Nokia IP300 Series User manual

IP300 Series
Security Platform
Installation Guide
Part No. N450312006 Rev A
Published September 2005
All manuals and user guides at all-guides.com
all-guides.com

2 Nokia IP300 Series Security Platform Installation Guide
COPYRIGHT
©2005 Nokia. All rights reserved.
Rights reserved under the copyright laws of the United States.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the United States Government is subject to restrictions as set
forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of,
this computer software, the rights of the United States Government regarding its use,
reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted
Rights clause at FAR 52.227-19.
IMPORTANT NOTE TO USERS
This software and hardware is provided by Nokia Inc. as is and any express or implied
warranties, including, but not limited to, implied warranties of merchantability and fitness for a
particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or
suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential
damages (including, but not limited to, procurement of substitute goods or services; loss of use,
data, or profits; or business interruption) however caused and on any theory of liability, whether in
contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use
of this software, even if advised of the possibility of such damage.
Nokia reserves the right to make changes without further notice to any products herein.
TRADEMARKS
Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document
are trademarks or registered trademarks of their respective holders.
050110
All manuals and user guides at all-guides.com

Nokia IP300 Series Security Platform Installation Guide 3
Nokia Contact Information
Corporate Headquarters
Regional Contact Information
Nokia Customer Support
Web Site http://www.nokia.com
Telephone [phone] or
1-650-625-2000
Fax [phone]
Mail
Address Nokia Inc. 313 Fairchild Drive
Mountain View, California
94043-2215 USA
Americas Nokia Inc.
313 Fairchild Drive
Mountain View, CA 94043-2215
USA
Tel: [phone]
Outside USA and Canada: [phone]
email: info.ipnetworking_am[email protected]
Europe,
Middle East,
and Africa
Nokia House, Summit Avenue
Southwood, Farnborough
Hampshire GU14 ONG UK
Tel: UK: [phone]
Tel: France: [phone]
email: [e-mail]
Asia-Pacific 438B Alexandra Road
#07-00 Alexandra Technopark
Singapore 119968
Tel: [phone]
email: [e-mail]
Web Site: https://support.nokia.com/
Email: [e-mail]
Americas Europe
Voice: 1-888-361-5030 or
1-613-271-6721 Voice: [phone]
Fax: [phone] Fax: [phone]
Asia-Pacific
Voice: [phone]
Fax: [phone]
050602
All manuals and user guides at all-guides.com

4 Nokia IP300 Series Security Platform Installation Guide
All manuals and user guides at all-guides.com

Nokia IP300 Series Security Platform Installation Guide 5
Contents
About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
In this Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Conventions this Guide Uses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Command-Line Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
About the Nokia IP300 Series Disk-Based Appliance . . . . . . . . . . 10
About the Nokia IP300 Series Flash-Based Appliance . . . . . . . . . 11
Managing the IP300 Series Appliance. . . . . . . . . . . . . . . . . . . . . . 12
About the IP300 Series Appliance . . . . . . . . . . . . . . . . . . . . . . . . . 13
Ethernet Management Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Built-in Console Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Built-in AUX Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Site Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Product Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2 Installing the Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Rack Mounting the Appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Connecting Power and Turning the Power on . . . . . . . . . . . . . . . . 25
Connecting Network Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
All manuals and user guides at all-guides.com

6 Nokia IP300 Series Security Platform Installation Guide
3 Performing the Initial Configuration . . . . . . . . . . . . . . . . . . . . . 27
Using a Console Connection to Perform the Initial Configuration . 28
Accessing Nokia Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . 30
Accessing Network Voyager Reference Information. . . . . . . . . . 31
Using Network Voyager to Monitor an IP300 Series Appliance . 32
Using Nokia Horizon Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4 Installing and Replacing Network Interface Cards . . . . . . . . . 35
Deactivating Configured Interfaces . . . . . . . . . . . . . . . . . . . . . . . . 36
Removing, Installing, and Replacing NICs. . . . . . . . . . . . . . . . . . . 36
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configuring and Activating Interfaces . . . . . . . . . . . . . . . . . . . . . . 43
Monitoring Network Interface Cards. . . . . . . . . . . . . . . . . . . . . . . . 43
5 Connecting PMC Network Interface Cards . . . . . . . . . . . . . . . . 45
Four-Port and Two-Port 10/100 Mbps Ethernet Interface, PMC . . 46
Ethernet PMC NIC Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Connectors and Cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Two-Port V2 Gigabit Ethernet Card, PMC, Copper . . . . . . . . . . . . 49
Connectors and Cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Two-Port Gigabit Ethernet Card, PMC, Fiber. . . . . . . . . . . . . . . . . 52
Connectors and Cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
6 Installing and Replacing Other Components . . . . . . . . . . . . . . 55
Installing a PCMCIA Modem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Replacing a Hard-Disk Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Replacing or Upgrading Memory . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Adding or Replacing DIMMs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Installing an Encryption Accelerator Card . . . . . . . . . . . . . . . . . . . 67
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
All manuals and user guides at all-guides.com
all-guides.com

Nokia IP300 Series Security Platform Installation Guide 7
Installing the Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Configuring Software to Use Hardware Acceleration . . . . . . . . . 72
Replacing the Battery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Before You Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
7 Installing PC Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Installing a Flash-Memory PC Card . . . . . . . . . . . . . . . . . . . . . . 78
Storing System Logs on the Flash-Memory PC Card . . . . . . . . . 78
Transferring Files with the Flash-Memory PC Card . . . . . . . . . . 79
8 Using the Boot Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Viewing the Variables and Other System Parameters . . . . . . . . 84
Setting the Variables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Other Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Booting the System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Using the Boot Manager to Install IPSO. . . . . . . . . . . . . . . . . . . . . 89
Protecting the Boot Manager with a Password . . . . . . . . . . . . . . . 90
Installing the Boot Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Upgrading the Boot Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
9 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
General Troubleshooting Information. . . . . . . . . . . . . . . . . . . . . . . 95
Troubleshooting Routing Problems . . . . . . . . . . . . . . . . . . . . . . . 105
A Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Physical Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Space Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
NIC Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
All manuals and user guides at all-guides.com

8 Nokia IP300 Series Security Platform Installation Guide
B Compliance Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Declaration of Conformity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Compliance Statements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
FCC Notice (US) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
All manuals and user guides at all-guides.com

Nokia IP300 Series Security Platform Installation Guide 1
Figures
Figure 1 Component Locations Front View . . . . . . . . . . . . . . . . . 13
Figure 2 Component Locations Rear View . . . . . . . . . . . . . . . . . 14
Figure 3 Ethernet Management Ports Details . . . . . . . . . . . . . . . 14
Figure 4 Pin Assignments for Console Connection . . . . . . . . . . . 16
Figure 5 Pin Assignments for Modem Connection . . . . . . . . . . . 17
Figure 6 Appliance Status LEDs . . . . . . . . . . . . . . . . . . . . . . . . . 18
Figure 7 Mounting Screws Location . . . . . . . . . . . . . . . . . . . . . . 24
Figure 8 Adjustable Mounting Brackets . . . . . . . . . . . . . . . . . . . . 24
Figure 9 Back Panel Power Switch . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 10 Network Voyager Reference Access Points . . . . . . . . 31
Figure 11 Four-Port Ethernet NIC Front Panel Details . . . . . . . . 46
Figure 12 Two-Port Ethernet NIC Front Panel Details . . . . . . . . 47
Figure 13 Output Connector for the Ethernet Cable . . . . . . . . . . 48
Figure 14 Ethernet Crossover-Cable Pin Connections . . . . . . . . 49
Figure 15 Two-Port V2 Gigabit Ethernet NIC, Copper . . . . . . . . 50
Figure 16 Ethernet Cable Connector Output Pin Assignments . . 51
Figure 17 Gigabit Ethernet Crossover Cable Pin Connections . . 52
Figure 18 10/100 Ethernet Crossover Cable Pin Connections . . 52
Figure 19 Two-Port Gigabit Ethernet NIC, Fiber . . . . . . . . . . . . . 53
Figure 20 Hard-Disk Drive Location . . . . . . . . . . . . . . . . . . . . . . 58
Figure 21 DIMM Socket Locations . . . . . . . . . . . . . . . . . . . . . . . 63
Figure 22 Battery Location in the Nokia IP300 Series Appliance 75
All manuals and user guides at all-guides.com

2 Nokia IP300 Series Security Platform Installation Guide
All manuals and user guides at all-guides.com

Nokia IP300 Series Security Platform Installation Guide 3
About this Guide
This guide describes how to install and use the Nokia IP300 Series security
platforms—Nokia IP350, Nokia IP355, Nokia IP380, and Nokia IP385.
Installation and maintenance should be performed by experienced technicians
or Nokia-approved service providers only.
This preface provides the following information:
In this Guide
Conventions t his Guide Uses
Related Documentation
In this Guide
This guide is organized into the following chapters and appendixes:
Chapter 1, “Overview” presents a general overview of the IP300 Series
appliance.
Chapter 2, “Installing the Appliance” describes how to rack-mount the
appliance and how to physically connect it to a network and power.
Chapter 3, “Performing the Initial Configuration” describes how to make
the appliance available on the network.
Chapter 4, “Installing and Replacing Network Interface Cards” describes
how to install, monitor, and replace network interface cards (NICs).
All manuals and user guides at all-guides.com
all-guides.com

4 Nokia IP300 Series Security Platform Installation Guide
Chapter 5, “Connecting PMC Network Interface Cards” describes how to
connect to and use each of the supported NICs.
Chapter 6, “Installing and Replacing Other Components” describes how
to install or replace PCMCIA modems, memory, the hard-disk drive, an
encryption accelerator card, and the battery.
Chapter 7, “Installing PC Cards” describes how to install the flash-
memory PC cards.
Chapter 8, “Using the Boot Manager” describes how to use the Nokia
IPSO boot manager.
Chapter 9, “Troubleshooting” discusses problems you might encounter
and proposes solutions to these problems.
Appendix A, “Technical Specifications” gives technical specifications
such as interface characteristics.
Appendix B, “Compliance Information” includes compliance and
regulatory information.
Conventions this Guide Uses
The following sections describe the conventions this guide uses, including
notices, text conventions, and command-line conventions.
Notices
Warning
Warnings advise the user that bodily injury might occur because of a
physical hazard.
All manuals and user guides at all-guides.com

Conventions t his Guide Uses
Nokia IP300 Series Security Platform Installation Guide 5
Caution
Cautions indicate potential equipment damage, equipment
malfunction, loss of performance, loss of data, or interruption of
service.
Note
Notes provide information of special interest or recommendations.
Command-Line Conventions
This section defines the elements of commands that are available in Nokia
Network Security Solutions products. You might encounter one or more of the
following elements on a command-line path.
Table 1 Command-Line Conventions
Convention Description
command This required element is usually the product name or other
short word that invokes the product or calls the compiler or
preprocessor script for a compiled Nokia product. It might
appear alone or precede one or more options. You must
spell a command exactly as shown and use lowercase
letters.
Italics Indicates a variable in a command that you must supply. For
example:
delete interface if_name
Supply an interface name in place of the variable. For
example:
delete interface nic1
All manuals and user guides at all-guides.com

6 Nokia IP300 Series Security Platform Installation Guide
angle brackets < > Indicates arguments for which you must supply a value:
retry-limit <1–100>
Supply a value. For example:
retry-limit 60
Square brackets [ ] Indicates optional arguments.
delete [slot slot_num]
For example:
delete slot 3
-flag A flag is usually an abbreviation for a function, menu, or
option name, or for a compiler or preprocessor argument.
You must enter a flag exactly as shown, including the
preceding hyphen.
.ext A filename extension, such as .ext, might follow a variable
that represents a filename. Type this extension exactly as
shown, immediately after the name of the file. The extension
might be optional in certain products.
( . , ; + * - / ) Punctuation and mathematical notations are literal symbols
that you must enter exactly as shown.
' ' Single quotation marks are literal symbols that you must
enter as shown.
Table 1 Command-Line Conventions (continued)
Convention Description
All manuals and user guides at all-guides.com

Conventions t his Guide Uses
Nokia IP300 Series Security Platform Installation Guide 7
Text Conventions
Table 2 describes the text conventions this guide uses.
Table 2 Text Conventions
Convention Description
monospace font Indicates command syntax, or represents computer
or screen output, for example:
Log error 12453
bold monospace font Indicates text you enter or type, for example:
# configure nat
Key names Keys that you press simultaneously are linked by a
plus sign (+):
Press Ctrl + Alt + Del.
Menu commands Menu commands are separated by a greater than
sign (>):
Choose File > Open.
The words enter and type Enter indicates you type something and then press
the Return or Enter key.
Do not press the Return or Enter key when an
instruction says type.
Italics •Emphasizes a point or denotes new terms at the
place where they are defined in the text.
•Indicates an external book title reference.
•Indicates a variable in a command:
delete interface if_name
All manuals and user guides at all-guides.com

8 Nokia IP300 Series Security Platform Installation Guide
Related Documentation
The documentation set for the Nokia IP300 Series security platform consists
of:
Getting Started Guide and Release Notes for the version of Nokia IPSO
you are using
Nokia IP300 Series Security Platform Installation Guide (this document)
Nokia Network Voyager inline help feature, and Nokia Network Voyager
Reference Guide (online)
CLI Reference Guide for the version of Nokia IPSO you are using
You can find the Nokia IP300 Series Security Platform Installation Guide in
PDF on the Nokia support site (https://support.nokia.com). You can access
inline help and the Nokia Network Voyager Reference Guide from Nokia
Network Voyager.
All manuals and user guides at all-guides.com
all-guides.com

Nokia IP300 Series Security Platform Installation Guide 9
1Overview
This guide describes the installation and use of the Nokia IP300 Series
appliances–the IP350 and IP380 disk-based appliances and the IP355 and
IP385 flash-based appliances. Most of the information for how to use these
appliances is the same. Where differences exist between different IP300
platforms, they are noted in the documentation.
The Nokia IP300 Series appliance combines the power of Nokia IPSO
software with your choice of firewall, VPN, and intrusion detection security
applications. These appliances are ideally suited for growing companies and
satellite offices that want high-performance IP routing combined with the
industry-leading Check Point VPN-1/FireWall-1 enterprise security suite. The
small size of the IP300 Series appliance makes them ideal for installations
that need to conserve space.
As network devices, these appliances support a comprehensive suite of IP-
routing functions and protocols, including RIPv1/RIPv2, IGRP, OSPF and
BGP4 for unicast traffic, and DVMRP for multicast traffic. The integrated
router functionality eliminates the need for separate intranet and access
routers in security applications.
This chapter provides an overview of the IP300 Series appliance and the
requirements for using it. The following topics are covered:
About the Nokia IP300 Series Disk-Based Appliance
About the Nokia IP300 Series Flash-Based Appliance
Managing the IP300 Series Appliance
About the IP300 Series Appliance
All manuals and user guides at all-guides.com

1Overview
10 Nokia IP300 Series Security Platform Installation Guide
Site Requirements
Product Disposal
Software Requirements
About the Nokia IP300 Series Disk-Based
Appliance
Both the IP350 and the IP380 share the same one-rack unit (1 RU) size and
support the same selection of network interface cards. The IP350 appliance
supports a minimum memory configuration of 256 MB, and a maximum
memory configuration of 512 MB. The IP380 appliance supports a minimum
memory configuration of 256 MB, and a maximum memory configuration of
1 GB.
The Nokia IP300 Series appliance provides built-in hardware-based
encryption acceleration. The IP380 appliance also supports an optional
encryption accelerator card to further enhance VPN performance.
Table 3 Specifications for IP300 Series Disk-Based Appliances
Feature Nokia IP350 Nokia IP380
Maximum memory size 512 MB 1 GB
Optional encryption
accelerator card No Yes
Line cards •2 two-port 10/100 NICs
•1 four-port 10/100 NIC
•2 two-port V2 Copper
Gigabit Ethernet NICs
•2 two-port Fiber
Gigabit Ethernet NICs
•2 two-port 10/100 NICs
•1 four-port 10/100 NIC
•2 two-port V2 Copper
Gigabit Ethernet NICs
•2 two-port Fiber
Gigabit Ethernet NICs
All manuals and user guides at all-guides.com

About the Nokia IP300 Series Flash-Based Appliance
Nokia IP300 Series Security Platform Installation Guide 11
About the Nokia IP300 Series Flash-Based
Appliance
Both the IP355 and the IP385 share the same one-rack unit (1 RU) size. The
Nokia IP355 and IP385 flash-based appliances support the same cards as
IP350 and IP380 appliances. Both flash-based appliances have a maximum
memory size of 1GB.
Nokia IPSO version 3.9 3.9
Check Point
(Enforcement Module
support only)
Check Point NGX R60 Check Point NGX R60
Table 3 Specifications for IP300 Series Disk-Based Appliances
Feature Nokia IP350 Nokia IP380
Table 4 Specifications for IP300 Series Flash-Based Appliances
Feature Nokia IP355 Nokia IP385
Maximum memory size 1 GB 1 GB
Compact Flash 512 MB 512 MB
Optional PC card flash
for logging (PCMCIA slot) 1 GB 1 GB
Optional encryption
accelerator card No Yes
All manuals and user guides at all-guides.com

1Overview
12 Nokia IP300 Series Security Platform Installation Guide
Managing the IP300 Series Appliance
You can manage the IP300 Series appliance by using one of the following
interfaces:
Nokia Network Voyager—an SSL-secured, Web-based element
management interface to Nokia IP security platforms. Network Voyager is
preinstalled on the IP300 Series appliance and enabled through the IPSO
operating system. With Network Voyager, you can manage, monitor, and
configure the IP300 Series appliance from any authorized location within
the network by using a standard Web browser.
For information about how to access Network Voyager and the related
reference materials, see “Accessing Nokia Network Voyager” on page 30.
The IPSO command-line interface (CLI)—an SSHv2-secured interface
that enables you to easily configure Nokia IP security platforms from the
command line. Everything that you can accomplish with Network
Voyager—manage, monitor, and configure the IP300 Series appliance—
you can also accomplish with the CLI.
Line cards •2 two-port 10/100 NICs
•1 four-port 10/100 NIC
•2 two-port V2 Copper
Gigabit Ethernet NICs
•1 two-port Fiber
Gigabit Ethernet NICs
•2 two-port 10/100 NICs
•1 four-port 10/100 NIC
•2 two-port V2 Copper
Gigabit Ethernet NICs
•1 two-port Fiber
Gigabit Ethernet NICs
Optional disk No No
Nokia IPSO version 3.9 3.9
Check Point
(Enforcement Module
support only)
Check Point NGX R60 Check Point NGX R60
Table 4 Specifications for IP300 Series Flash-Based Appliances
Feature Nokia IP355 Nokia IP385
All manuals and user guides at all-guides.com