ProfiTap F1-10G-BP BYPASS TAP Manual

F1-10G-BP BYPASS TAP
INSTALLATION AND CONFIGURATION MANUAL
www.profitap.com

BRINGING CLARITY INTO NETWORKS.
ANYTIME. ANYWHERE.

For any questions, technical or otherwise, please contact our
customer support through our website:
www.profitap.com
or by email:
[e-mail]
For the latest documentation and software, visit our Resource
Center:
http://www.profitap.com/resource-center/

TABLE OF CONTENTS
Installation
1. Unpacking & Installation
1.1 Unpacking
1.2 Installation
2. Product Overview
2.1 Technical and Electrical Specifications
2.2 Front View
2.3 Rear View
2.4 LED Functionality
3. Connecting Power and Start-Up
4. Accessing the F1-10G-BP Bypass Tap
Configuration
1. Web Administration
1.1 Device Status
1.2 Port Management
1.3 Global Statistics
1.4 Bypass Settings
1.5 Administration
1.6 Logs
2. CLI Administration
Operation Use Cases
Legal
1
1
1
1
2
4
5
5
6
6
7
8
8
8
9
9
10
12
13
13
17
22

1
INSTALLATION
. UNPACKING & INSTALLATION
1.1 Unpacking
Carefully unpack all the items supplied with the F1-10G-BP and retain
the packaging for later use:
◉1 x F1-10G-BP main unit
◉2 x 12V 1.5A Power supply
◉1 x DB9 to RJ45 Console cable
▶Note: Please contact the supplier if any part is missing or damaged.
1.2 Installation
Up to 3 x F1-10G-BP units can be installed in a standard 19’’ rack, using the
rackmount chassis kit (ARKB-1U).
To install the unit(s) in the rack, follow these steps:
◉Slide the rackmount chassis kit in desired rack location and secure it to the
rack using appropriate rack screws.
◉Slide the unit(s) in the rackmount chassis kit and secure them using the
units’ thumbscrews.
◉Make sure the rack is properly grounded.

2
. PRODUCT OVERVIEW
Active in-line security appliances are single points of failure in any network.
The F1-10G-BP bypass TAP monitors the health of your appliance over copper or fiber
connections and removes any point of failure by automatically switching traic in a
bypass mode, to keep the network critical link up.
The F1-10G-BP features set include:
◉Link Failure Propagation (LFP)
◉Bidirectional Heartbeat (ping signal to and from the monitored appliance)
◉Predefined and custom Heartbeat signal type
◉Heartbeat control
◉Administration via HTTP/CLI
◉Comprehensive configuration and behavior
◉1G/10G operation
◉High reliability design, no point of failure
LINK FAILURE PROPAGATION (LFP)
The in-line network port group (NET A and NET B ports) supports Link Failure
Propagation. If a network disconnection occurs on one port of the group, the other
port is automatically disabled, propagating the failure on the monitored line and
allowing alternative data paths to be used in the networks’ routing node.
BIDIRECTIONAL HEARTBEAT INJECTION
When the device operates in Auto Bypass mode, Heartbeat packets A and B are
inserted into the network traic egressing TAP A and TAP B. These Heartbeats
packets are used to monitor the inline path of the security appliance.
Heartbeat packets A and B can be configured from a predefined list or can be

3
customized. Predefined packets include IPX, ICMP request/reply, LCP request/reply
and TCP-SYN. The device is factory programmed with two globally unique MAC
addresses, used as source MAC addresses for Heartbeat A and B.
HEARTBEAT RATE CONTROL
The Heartbeat injection rate can be set from 50s to 4s (default value is 1s).
HEARTBEAT FAILURE TIMEOUT
The Heartbeat failure timeout can be set from 50s to 4s (default value is 3s). When
the Heartbeat timeout event occurs on at least one direction, the logical bypass is
enabled while the in-line path remains active.
HEARTBEAT RECOVERY
If the logical Bypass is activated due to a Heartbeat failure or TAP link down event, the
return to normal operation occurs after N valid Heartbeat packets are received in both
directions (default N value is 2).
HEARTBEAT PRIORITY
The injected Heartbeat packets have a higher priority over the network traic. If the
network bandwidth utilization is 100%, some packets might get dropped in order to
inject the Heartbeat packets. Dropped packets are reported in “Dropped packets”
counters.

4
BYPASS CIRCUITS
Covering all failure scenarios, the F1-10G-BP unit is equipped with both a physical
bypass (passive) and a logical bypass (activated by the FPGA) used to maintain data
flow:
◉In case of power outage, the physical bypass is activated by default (fail open),
allowing the network connection on the tapped line to remain functional.
◉In case of Heartbeat failure or TAP link down, the logical bypass is activated
instead, allowing the network connection on the tapped line to remain
functional.
The basic functionality is depicted in the following diagram, explaining the logical
paths and alternatives F1-10G-BP operates on. For more information regarding
operation scenarios, please go to Operation Use Cases chapter.

5
2.1 Technical and Electrical Specifications
◉Dimensions (WxDxH): 120 x 205 x 41 mm — 4.72 x 8.07 x 1.61 in
◉Weight: 950 g — 2.1 lb
◉Power requirement: 12V 1.5A
◉BTU/hr: 62

6
2.2 Front View
2.3 Rear View
PSU1, PSU2 Status LEDs
Bypass Status Led
Fan Status LED
Serial Management interface
115200/8/1/n
Ethernet management interface
10 / 100 Mbps
1, 2
3
4
5
6
1
2
3
4
5 7 9 1086
Rx / Tx activity LEDs for TAP A & TAP B
SFP+ interfaces, accepting copper/fiber
modules, used for connecting to monitored
security appliances. 1Gbps/10Gbps
In-Line network ports, accepting LC optical
fiber connections. 1Gbps/10Gbps
Rx / Tx activity LEDs for NET A & NET B
7
8
9
10

7
. CONNECTING POWER AND STARTUP
The system powers on when one of the power supplies is connected to the main
power.
▶Note: The use of both power supplies is recommended to ensure
fail-safe operation.
The F1-10G-BP is equipped with status and activity leds. For more details on status
leds color and coding, please see 2.4 Led Functionality chapter.
2.4 LED Functionality
Bypass LED
1 LED
2 LED
FAN, Bypass, 1, 2
Fan LED
PSU is operating normally
PSU1 is connected
PSU2 is connected
Link up @ 10 / 100 Mbps
Unit is rebooting
Link up with activity.
PSU1 not connected or not working
PSU2 not connected or not working
PSU is operating normally
OVP: Over Voltage Protection
UVP: Under Voltage Protection
Monitored appliance is down, bypass is
activated.
Green
Green
Green
link Amber
Orange
act Blinking
Green
Orange
Orange
Green
Orange
Orange
LED FUNCTION / STATE MEANING / CONTROL

8
. ACCESSING THE FGBP BYPASS TAP
System access can be achieved through serial or Ethernet connection. By default,
the unit network interface has DHCP enabled.
For accessing the unit through the serial connection, follow these steps:
1. Power up the unit.
2. Wait for the unit to boot.
3. Connect your computer to the serial administration interface.
4. Using any terminal software (xterm, PuTTY, etc.), use the following
connection settings: 115200 baud rate, 8 bit, no parity, 1 bit stop. Login, using
the following credentials:
◉ Username: master
◉ Password: master
For accessing the unit through its IP address, either in CLI mode (ssh) or via web
interface (BP Manager), follow these steps:
1. Power up the unit.
2. Wait for the unit to boot.
3. Connect the Ethernet management port to the local network. By
default, the DHCP is enabled.
▶Note: The IP must first be discovered in the network, in case it is
not allocated by the gateway, using a mac allocation table. As an
alternative, the IP can be obtained by connecting to the unit through
its serial interface and running the network.status command.

9
CONFIGURATION
. WEB ADMINISTRATION
The F1-10G-BP can be administered either in CLI mode or in a graphical
OS and platform independent web-based interface, called BP Manager.
▶Note: BP Manager can only administer and monitor a single F1-10G-BP unit.
Grouped by functionality, there are six menu tabs displayed in the left side of the
screen:
◉Device Status
◉Port Management
◉Global Statistics
1.1 Device Status
The Device Status page displays the device status and sensors information. Without
logging in, this menu is the only one available. The following information is displayed:
◉Version information (sw/hw version)
◉Administrator information (user name, phone number, email address)
◉Bypass Settings
◉Administration
◉Logs
4. Type the device IP in a browser. Alternatively, connect via SSH, using
the unit’s IP address.
5. Login with the default credentials. (master:master). Modify the default
admin account, if desired.
6. Login again, using the modified username:password combination.

10
◉Date and time information
◉Network details
◉Sensors (the air temperature is measured in proximity of the fans block, the
system temperature is measured within the forwarding plane chip).
◉Temperature readings for CPU, system and external air.
1.2 Ports Management
The Port Management page displays
the name, link status and speed of
all interfaces. Changing the speed at
which the interfaces operate (between
1G and 10G) is done from the Speed
drop down menu, operation also available in CLI, using the port_speed.set command.
▶Note: Interface speed changes apply for all interfaces: NET A, NET B, TAP A and TAP B.
1.3 Statistics
The Global Statistics page displays the counters for each interface, oering an
overview on all data flow:
◉Rx good packets: all packets received in good shape are counted here.
◉Rx CRC error packets: all packets received, failing the CRC error checking
(the Heartbeat packets or the network traic which are sent to the monitored
appliance come back corrupted - having the wrong Ethernet FCS) are
counted here.
◉Dropped packets: all packets dropped so that Heartbeat packets could be

11
injected in case of a 100% network bandwidth utilization, are counted here.
◉Rx Heartbeat packets: all Heartbeat packets (replied from an ALIVE
monitored appliance) received in good shape are counted here.
1.4 Bypass Settings
The Bypass page represents the heart of F1-10G-BP functionality configuration,
allowing the user to custom tailor the unit’s behavior, given various environment
scenarios. For more information regarding operation scenarios, please goto Operation
Use Cases chapter.
MANUAL BYPASS: This checkbox allows the user to force the unit to bypass the
traic regardless of other bypass related rules.
IN CASE MANUAL BYPASS IS ON: This option is only relevant when Manual Bypass
options is ON, allowing the user to configure whether the TAP mode is ON and the
data is being replicated or the TAP mode is o.
IN CASE OF POWER FAILURE: This selection allows the user to program the
physical (passive) bypass to be activated or deactivated in case of a power loss in the
unit.
IN CASE OF HEARTBEAT FAILURE: This selection allows the user to program the
bypass behavior in case of a Heartbeat timeout. The timeout is also user customizable
in the Heartbeat failure timeout field.
IN CASE THE TAP LINK IS DOWN: This selection allows the user to program the
bypass behavior in case the TAP link is down.

12
HEARTBEAT A, B: There are two sections, one corresponding to the Heartbeat packet
sent from NET A port to NET B port and one corresponding to the Heartbeat packet
sent from NET B port to NET A port, allowing the user to customize these packets
and save/load them to/from a local location.
◉The Heartbeat packets (A,B) can be either edited in the HEX editor or
selected from a list of pre-defined signatures.
◉These buttons allow the user to tailor the size of the Heartbeat
custom packet. There is a minimum and a maximum size allowed.
Added blocks ( ) of information to the custom packet are initially filled with
“00”, which can be changed as desired.
HEARTBEAT RATE: Allows the user to change the rate at which Heartbeat
packets are sent to the monitored appliance. The rate can be set in nanoseconds,
microseconds, milliseconds, seconds, or minutes.
HEARTBEAT FAILURE TIMEOUT: Allows the user to set a specific time interval that
will be allowed to elapse between sending and receiving a Heartbeat packet. The
interval can be set in nanoseconds, microseconds, milliseconds, seconds, or minutes.
If this interval is exceeded, the behavior is interpreted as failure and the Bypass is set
to ON or OFF, depending on how the “IN CASE OF HEARTBEAT FAILURE (timeout)”
option is configured.
+
+ -

13
1.5 Administration
The Administration page allows changing system related settings.
The Setup tab allows editing the administration contact details, the system date and
time and the network address.
▶Note: In case the IP is changed from static to dynamically allocated
(DHCP), the new IP must first be discovered or allocated by the gateway
(using a MAC address allocation table). Also, disabling the network
interface will make the web interface unavailable, in which case a serial
connection to the unit must be established to reactivate the network
interface (see CLI Administration for additional details).
▶Note: If you wish to create or import a custom Heartbeat packet file,
remember to always follow this format for the MAC address: MM:MM:M-
M:SS:SS:SS. By default, the Destination fields for both Heartbeat A and
Heartbeat B are pre-filled as follows:
◉Source MAC HB_A = Destination MAC HB_B
◉Destination MAC HB_A = Source MAC HB_B
However, the Destination fields can be edited to suit particular network
requirements.
HEARTBEAT RECOVERY AFTER: After a Heartbeat timeout occurs, it is important
not to consider the appliance alive again (or the network being up again) after only
receiving a single Heartbeat packet. It is safer to receive at least 2 or more Heartbeat
packets to be sure the service is alive again. This option allows the user to configure
the number of these consecutive received Heartbeats, after a Heartbeat failure, after
which the system enables or disables the Bypass behavior contrary to the selection
user made on the “In case of Heartbeat failure (timeout)” option.

14
The Firmware Update tab allows the system to be updated to a new version, from a
locally stored update file.
▶Note: Please do not unplug the power cable during the update process.
The device will reboot once the installation is complete and the webpage
will be reloaded.
The SNMP Configuration tab allows the users to enable and configure the Simple
Network Management Protocol (SNMP).
SNMP v1 and v2c use a community string for authentication, sent as clear text, an
approach less than ideal, security wise. This is why SNMPv3 has been developed,
improving on v1 and v2c by introducing the following security features:
◉Message integrity: prevents packets to be intercepted or tampered with during
transit.
◉Authentication: ensures the message comes from a valid source.
◉Encryption: scrambles the contents of the packets to avoid deciphering in case of
interception by third parties.
ENCRYPTION
METHOD
LEVEL AUTHENTICATION
KEY BEHAVIOR
no auth
auth
priv MD or SHA
PASSPHRASE IN
MD OR SHA
USERNAME ONLYNO
NO
DES or AES
The authentication is done using the
MD5 or SHA hash of the passphrase.
The channel is encrypted using DES or
AES algorithms.
The authentication is done using the
MD5 or SHA hash of the passphrase.
Authentication is done using a user-
name only.

15
1.6 Logs
The Logs page displays Bypass and System logs for the specified period. To change
the period, select the desired From and Until dates, and click the View button. The
displayed log files can be downloaded either individually, by clicking the Download
button next to the desired file’s name, or as a single file, by clicking the Download
range button.
The SNMP service allows users to configure the following security options:
◉SNMP communities: (for SNMP v1 and v2c) Allows adding, deleting or editing
SNMP communities, used for establishing trust without standard credentials.
◉SNMP users: (for SNMP v3 only) Allows adding, deleting and editing SNMP
users, including their security level and authentication/privacy type and hash.
◉SNMP trap_sinks: Allows adding, deleting and configuring hosts which SNMP
notifications (traps) will be sent to.
▶Note: Every time an entry is added, the change must be applied by
clicking . Navigating away from the SNMP tab without applying
changes will result in losing the latest changes.
The SNMP management information base (MIB) used for managing the entities in the
secured accessed network can also be downloaded from this tab, by clicking on .

16
.date_time.> .users.show
Users: master
.date_time.>
. CLI ADMINISTRATION
After logging into the system, the user has access to all available commands. Useful
commands to navigate the console:
◉‘ls’ or ‘help’ for available branches.
◉TAB autocompletes commands and also shows the available branches.
◉Ctrl+D cancels a command.
◉‘.’ returns to initial branch.
◉‘..’ returns to previous branch.
◉PgUp and PgDown scrolls the console.
◉CTRL+C closes the terminal.
Commands residing in one branch can also be executed from dierent branches,
using the [.] prefix, provided the path and the command name is known, for example: