Huawei NIP6000E User manual

Quick Start
HUAWEI NIP6000E V600R006
Issue: 02 (2018-10-30)
Part Number: 31500AAR

1
Thank you for using NIP6000E series intrusion prevention products. This Quick Start shows the product appearance and provides
the essential information required for installing the device and initial configuration. For detailed hardware description and instal-
lation guidelines, refer to the Hardware Guide. For detailed configurations, refer to the Configuration Guide.
Safety Precautions
•Deactivate power whenever possible before performing maintenance on power cables.
•Always wear a properly-grounded wrist strap before touching the device.
NIP6305E, NIP6310E, NIP6510E
PGND cablePower cable retention clip Quick startRack-mounting ears
Power receptacle
RST button
Protective ground terminal
Console port
SN
Rubber feet
GE electrical ports
Fan
System indicators
RST
CONMGM T
1
0
10G
1
0WAN
SSD
98 10 11 12 1 3 14 15 16 17
18 19
20 21
22 23 1 6 17 18 19 2 0 21
22 23
PWR
WAN
CLOUD
SYS
USB
HA
1
0
3
2
456 7
PWR2
PAC 60S12-R
PWR1
STAT
SM
MAC
FAN -
023A-B
GE combo ports 10GE optical ports
WAN ports
USB3.0 USB2.0
MAC:
xxxxxxxxxx
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
Out-of-band
management port
SSD disk slot
M4 screw
MAC Power cable clip hole
NIP6510E
AC power cable
NIP6550E
The power cable varies according to the delivery country.
WARNING
RST
PWR
WAN
CLOUD
SYS
USB
HA
WARNING
CONMGMT98 10 11
1
03
2456 7 98
3
2456 7 10 11
1
010G 1 040G
OFL HDD/SSD 1 2
SM
MAC
PWR2
PAC 60S12-R
STAT
FAN
023A-B
AIROUT
FAN
023A-B
AIROUT
FAN
023A-B
AIROUT
PDC350S12-B
PWR
AIR OUT
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
MAC:
xxxx xxxx xxxx
PAC 60S12-R
STAT
NIP6550E
PWR1
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
MAC:
xxxx xxxx xxxx
System indicators HDD/SSD disk slot
RST button OFL button
Console port
Out-of-band
management port
USB3.0
GE electrical ports 10GE optical ports
40GE optical ports
SN MAC
Protective ground terminal Power receptacle
Fan
PGND cablePower cable retention clip Quick startRack-mounting ears M4 screw
Power cable clip hole
AC power cable

2
NIP6610E
By default, 40GE optical interfaces 40GE0/0/2 and 40GE0/0/3 are unavailable. To use them, run the set device port-config-mode
40g-port enable command to enable them. However, after that, 10GE optical interfaces numbered XGE0/0/20 to XGE0/0/27
become unavailable.
NIP6620E
In the preceding figure, the NIP6620E AC model is used as an example. The NIP6620E AC and DC models differ only in the power
supply mode.
Four 40GE optical interfaces are provided by default. You can run the set device port-config-mode 100g-port enable command
to switch 40GE0/0/2 and 40GE0/0/3 to 100GE optical interfaces. After that, their interface numbers are changed to 100GE0/0/0
and 100GE0/0/1. When 100GE0/0/0 is used, 10GE optical interfaces numbered XGE0/0/16 to XGE0/0/19 are unavailable. When
100GE0/0/1 is used, 10GE optical interfaces numbered XGE0/0/12 to XGE0/0/15 are unavailable.
The power cable varies according to the delivery country.
WARNING
RST
PWR
WAN
CLOUD
SYS
USB
HA
WARNING
OFL HDD/SSD 1 2
23
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
MAC:
xxxx xxxx xxxx
PWR2
STATSTAT
NIP6610E
1-4
COM BO WITH 4 0G PORT 3 COM BO WITH 4 0G PORT 2
PWR1
System indicators HDD/SSD disk slot
RST button OFL button USB3.0
HA ports
Console port
Out-of-band
management port
10GE optical ports 40GE optical ports
Protective ground terminal
SN MAC
Power receptacle
Fan
PGND cable Quick startRack-mounting ears M4 screw AC power cable
WARNING
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
MAC:
xxxx xxxx xxxx
PWR2
STATSTAT
RST
PWR
WAN
CLOUD
SYS
USB
HA
WARNING
OFL HDD/SSD
1 2
23
NIP6620E
1-5
System indicators
RST button
HDD/SSD disk slot
OFL button
HA ports
USB3.0
Console port
Out-of-band
management port
10GE optical ports 40GE optical ports
SN MAC
Protective ground terminal Power receptacleFan
100GE optical ports
PGND cable Quick startRack-mounting ears M4 screw AC power cable

3
Connecting
Fixed Interface Pair
Before delivery, two service interfaces with adjacent interface numbers form a Layer 2 interface pair (excluding WAN interfaces of
the NIP6305E, NIP6310E, and NIP6510E).
The interface pair is used to connect upstream and downstream devices in the in-line deployment whereas any interface of the
interface pair can be used in the off-line deployment. The following figure shows an example of such an interface pair.
12
14 0
13 15 1 WAN1 3 5 7
2 4 6
11
8 100
19
WAN0
...
...
Connecting Cables
The preceding figure uses the NIP6510E as an example to describe cabling.
1. Connect cables based on the selected deployment mode.
﹣In-line deployment: Use the default interface pair to connect the upstream and downstream devices. The following uses the
GE0/0/6-GE0/0/7 interface pair as an example. The NIP is deployed in in-line mode to block intrusion traffic and protect the
intranet against attacks.
﹣Off-line deployment: Use an independent interface to connect to the observing port of the switch on the primary link and
receive mirrored traffic from the switch. GE0/0/1 is used as an example. The NIP is deployed in off-line mode to record
intrusion event logs without blocking traffic.
2. Connect the WAN interface (supported only by the NIP6305E, NIP6310E, and NIP6510E) or management interface to the
Internet to update the signature database.
Before delivery, only the management interface and WAN interface are Layer 3 interfaces. If interfaces excluding the
management and WAN interfaces are used to communicate with external devices, the interfaces must be switched to Layer 3
mode.
3. Connect the management PC to the management interface.
4. Connect the PGND cable and power cable. Then power on the device.
As device does not provide a power switch, it starts up immediately after receiving power. When the SYS indicator on the
panel is blinking (once every two seconds), the device is running and ready for configuration.
Administrator
In-line deployment,
protecting the server farm
GE0/0/6
GE0/0/7
RST
CONMGMT
1
010G 1 0WAN
SSD
98 10 11 12 13 1 4 15 16 1 7 18 19 20 2 1 22 23 1 6 17 18 19 2 0 21 22 2 3
PWR
WAN
CLOUD
SYS
USB
HA
1
03
2456 7
PWR2
PAC 60S12-R
PWR1
STAT
SM
MAC FAN-
023A-B
MEth0/0/0
AC power cable
GE0/0/1
Off-line deployment,
detecting network attacks
Update of the
signature databases
WAN0/0/1
MAC:
xxxxxxxxxx
SN:xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
NIP6510E

4
Default Configuration
The following table lists the default configuration.
Item Description
Management port The IP address is 192.168.0.1.
Administrator account/password You can use the default account/password (amin/Admin@123) to log in through web or
console.
Intrusion prevention policy The default intrusion prevention policy is applied to each interface.
Quick Configuration
1. Set the IP address to 192.168.0.2 (or any other in the range of 192.168.0.2 to 192.168.0.254) and subnet mask to 255.255.255.0
of the corresponding network interface on the administration PC.
2. Open a web browser and navigate to https://192.168.0.1:8443.
3. Enter the user name (admin) and password (Admin@123) in the login dialog box, and then click Login. You need to change the
user password as instructed after the first login.
4. Activate licenses.
The intrusion prevention and antivirus signature database upgrade services are controlled by licenses.
1）Find the license authorization certificate in the delivery accessories and obtain the activation password.
2）On the web UI, select Dashboard. On the System Information page, obtain the ESN in SN.
3）Access http://app.huawei.com/isdp to apply for a license file.
4）Choose System > License Management. Then load and activate the license file.
5. Choose Network > Interface. Configure an IP address for the interface to update the signature database.
If service interface in the interface pair is used to update the signature database, configure the interface to work in routing
mode.
6. (Optional) When the NIP needs to be deployed in off-line mode, split an interface pair and configure a single interface to work
in bypass mode.
Choose Network > Interface. Click one of the interfaces in the interface pair and configure the interface to work in bypass
mode.
7. Choose Policy > Security Policy. You can find that the default security policy is applied to the device and meet the
requirements of most intrusion prevention scenarios.
Multiple types of intrusion prevention policy templates are preconfigured on the NIP so that you can create a security policy
based on the required template. Upgrade the intrusion prevention and antivirus signature databases to the latest versions by
choosing System > Upgrade Center.

5
Appendix
·Open Source Software Notice
You can access the device web UI and click Open-Source Software Notice at the bottom of the UI to view details of the
open source software notice.
·Obtaining Product Documents and Technical Support
•Log in to http://support.huawei.com/enterprise and select a specific product model and version to find its documentation.
•Log in to http://forum.huawei.com/enterprise and post your questions in the community.
•Contact your local representative for further information.
The contact information is available at http://e.huawei.com/en/service-hotline.
Huawei Enterprise
Technical Support
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Copyright © Huawei Technologies Co., Ltd. 2018. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of
Huawei Technologies Co., Ltd.
Supplier’s Declaration of Conformity (SDoC)
Unique Identifier: trade name: HUAWEI; product name: IPS; model number: NIP6000E
Responsible Party- U.S. Contact Information
Huawei Technologies USA Inc.
5700 Tennyson Parkway, Suite 500
Plano, Texas 75024
Main: 214-919-6000 / TAC Hotline: [phone]
FCC Compliance Statement ( for products subject to Part 15)
This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and (2) this device must accept any interference
received, including interference that may cause undesired operation.