HP A-F1000-E User manual

HP High-End Firewalls
Getting Started Guide
Part number: 5998-2626
Software version: A-F1000-E/Firewall module: R3166P13
A-F5000-A5: R3206P14
Document version: 6PW100-20110909

Legal and notice information
© Copyright 2011 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use
of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

i
Contents
Overview ······································································································································································ 1
Product overview·······························································································································································1
Firewall A-F1000-E···················································································································································1
Firewall A-F5000······················································································································································2
HP firewall modules ·················································································································································2
Application scenarios ·······················································································································································4
A-F1000-E application·············································································································································4
A-F5000 application················································································································································5
Firewall module application····································································································································6
Login methods ······························································································································································ 7
Login methods····································································································································································7
User interface overview····················································································································································8
Users and user interfaces·········································································································································9
Numbering user interfaces ······································································································································9
CLI login······································································································································································10
Overview········································································································································································· 10
Logging in through the console port ···························································································································· 10
Introduction ···························································································································································· 10
Configuration requirements·································································································································· 10
Login procedure····················································································································································· 11
Console login authentication modes ··················································································································· 14
Configuring none authentication for console login ··························································································· 14
Configuring password authentication for console login ··················································································· 15
Configuring scheme authentication for console login ······················································································· 16
Configuring common settings for console login (optional) ··············································································· 19
Logging in through Telnet·············································································································································· 21
Introduction ···························································································································································· 21
Telnet login authentication modes ······················································································································· 21
Configuring none authentication for Telnet login ······························································································ 22
Configuring password authentication for Telnet login ······················································································ 23
Configuring scheme authentication for Telnet login ·························································································· 24
Configuring common settings for VTY user interfaces (optional)······································································ 27
Configuring the device to log in to a Telnet server as a Telnet client······························································ 29
Logging in through SSH ················································································································································ 29
Introduction ···························································································································································· 29
Configuring the SSH server·································································································································· 30
Configuring the SSH client to log in to the SSH server ····················································································· 32
Logging in through the AUX port·································································································································· 33
Introduction ···························································································································································· 33
AUX login authentication modes ························································································································· 34
Configuring none authentication for AUX login································································································· 35
Configuring password authentication for AUX login························································································· 35
Configuring scheme authentication for AUX login ···························································································· 36
Configuring common settings for AUX login (optional)····················································································· 39
Configuration requirements·································································································································· 41
Login procedure····················································································································································· 41
Logging in through modems ········································································································································· 44
Introduction ···························································································································································· 44

ii
Configuration requirements·································································································································· 44
Login procedure····················································································································································· 44
Modem login authentication modes ···················································································································· 48
Configuring none authentication for modem login···························································································· 48
Configuring password authentication for modem login···················································································· 50
Configuring scheme authentication for modem login ······················································································· 51
Configuring common settings for modem login (optional)················································································ 53
Displaying and maintaining CLI login ························································································································· 56
Web login ··································································································································································57
Web login overview ······················································································································································ 57
Configuration guidelines ··············································································································································· 57
Logging in to the firewall by using the default web login information····································································· 57
Modifying the default web login information ············································································································· 58
Configuring the web login function····················································································································· 58
Configuring HTTP login ················································································································································· 59
Configuring HTTPS login ··············································································································································· 60
Displaying and maintaining web login ······················································································································· 62
Web login example······················································································································································· 62
HTTP login example ·············································································································································· 62
HTTPS login example ············································································································································ 63
Troubleshooting web login problems··························································································································· 65
Problem 1: Unable to access the device through web······················································································ 65
NMS login ··································································································································································69
NMS login overview······················································································································································ 69
Configuring NMS login················································································································································· 70
NMS login example······················································································································································· 71
Logging in to the firewall module from the network device····················································································73
Logging in to the firewall module from the network device······················································································· 73
Configuring the AUX user interface of the firewall module ·············································································· 73
Logging in to the firewall module ························································································································ 73
Monitoring and managing the firewall module on the network device ··································································· 74
Resetting the system of the firewall module ········································································································ 74
Configuring the ACSEI protocol ·························································································································· 74
Example for monitoring and managing the firewall module from the network device ·········································· 76
Basic configuration ····················································································································································79
Launching the basic configuration wizard·········································································································· 79
Configuring the system name and user password····························································································· 80
Configuring service management························································································································ 81
Configuring the IP address for an interface········································································································ 83
Configuring NAT··················································································································································· 84
Completing the configuration wizard ················································································································· 85
Device management ··················································································································································87
Device management overview······································································································································ 87
Configuring the device name ······································································································································· 87
Configuring the device name in the web interface···························································································· 87
Configuring the device name in the CLI·············································································································· 87
Configuring the system time·········································································································································· 88
Configuring the system time in the web interface······························································································ 88
Configuring the system time in the CLI················································································································ 92
Setting the idle timeout timer········································································································································· 95
Setting the idle timeout timer in the web interface····························································································· 95
Setting the idle timeout timer in the CLI··············································································································· 96

iii
Enabling the display of copyright information············································································································ 96
Configuring banners······················································································································································ 96
Introduction to banners ········································································································································· 96
Configuring banners ············································································································································· 97
Configuring the maximum number of concurrent users ····························································································· 98
Configuring the exception handling method··············································································································· 98
Rebooting the firewall···················································································································································· 99
Rebooting the firewall in the CLI·························································································································· 99
Configuring a scheduled task·····································································································································100
What is a scheduled task ···································································································································100
Configuration approaches ·································································································································100
Scheduled task configuration example ·············································································································103
Configuring temperature alarm thresholds for a card······························································································104
Clearing unused 16-bit interface indexes··················································································································104
Identifying and diagnosing pluggable transceivers ·································································································105
Introduction to pluggable transceivers ··············································································································105
Identifying a pluggable transceiver···················································································································106
Diagnosing a pluggable transceiver ·················································································································106
Displaying and maintaining device management····································································································106
User management ··················································································································································· 108
Configuring local users················································································································································108
Local user overview·············································································································································108
User levels ····························································································································································108
Configuring a local user·····································································································································108
Local user configuration example······················································································································109
Configuring user login control ····································································································································110
User login control overview································································································································110
Configuring login control over Telnet users······································································································110
Configuring source IP-based login control over NMS users···········································································113
Configuring source IP-based login control over web users·············································································114
Displaying online users················································································································································116
Overview······························································································································································116
Displaying online users·······································································································································116
CLI configuration ····················································································································································· 117
What is CLI? ·································································································································································117
Entering the CLI ····························································································································································117
Command conventions ················································································································································117
Undo form of a command···········································································································································118
CLI views ·······································································································································································118
CLI view description············································································································································118
Entering system view···········································································································································119
Exiting the current view·······································································································································120
Returning to user view·········································································································································120
Using the CLI online help ············································································································································120
Typing commands························································································································································121
Editing command lines········································································································································121
Typing incomplete keywords······························································································································122
Configuring command aliases ···························································································································122
Configuring CLI hotkeys······································································································································123
Redisplaying input but not submitted commands·····························································································124
Checking command-line errors···································································································································125
Using command history···············································································································································125
Accessing history commands ·····························································································································125

iv
Configuring the history buffer size ····················································································································126
Controlling the CLI display··········································································································································126
Multi-screen display·············································································································································126
Filtering output information·································································································································127
Configuring user privilege and command levels ······································································································130
Introduction ··························································································································································130
Configuring a user privilege level ·····················································································································130
Switching user privilege level·····························································································································133
Modifying the level of a command ···················································································································134
Saving the current configuration ································································································································134
Displaying and maintaining CLI ·································································································································134
Support and other resources ·································································································································· 135
Contacting HP ······························································································································································135
Subscription service ············································································································································135
Related information······················································································································································135
Documents····························································································································································135
Websites·······························································································································································135
Conventions ··································································································································································136
Index ········································································································································································ 138

1
Overview
This documentation is applicable to the following HP high-end firewall products and software versions:
•Firewall chassis—A-F1000-E (R3166P13), and A-F5000 (R3206P14)
•Firewall modules—(R3166P13)
You can configure most of the firewall functions in the web interface and some functions in the command
line interface (CLI). Each function configuration guide specifies clearly whether the function is configured
in the web interface or CLI.
This chapter includes these sections:
•Product overview
•Application scenarios
Product overview
Firewall A-F1000-E
The HP A-F1000-E firewall (hereinafter referred as the A-F1000-E) is designed for large- and
medium-sized networks. It supports the following functions:
•Traditional firewall functions
•Virtual firewall, security zone, attack protection, URL filtering
•Application Specific Packet Filter (ASPF), which can monitor connection processes and user
operations and provide dynamic packet filtering together with ACLs.
•Multiple types of VPN services, such as IPsec VPN
•RIP/OSPF/BGP routing
•Power supply redundancy backup (AC+AC or DC+DC)
•Stateful failover (Active/Active and Active/Standby mode)
•Inside-chassis temperature detection
•Its own web-based management system
•Support for management by iMC
The A-F1000-E uses a multi-core processor and provides the following interfaces:
•Four combo interfaces, for fiber/copper port switching
•Two high-speed interface module (HIM) expansion slots, which support the following interface
modules: 4GBE, 8GBE, HIM-1EXP, and 4GBP.

2
Figure 1 Appearance of the A-F1000-E
Firewall A-F5000
The HP A-F5000 firewall (hereinafter referred to as the A-F5000) provides security protection for large
enterprises, carriers, and data centers. It adopts multi-core multi-threaded and ASIC processors to
construct a distributed architecture, which allows for the separation of the system management and
service processing, making it a firewall that has the highest, distributed security processing capability.
The A-F5000 supports the following functions and features:
•Protection against external attacks, internal network protection, traffic monitoring, email filtering,
web filtering, application layer filtering
•ASPF
•Multiple types of VPN services, such as L2TP VPN, GRE VPN, IPsec VPN, and dynamic VPN
•RIP/OSPF/BGP routing, routing policy, and policy-based routing
•Power supply 1+1 redundancy backup (AC+AC or DC+DC)
•Service interface cards are hot swappable.
•High availability functions, such as stateful failover and VRRP
Figure 2 Appearance of the A-F5000
HP firewall modules
The HP firewall modules are developed based on the Open Application Architecture (OAA) for
carrier-level customers.

3
A firewall module can be installed in the HP A5800/A7500/A9500/A12500 Switch Series or an
A6608/A8800 router. A switch or router can be installed with multiple firewall modules to expand the
firewall processing capability for future use. The main network device (switch or router) and the firewall
modules together provide highly integrated network and security functions for large networks.
The firewall modules support the following functions and features:
•Traditional firewall functions
•Virtual firewall, security zone, attack protection, URL filtering
•Application Specific Packet Filter (ASPF), which can monitor connection processes and user
operations and provide dynamic packet filtering together with ACLs.
•Multiple types of VPN services, such as IPsec VPN
•RIP/OSPF/BGP routing
A firewall module provides two GE ports and two GE combo interfaces. It is connected to the main
network device through the internal 10GE port. The HP main network device’s rear card has the
line-speed forwarding capability, ensuring fast data forwarding with the firewall module. The firewall
modules are equipped with dedicated, multi-core processors and high-speed caches. They can process
security services without impacting performances of the main network devices.
Figure 3 Firewall module for A5800 series switches
Figure 4 Firewall module for A7500/A9500/A12500 series switches

4
Figure 5 Firewall module for A6600/A8800 routers
Application scenarios
The A-F1000-E and A-F5000 have similar software functions.
The firewall modules also have similar software functions to the A-F1000-E. You can regard a firewall
module as an A-F1000-E firewall that is connected to the main network device through their 10 GE ports.
The difference lies in that the A-F1000-E firewall uses physical ports to forward data, and the firewall
module uses logical interfaces (subinterfaces and VLAN interfaces) of the 10 GE port to forward data.
The configuration on a firewall module is similar to that on an A-F1000-E firewall.
•Configurations for zone-based security functions, such as attack protection and object-oriented
ACLs, are the same on the two firewalls. The difference is that the A-F1000-E adds physical ports to
security zones, and the firewall module adds logical interfaces (subinterfaces and VLAN interfaces)
of the 10 GE port to security zones.
•Configurations for interface-based security functions are the same on the two firewalls. The
difference is that the A-F1000-E supports these functions on physical ports and the firewall module
support these functions on the logical interfaces of the 10 GE port.
For more information about the configuration differences, see the Layer 2 and Layer 3 forwarding
configurations in Network Management Configuration Guide.
A-F1000-E application
Deployed at the egress of an enterprise network, A-F1000-E firewalls can protect against external attacks,
ensure security access from the external network to the internal network resources (such as servers in the
DMZ zone) through NAT and VPN functions, and control access to the internal network by using security
zones. You can deploy two firewalls in the network for redundancy backup to avoid a single point failure.