Nokia IP2255 - Security Appliance User manual

Part No. N450000275 Rev 002
Published March 2007
Nokia IP2255 Security
Platform Installation Guide

2 Nokia IP2255 Security Platform Installation Guide
COPYRIGHT
©2007 Nokia. All rights reserved.
Rights reserved under the copyright laws of the United States.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the United States Government is subject to restrictions as set
forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of,
this computer software, the rights of the United States Government regarding its use,
reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted
Rights clause at FAR 52.227-19.
IMPORTANT NOTE TO USERS
This software and hardware is provided by Nokia Inc. as is and any express or implied
warranties, including, but not limited to, implied warranties of merchantability and fitness for a
particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or
suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential
damages (including, but not limited to, procurement of substitute goods or services; loss of use,
data, or profits; or business interruption) however caused and on any theory of liability, whether in
contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use
of this software, even if advised of the possibility of such damage.
Nokia reserves the right to make changes without further notice to any products herein.
TRADEMARKS
Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document
are trademarks or registered trademarks of their respective holders.
070101

Nokia IP2255 Security Platform Installation Guide 3
Nokia Contact Information
Corporate Headquarters
Regional Contact Information
Nokia Customer Support
Web Site http://www.nokia.com
Telephone [phone]
or
1-650-625-2000
Fax [phone]
Mail
Address
Nokia Inc.
313 Fairchild Drive
Mountain View, California
94043-2215 USA
Americas Nokia Inc.
313 Fairchild Drive
Mountain View, CA 94043-2215
USA
Tel: [phone]
Outside USA and Canada: [phone]
email: info.ipnetworking_america[email protected]
Europe,
Middle East,
and Africa
Nokia House, Summit Avenue
Southwood, Farnborough
Hampshire GU14 ONG UK
Tel: UK: [phone]
Tel: France: [phone]
email: [e-mail]
Asia-Pacific 438B Alexandra Road
#07-00 Alexandra Technopark
Singapore 119968
Tel: [phone]
email: [email protected]
Web Site: https://support.nokia.com/
Email: [email protected]
Americas Europe
Voice: 1-888-361-5030 or
1-613-271-6721
Voice: [phone]
Fax: [phone] Fax: [phone]
Asia-Pacific
Voice: [phone]
Fax: [phone]
050602

4 Nokia IP2255 Security Platform Installation Guide

Nokia IP2255 Security Platform Installation Guide 5
Contents
About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
In this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Conventions this Guide Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
About the Nokia IP2255 Security Platform . . . . . . . . . . . . . . . . . . . 19
Managing the Nokia IP2255 Appliance . . . . . . . . . . . . . . . . . . . . . 20
Nokia IP2255 Appliance Overview. . . . . . . . . . . . . . . . . . . . . . . . . 21
Ethernet Management Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Nokia Network Interface Cards . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Console Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
System Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Fan Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Storage Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Power Supplies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Product Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Site Requirements, Warnings, and Cautions . . . . . . . . . . . . . . . . . 33
Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
2 Installing Nokia IP2255 Appliances . . . . . . . . . . . . . . . . . . . . . . 37
Rack Mounting the Security Platform . . . . . . . . . . . . . . . . . . . . . . . 37
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

6 Nokia IP2255 Security Platform Installation Guide
3 Performing the Initial Configuration . . . . . . . . . . . . . . . . . . . . . 45
Using a Console Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Connecting Power and Turning the Power On. . . . . . . . . . . . . . . . 47
Performing the Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . 50
Connecting Network Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Using Nokia Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Viewing Nokia IPSO Documentation by Using
Nokia Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Using the Command-Line Interface . . . . . . . . . . . . . . . . . . . . . . . . 55
Using Nokia Horizon Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
4 Connecting to the Network Interface Cards . . . . . . . . . . . . . . . 59
Eight-Port 10/100 Ethernet NIC . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
10/100 Ethernet NIC Features . . . . . . . . . . . . . . . . . . . . . . . . . . 60
10/100 Ethernet NIC Connectors and Cables. . . . . . . . . . . . . . . 61
Two-Port and Four-Port Copper Gigabit Ethernet NIC . . . . . . . . . 64
Copper Gigabit Ethernet NIC Features . . . . . . . . . . . . . . . . . . . . 64
Copper Gigabit Ethernet NIC Connectors and Cables . . . . . . . . 65
Two-Port and Four-Port Fiber-Optic Gigabit Ethernet NIC . . . . . . 67
Fiber-Optic Gigabit Ethernet NIC Features . . . . . . . . . . . . . . . . . 67
Fiber-Optic Gigabit Ethernet NIC Connectors and Cables . . . . . 68
Single-Port Fiber-Optic 10 Gigabit Ethernet NIC . . . . . . . . . . . . . . 69
Fiber-Optic 10 Gigabit Ethernet NIC Features . . . . . . . . . . . . . . 69
Fiber-Optic 10 Gigabit Ethernet NIC Connectors and Cables. . . 70
5 Installing, Replacing, and Configuring the
Nokia Encryption Accelerator Card . . . . . . . . . . . . . . . . . . . . . . 73
Removing, Installing, and Replacing the Nokia Encryption Accelerator
Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Before you Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Configuring and Activating Encryption Acceleration . . . . . . . . . . . 78

Nokia IP2255 Security Platform Installation Guide 7
6 Installing and Replacing Network Interface Cards . . . . . . . . . . 79
Removing, Installing, and Replacing NICs . . . . . . . . . . . . . . . . . . . 80
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Configuring and Activating Interfaces. . . . . . . . . . . . . . . . . . . . . . . 84
Monitoring NICs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
7 Installing and Replacing Other Components . . . . . . . . . . . . . . 85
Replacing the Compact-Flash Memory Card . . . . . . . . . . . . . . . . . 86
Replacing the Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Replacing the Fan Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Replacing a Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Replacing the Management NIC . . . . . . . . . . . . . . . . . . . . . . . . . 100
8 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
General Troubleshooting Information. . . . . . . . . . . . . . . . . . . . . . 105
A Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Space Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
B Compliance Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Declaration of Conformity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Compliance Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
FCC Notice (US) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

8 Nokia IP2255 Security Platform Installation Guide

Nokia IP2255 Security Platform Installation Guide 9
Tables
Table 1 Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Table 2 NICs Available for the Network Interface Card Slots . . . 25
Table 3 System Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Table 4 Power Supply Status LEDs . . . . . . . . . . . . . . . . . . . . . . 32

10 Nokia IP2255 Security Platform Installation Guide

Nokia IP2255 Security Platform Installation Guide 11
Figures
Figure 1 Component Locations Front View . . . . . . . . . . . . . . . . . 22
Figure 2 Dual Power Supplies Location Rear View . . . . . . . . . . . 23
Figure 3 Ethernet Management Port Details . . . . . . . . . . . . . . . . 24
Figure 4 Slot Numbers for Network Interface Cards . . . . . . . . . . 25
Figure 5 Pin Assignments for Console Connection . . . . . . . . . . . 27
Figure 6 Pin Assignments for Modem Connection . . . . . . . . . . . 28
Figure 7 System Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 8 Power Supply LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 9 Rack-Mounting Screw Locations . . . . . . . . . . . . . . . . . . 38
Figure 10 Power Switch Location (Rear View) . . . . . . . . . . . . . . 48
Figure 11 Nokia Network Voyager Reference Access Points . . . 55
Figure 12 Eight-Port Ethernet NIC Front Panel Details . . . . . . . . 61
Figure 13 Output Connector for the Ethernet Cable . . . . . . . . . . 62
Figure 14 Ethernet Crossover-Cable Pin Connections . . . . . . . . 63
Figure 15 Gigabit Ethernet Crossover Cable Pin Connections . . 63
Figure 16 Two-Port Copper Gigabit Ethernet NIC Front Panel
Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 17 Four-Port Copper Gigabit Ethernet NIC Front Panel
Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 18 Gigabit Ethernet Crossover-Cable Pin Connections . . 66
Figure 19 Two-Port Fiber-Optic Gigabit Ethernet NIC Front Panel
Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

12 Nokia IP2255 Security Platform Installation Guide
Figure 20 Four-Port Fiber-Optic Gigabit Ethernet NIC Front Panel
Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 21 ADP Single-Port 10 Gigabit Ethernet NIC . . . . . . . . . . 70
Figure 22 Location of Compact-Flash Memory Card . . . . . . . . . 87
Figure 23 DIMM Socket Locations . . . . . . . . . . . . . . . . . . . . . . . 92

Nokia IP2255 Security Platform Installation Guide 13
About this Guide
This manual is written for network administrators. It provides information for
the installation and use of the Nokia IP2255 Security Platform. Installation
and maintenance should be performed by experienced technicians or
Nokia-approved service providers only.
This preface provides the following information:
In this Guide
Conventions this Guide Uses
Related Documentation
In this Guide
This guide is organized into the following chapters and appendixes:
Chapter 1, “Overview” presents a general overview of the IP2255
security platform.
Chapter 2, “Installing Nokia IP2255 Appliances” describes how to rack
mount the appliance.
Chapter 3, “Performing the Initial Configuration” describes how to
connect the power and make the appliance available on the network.
Chapter 4, “Connecting to the Network Interface Cards” describes how to
connect to and use each of the supported NICs.

14 Nokia IP2255 Security Platform Installation Guide
Chapter 6, “Installing and Replacing Network Interface Cards” describes
how to install, monitor, and replace supported network interface cards.
Chapter 5, “Installing, Replacing, and Configuring the Nokia Encryption
Accelerator Card” describes how to install and replace the Nokia
encryption accelerator card and how to configure software to use the
Nokia encryption accelerator card.
Chapter 7, “Installing and Replacing Other Components” describes how
to install or replace the compact-flash memory card, DIMMs, the fan tray
unit, power supplies, and the Ethernet management ports.
Chapter 8, “Troubleshooting” describes problems you might encounter
and proposes solutions to these problems.
Appendix A, “Technical Specifications” provides physical technical
specifications.
Appendix B, “Compliance Information” provides compliance and
regulatory information.
Conventions this Guide Uses
The following sections describe the conventions this guide uses, including
notices, text conventions, and command-line conventions.
Notices
Warning
Warnings advise the user that either bodily injury might occur because of
a physical hazard, or that damage to a structure, such as a room or
equipment closet, might occur because of equipment damage.

Conventions this Guide Uses
Nokia IP2255 Security Platform Installation Guide 15
Caution
Cautions indicate potential equipment damage, equipment
malfunction, loss of performance, loss of data, or interruption of
service.
Note
Notes provide information of special interest or recommendations.
Text Conventions
Table 1 describes the text conventions this guide uses.
Table 1 Text Conventions
Convention Description
monospace font Indicates command syntax, or represents computer or screen output,
for example:
Log error 12453
bold monospace font Indicates text you enter or type, for example:
# ifconfig -a
Key names Keys that you press simultaneously are linked by a plus sign (+):
Press Ctrl + Alt + Del.
Menu commands Menu commands are separated by a greater than sign (>):
Choose File > Open.

16 Nokia IP2255 Security Platform Installation Guide
Related Documentation
You can find this guide in PDF on the Nokia support Web site (https://
support.nokia.com/) and on the Nokia IPSO operating system CD-ROM
issued with your Nokia IP2255 security platform.
In addition to this guide and other documents shipped with your appliance,
documentation for this product includes the following:
Nokia Network Voyager Reference Guide for the version of Nokia IPSO
you are using
CLI Reference Guide for the version of Nokia IPSO you are using
Getting Started Guide and Release Notes for the version of Nokia IPSO
you are using
Nokia IPSO Boot Manager Reference Guide, which describes how to use
the Nokia IPSO boot manager
Clustering Configuration Guide for the version of Nokia IPSO you are
using
Nokia Network Voyager inline help
You can find the most up-to date version of the Nokia IP2255 Security
Platform Installation Guide in PDF on the Nokia support site (https://
The words enter and type Enter indicates that you type something and then press the Return or
Enter key.
Do not press the Return or Enter key when an instruction says
type .
Italics
•Emphasizes a point or denotes new terms at the place where they
are defined in the text.
•Indicates an external book title reference.
•Indicates a variable in a command:
ls device directory
Table 1 Text Conventions
Convention Description

Related Documentation
Nokia IP2255 Security Platform Installation Guide 17
support.nokia.com). You can access inline help, the Nokia Network Voyager
Reference Guide, and the CLI Reference Guide from Nokia Network Voyager.
Check Point documentation is available from the Check Point Web site at:
http://www.checkpoint.com/

18 Nokia IP2255 Security Platform Installation Guide

Nokia IP2255 Security Platform Installation Guide 19
1Overview
This chapter provides an overview of the Nokia IP2255 appliance and the
requirements for its use. The following topics are covered:
About the Nokia IP2255 Security Platform
Managing the Nokia IP2255 Appliance
Nokia IP2255 Appliance Overview
Product Disposal
Site Requirements, Warnings, and Cautions
Software Requirements
About the Nokia IP2255 Security Platform
The Nokia IP2255 appliance combines the power of Nokia IPSO software
with Check Point VPN-1 enterprise applications.
Nokia IP2255 appliances are ideally suited to handle small packet sizes, short-
lived sessions and short-lived connections, and to provide secure Internet
connectivity.
The Nokia IP2255 appliances use accelerated data path (ADP) technology to
deliver gigabit firewall and VPN forwarding performance when running
Check Point VPN-1 enterprise applications. The ADP technology also allows
the Nokia operating system and Check Point VPN-1 enterprise applications to
accelerate other data link, network, and transport layer functions.

1Overview
20 Nokia IP2255 Security Platform Installation Guide
Additionally, the Nokia IP2255 appliances support an encryption accelerator
card to further enhance VPN performance.
Nokia IP2255 is a three-rack unit (3U) appliance that incorporates a
serviceable slide-out tray into the chassis design. Nokia IP2255 appliances are
designed to meet high-end availability requirements and they have port
density for connections to redundant internal, external, DMZ, and
management networks.
As network devices, Nokia IP2255 appliances support a comprehensive suite
of IP-routing functions and protocols, including RIPv1/RIPv2, IGRP, OSPF
and BGP4 for unicast traffic, and DVMRP for multicast traffic. The integrated
router functionality eliminates the need for separate intranet and access
routers in security applications.
Managing the Nokia IP2255 Appliance
You can manage the Nokia IP2255 appliance by using one of the following
interfaces:
Nokia Network Voyager—an SSL-secured, Web-based element
management interface to Nokia IP Security Platforms. Network Voyager
is preinstalled on the IP2255 appliance and enabled through the IPSO
operating system. With Network Voyager, you can manage, monitor, and
configure the appliances from any authorized location within the network
by using a standard Web browser.
For information about how to access Network Voyager and the related
reference materials, see “Using Nokia Network Voyager” on page 53.
The Nokia IPSO command-line interface (CLI)—an SSHv2-secured
interface that enables you to easily configure Nokia IP Security Platforms
from the command line. Everything that you can accomplish with
Network Voyager—manage, monitor, and configure the your appliance—
you can also do with the CLI.
For information about how to access the CLI, see “Using the Command-
Line Interface” on page 55.