/A
BootWare version
1.08 (Note: Execute the display version command in any view to view the version
information. Please see Note②)
Host software
SECPATH5080F-CMW710-R9628P2414.ipe
F5080FW-CMW710-BOOT-R9628P2414.bin
F5080FW-CMW710-SYSTEM-R9628P2414.bin
iMC version
iMC EIA 7.3 (E0611P05)
iMC IVM 7.3 (E0506L02)
iMC PLAT 7.3 (E0705P10)
iMC SHM 7.3 (E0506)
iMC SSM 7.3 (E0506H01)
iMC UBA 7.3(E0505P03)
CSAP-S version
E1143P01
H3C SecCenter
SMP version
E1110P02
H3C SecCloud
OMP version
V100R001B02D009
iNode version
iNode PC 7.3 (E0568)
Sample: To display the host software and BootWare version of F5030, perform the following:
<H3C> display version
H3C Comware Software, Version 7.1.064, Release 9628P2414 ----Note①
Copyright (c) 2004-2021 New H3C Technologies Co., Ltd. All rights reserved.
H3C SecPath F5080 uptime is 0 weeks, 0 days, 5 hours, 38 minutes

5
Last reboot reason: User reboot
Boot image: sda0:/F5080FW-CMW710-BOOT-R9628P2414.bin
Boot image version: 7.1.064, Release 9628P2414
Compiled Jul 14 2021 14:00:00
System image: sda0:/F5080FW-CMW710-SYSTEM-R9628P2414.bin
System image version: 7.1.064, Release 9628P2414
Compiled Jul 14 2021 14:00:00
SLOT 1
CPU type: Multi-core CPU
DDR3 SDRAM Memory: 16368M bytes
SD0: 3728M bytes
NSQ1MPBHA PCB Version: Ver.B
NSQ1MPBBHB PCB Version: Ver.A
NSQ1MPHDBHA PCB Version: Ver.A
NSQ1MPGC4BHA PCB Version: Ver.A
NSQ1MPLEDBHA PCB Version: Ver.A
CPLD_A Version: 1.0
CPLD_B Version: 1.0
Release Version:SecPath F5030-9628P2414
Basic BootWare Version:1.08 ----Note②
Extend BootWare Version:1.08
ISSU compatibility list
ISSU allows compatible upgrades and incompatible upgrades. Table 3 show the versions released in
18 months that support compatible upgrades to the current version. For more information about
ISSU upgrade methods, see Fundamentals Configuration Guide.
Table 3 ISSU compatibility list
Current version
Earlier version
ISSU compatibility
SECPATH5080F-CMW710-R962
8P2414
SECPATH5080F-CMW710-R9628P2413
Compatible
SECPATH5080F-CMW710-R9628P2412
Compatible
SECPATH5080F-CMW710-R9628P2410
Compatible
SECPATH5080F-CMW710-R9628P24
Compatible
SECPATH5080F-CMW710-F9628P22
Compatible
SECPATH5080F-CMW710-F9628P20
Compatible
SECPATH5080F-CMW710-F9628P18
Compatible
SECPATH5080F-CMW710-F9628P16
Compatible
SECPATH5080F-CMW710-R9628P13
Compatible
SECPATH5080F-CMW710-F9628P12
Compatible
SECPATH5080F-CMW710-E9628P09
Compatible
SECPATH5080F-CMW710-E9628P08
Compatible

6
SECPATH5080F-CMW710-E9628P07
Compatible
SECPATH5080F-CMW710-E9628P05
Compatible
SECPATH5080F-CMW710-E9628P03
Compatible
Upgrade restrictions and guidelines
To ensure hardware compatibility, do not downgrade the factory software version.
For the signature databases for anti-virus and URL filtering, the official website provides two
sizes for different device storage spaces. The letter H in the name indicates a large signature
database. For example, the V7-AV-H-1.0.68.dat is a large signature database and the
V7-AV-1.0.68.dat is a small one. When you perform a manual update, examine your device
storage capacity to determine which signature database should be downloaded. The large
signature databases are supported when the memory is larger than 8 GB, and the capacity of
the storage medium (flash memory, SD card, or CF card) is larger than 1 GB. Otherwise, only
the small signature databases are supported.
You can upgrade an IRF fabric from a security policy-incapable version to a
security-policy-capable version through an ISSU. To use security policies after the upgrade, you
must reboot the IRF fabric.
To ensure a successful upgrade, make sure the current Boot ROM version is consistent with the
system version before an ISSU.
After an ISSU, clear the browser cache for the Web interface to correctly display the
configuration information of modified features.
You can check the Upgrade Way field in the output from the display version comp-matrix
command for recommended ISSU methods.
The version E9628P05 and earlier versions do not support ISSU.
Table 4 ISSU compatibility list
Version description
Version identifier
Version number
ISSU compatibility
Base line version
V0
E9628P07
Compatible
Last software version
Vn-1
R9628P2413
/
Last Release version
Vk
R9628P2413
/
Hardware feature updates
Hardware feature updates in E9628P05
The hardware platform F5000-V30 is added.
For information about the hardware features, see "Hardware features" in the appendix.
Hardware feature updates in E9628P03
The following hardware platforms are added:
F5000-A
F5000-AI-20

7
F5000-AI-40
For information about the hardware features, see "Hardware features" in the appendix.
Software feature and command updates
This version added support for sending logs to log hosts in SGCC format.
For more information about the software feature and command update history, see H3C
SECPATH5080F-CMW710-R9628P2413Release Notes (Software Feature Changes).
MIB updates
Table 5 MIB updates
Item
MIB file
Module
Description
R9628P2414
New
None
None
None
Modified
None
None
None
R9628P2413
None
None
None
None
None
None
R9628P2412
New
None
None
None
Modified
None
None
None
R9628P2410
None
None
None
None
None
None
R9628P24
New
None
None
None
Modified
None
None
None
F9628P22
New
None
None
None
Modified
None
None
None
F9628P20
New
None
None
None
Modified
None
None
None
F9628P18
New
None
None
None
Modified
None
None
None
F9628P16
New
None
None
None

8
Modified
None
None
None
R9628P13
New
None
None
None
Modified
None
None
None
R9628P12
New
None
None
None
Modified
None
None
None
E9628P09
New
None
None
None
Modified
None
None
None
E9628P08
New
None
None
None
Modified
None
None
None
E9628P07
New
None
None
None
Modified
None
None
None
E9628P05
New
None
None
None
Modified
None
None
None
E9628P03
New
None
None
None
Modified
None
None
None
E9623
New
None
None
None
Modified
None
None
None
E9616P10
New
None
None
None
Modified
None
None
None
Operation changes
None.
Restrictions and cautions
To avoid abnormality and configuration failure, follow these restrictions:
Use the following browsers:
Chrome 31 or higher.
Firefox v19 or higher.

9
Safari 5 or higher.
Internet Explorer 9 or higher.
When two power modules are installed, do not repeatedly re-install them within a short period.
To avoid the CPU errors caused by frequent power module re-installation, install power
modules correctly in one operation.
The Web interface and CLI cannot be used together. Do not configure a feature through both
the Web interface and CLI.
Only devices of the same model can form an IRF fabric.
IRF physical interfaces must be the same type. You can use only the following ports as IRF
physical interfaces:
Fiber ports on the panel.
Ports on an interface module installed in slot 1 or slot 2.
For 4SFP&4SFP+ and 8SFP+ interface modules, the following restrictions apply:
10 GE ports on 4SFP&4SFP+ and 8SFP+ interface modules support GE/10GE autosensing
when they are installed in slot 3, but they do not support copper transceiver modules.
4SFP&4SFP+ interface modules can be installed only in slot 3. For GE ports on a
4SFP&4SFP+ interface module, speed or duplex autonegotiation is disabled by default. As
a best practice for a GE port on the interface module to come up, make sure the speed or
duplex mode on the interface is the same as that on the peer interface.
If DPI is not configured, the maximum number of contexts is as described in the context
specification. If DPI is configured, the maximum number of contexts is half the specification.
As from version R9628P2412 the device supports global NAT but does not support VPN or
DNS mapping. Deploy global NAT on a newly launched network. On a network where
interface-based NAT has been deployed, you cannot deploy the global NAT to replace the
interface-based NAT.
As from version R9628P2412, the device supports RBM but does not support contexts.
Open problems and workarounds
201801290651
Symptom: Boot ROM upgrade fails.
Condition: This symptom occurs if you upgrade Boot ROM of the device from the CLI.
Workaround: Press Ctrl+B to enter the BootWare menu to upgrade the Boot ROM.
List of resolved problems
Resolved problems in R9628P2414
None.
Resolved problems in R9628P2413
None.

10
Resolved problems in R9628P2412
None.
Resolved problems in R9628P2410
202102070830
Symptom: The CPU usage information of the 2.6GHz multi-core CPU is abnormal. Some cores'
usage rates exceed 100%.
Condition: This symptom occurs when you execute the display process cpu | i drv
command to view CPU usage information on the device running R9628P24 or a lower version.
202102040409
Symptom: Traffic cannot match security policy rule 1 as expected but is permitted by a
permit-any security policy rule. However, the traffic can match rule 1 after you disable, enable,
and accelerate rule 1.
Condition: This symptom occurs if security policy rule 1 that uses an application group is
configured, and traffic matching rule 1 is injected after the device reboots.
Resolved problems in R9628P24
None.
Resolved problems in F9628P22
None.
Resolved problems in F9628P20
None.
Resolved problems in F9628P18
202006270148
Symptom: The CPU of the device is restarted or gets stuck.
Condition: This symptom occurs if DPI is enabled on the device and the device receives mixed
application layer traffic.
Resolved problems in F9628P16
202005260338
Symptom: Login through SSH is slow.
Condition: This symptom occurs if the device receives light traffic at 50 Mbps.

11
Resolved problems in R9628P13
None.
Resolved problems in F9628P12
202001070642
Symptom: The rate of file download through the Server Message Block protocol is very low.
Condition: This symptom occurs if the device is configured with bandwidth management, audit
management, or IPS settings.
Resolved problems in E9628P09
201907220439
Symptom: The interface cannot be brought up when you install an 8SFP+ or 4SFP&4SFP+
interface card in slot 3 and install a GE transceiver module in a 10-GE interface. This is because
10-GE interfaces on these interface cards do not support GE transceiver modules once the
interface cards are installed in slot 3. This problem is resolved in this release, but restrictions
exist. For more information, see "Restrictions and cautions."
Condition: This symptom occurs when you install an 8SFP+ or 4SFP&4SFP+ interface card in
slot 3 and install a GE transceiver module in a 10-GE port.
Resolved problems in E9628P08
None.
Resolved problems in E9628P07
None.
Resolved problems in E9628P05
201906260353
Symptom: Packets are dropped occasionally.
Condition: This symptom occurs if MAC address filtering is not enabled on the device by
default.
Resolved problems in E9628P03
None.
Resolved problems in E9623
None.

12
Resolved problems in E9616P10
None.
Related documentation
H3C SecPath F5030[60][80][30-D][60-D][80-D][30-6GW][F5000-M][F5000-A] Firewalls
@IG@-6W106
H3C SecPath F5030[60][80][30-D][60-D][80-D][30-6GW] Firewall Installation Quick
Start-6W104
H3C SecPath PSR650B-12A1 & PSR650B-12D1 Power Modules User Manual-6W102
H3C SecPath Firewall Command References(V7)
H3C SecPath Firewall Configuration Guides(V7)
Obtaining documentation
To obtain the related documents from the H3C website at http://www.h3c.com/en:
1. Click http://www.h3c.com/en/Support/Resource_Center/Technical_Documents.
2. Choose the desired product category and model.
Technical support
[email protected]
http://www.h3c.com/en

13
Appendix A Feature list
Hardware features
Table 6 Firewall specifications
Item
Specifications
Hardware
platform
F5030
F5060
F5080
F5000-M
F5000-V30
F5000-AI
-20
F5000
-AI-40
Ports
1 × console
port
2 × USB host
mode ports
4 × GE combo
ports
Included
interface
modules for
F5030:
8-port GE
interface
module
8-port
SFP+
interface
module
Included
interface
modules for
F5030-6GW:
None
1 × console port
2 × USB host
mode ports
4 × GE combo
ports
Included
interface
modules:
8-port SFP
interface
module
8-port GE
interface
module
8-port
SFP+
interface
module
1 × console port
2 × USB host
mode ports
4 × GE combo
ports
Included
interface
modules:
8-port SFP
interface
module
8-port GE
interface
module
8-port SFP+
interface
module
1 × console
port
2 × USB host
mode ports
3 × GE
combo ports
1 ×
management
port
No interface
modules
included
1 × console port
2 × USB host mode
ports
3 × GE combo ports
1 ×management
port
No interface
modules included
Memory
16 GB DDR3
SDRAM
32 GB DDR3
SDRAM
64 GB DDR3
SDRAM
16 GB DDR3
SDRAM
16 GB
DDR3
SDRAM
32 GB
DDR3
SDRA
M
Flash
4 GB
Expansion
slots
8 expansion slots that support the following interface modules:
8-port SFP+ interface module
2-port QSFP+ interface module
8-port GE interface module
8-port SFP interface module
4-port PFC interface module
4-port SFP & 4-port SFP+ interface module
Hard disk
slots
2 hard disk slots that support SATA hard disks. Hard disks are not hot swappable.
Power
modules
2 × 650 W AC or DC power modules. AC and DC power modules cannot be used together.
Dimension
s (H ×W ×
D)
88 ×440 ×660 mm (3.46 ×17.32 ×25.98 in)

14
Item
Specifications
Operating
temperatu
re
Operating:
Without hard disks: 0°C to 45°C (32°F to 113°F)
With hard disks: 5°C to 40°C (41°F to 104°F)
Storage: –40°C to 70°C (–40°F to 158°F)
Relative
humidity
Operating:
Without hard disks: 5% RH to 95% RH, noncondensing
With hard disks: 10% RH to 90% RH, noncondensing
Storage:
Without hard disks: 5% RH to 95% RH, noncondensing
With hard disks: 5% RH to 95% RH, noncondensing
Software features
Table 7 Firewall software features
Category
Features
AAA
RADIUS/HWTACACS+ authentication.
CHAP authentication.
PAP authentication.
Domain authentication.
Firewall
Packet filtering.
Security zone-based access control.
Time-based access control.
ASPF.
Virtual firewall.
Attack protection against malicious attacks, such as land, smurf, fraggle, WinNuke,
ping of death, teardrop, IP spoofing, IP fragmentation, invalid TCP flag, large ICMP
packet, address/port scanning, SYN flood, and ICMP flood.
Control of ICMP redirection and destination unreachable messages.
Tracert message control.
Control of IP packets with the RR option.
Static blacklist and dynamic blacklist.
Security
management
Real-time attack protection logs.
Blacklist logs.
Session logs.
Binary logs.
Traffic statistic collection and analysis.
Security event statistics.
NAT
NAT support for address pools.
NAT support for ACLs.
Easy IP.
NAT server.
Effective period of NAT.
NAT ALGs, including FTP, DNS, QQ, MSN, H323, NBT, ILS, RTSP, SQLNET, SIP,
RSH, and MGCP.
NAT444.

15
Category
Features
Email filtering
Email sender/recipient-based filtering.
Email subject/content/attachment filtering.
Uploaded/downloaded FTP file filtering.
Support for matching Chinese character codes.
Bandwidth
management
Setting the maximum upstream bandwidth and the maximum downstream
bandwidth.
Setting the guaranteed upstream bandwidth and the guaranteed downstream
bandwidth.
Specifying traffic profiles based on parameters such as source security zone,
destination security zone, source address, destination address, application,
application group, time range, and user.
Child traffic profiles.
Interface-specific bandwidth configuration.
AVC reports and logs, including user logs, local logs, and local reports.
Traffic blocking and rate-limiting.
IPSec/IKE
AH and ESP.
Manual SA setup and IKE SA setup.
ESP support for DES, 3DES, and AES encryption algorithms.
Support for MD5 and SHA-1 authentication algorithms.
Support for IKE main mode and aggressive mode.
DPD.
NAT traversal.
L2TP
L2TP.
GRE
GRE tunnel.
SSL VPN
SSL VPN features.
LAN
Ethernet_II.
VLAN.
IP services
ARP.
Static domain name resolution.
IP address borrowing.
DHCP relay.
DHCP server.
DHCP client.
IP routing
Static route management.
RIP-1/RIP-2.
OSPF.
BGP.
Routing policy.
PBR.
Basic IPv6 protocols.
Protocol processing.
Ethernet link layer.
ICMPv6.
IPv6 address management.
PMTU.