ProfiTap F1-40G-BP BYPASS TAP Manual

F1-40G-BP BYPASS TAP
INSTALLATION AND CONFIGURATION MANUAL
www.profitap.com

BRINGING CLARITY INTO NETWORKS.
ANYTIME. ANYWHERE.

For any questions, technical or otherwise, please contact our
customer support through our website:
www.profitap.com
or by email:
[e-mail]
For the latest documentation and software, visit our Resource
Center:
http://www.profitap.com/resource-center/

TABLE OF CONTENTS
Installation
1. Unpacking & Installation
1.1 Unpacking
1.2 Installation
2. Product Overview
2.1 Technical and Electrical Specifications
2.2 Front View
2.3 Rear View
2.4 LED Functionality
3. Connecting Power and Start-Up
4. Accessing the F1-40G-BP Bypass Tap
Configuration
1. Web Administration
1.1 Device Status
1.2 Port Management
1.3 Global Statistics
1.4 Bypass Settings
1.5 Administration
1.6 Logs
2. CLI Administration
Operation Use Cases
Legal
1
1
1
1
2
4
5
5
6
6
7
8
8
8
9
9
10
12
13
13
16
21

1
INSTALLATION
. UNPACKING & INSTALLATION
1.1 Unpacking
Carefully unpack all the items supplied with the F1-40G-BP and retain
the packaging for later use:
◉1 x F1-40G-BP main unit
◉2 x 12V 4.5A Power supply
◉1 x DB9 to RJ45 Console cable
▶Note: Please contact the supplier if any part is missing or damaged.
1.2 Installation
Up to 3 x F1-40G-BP units can be installed in a standard 19’’ rack, using the rackmount
chassis kit (ARKB-1U).
To install the unit(s) in the rack, follow these steps:
◉Slide the rackmount chassis kit in desired rack location and secure it to the
rack using appropriate rack screws.
◉Slide the unit(s) in the rackmount chassis kit and secure them using the units’
thumbscrews.
◉Make sure the rack is properly grounded.

2
. PRODUCT OVERVIEW
Active in-line security appliances are single points of failure in any network.
The F1-40G-BP bypass TAP monitors the health of your appliance over copper or fiber
connections and removes any point of failure by automatically switching traic in a
bypass mode, to keep the network critical link up.
The F1-40G-BP features set include:
◉Link Failure Propagation (LFP)
◉Bidirectional Heartbeat (ping signal to and from the monitored appliance)
◉Predefined and custom Heartbeat signal type
◉Heartbeat control
◉Administration via HTTP/SHH/CLI
◉Comprehensive configuration and behavior
◉40G operation
◉High reliability design, no point of failure
LINK FAILURE PROPAGATION (LFP)
The in-line network port group (NET A and NET B ports) supports Link Failure
Propagation. If a network disconnection occurs on one port of the group, the other
port is automatically disabled, propagating the failure on the monitored line and
allowing alternative data paths to be used in the networks’ routing node.
BIDIRECTIONAL HEARTBEAT INJECTION
When the device operates in Auto Bypass mode, Heartbeat packets A and B are
inserted into the network traic egressing TAP A and TAP B. These Heartbeats
packets are used to monitor the inline path of the security appliance.
Heartbeat packets A and B can be configured from a predefined list or can be
customized. Predefined packets include IPX, ICMP request/reply, LCP request/reply
and TCP-SYN. The device is factory programmed with two globally unique MAC
addresses, used as source MAC addresses for Heartbeat A and B.

3
HEARTBEAT RATE CONTROL
The Heartbeat injection rate can be set from 50µs to 4s (default value is 1s).
HEARTBEAT FAILURE TIMEOUT
The Heartbeat failure timeout can be set from 50µs to 4s (default value is 3s). When
the Heartbeat timeout event occurs on at least one direction, the logical bypass is
enabled while the in-line path remains active.
Note: Heartbeat rate and timeout are configurable based on dierent
metrics (nanoseconds, microseconds, milliseconds, seconds, minutes)
HEARTBEAT RECOVERY
If the logical Bypass is activated due to a Heartbeat failure or TAP link down event, the
return to normal operation occurs after N valid Heartbeat packets are received in both
directions (default N value is 2).
HEARTBEAT PRIORITY
The injected Heartbeat packets have a higher priority over the network traic. If the
network bandwidth utilization is 100%, some packets might get dropped in order to
inject the Heartbeat packets. Dropped packets are reported in “Dropped packets”
counters.

4
BYPASS CIRCUITS
Covering all failure scenarios, the F1-40G-BP unit is equipped with both a physical
bypass (passive) and a logical bypass (activated by the FPGA) used to maintain data
flow:
◉In case of power outage, the physical bypass is activated by default (fail open),
allowing the network connection on the tapped line to remain functional.
◉In case of Heartbeat failure or TAP link down, the logical bypass is activated
instead, allowing the network connection on the tapped line to remain
functional.
The basic functionality is depicted in the following diagram, explaining the logical
paths and alternatives F1-40G-BP operates on. For more information regarding
operation scenarios, please go to Operation Use Cases chapter.

5
2
FAN
BYPASS
F1-40G-BP
TAP B
NET
A
NET
B
TAP A
1
link act
2.1 Technical and Electrical Specifications
Dimensions (WxDxH): 120 x 315 x 40 mm — 4.7 x 12.4 x 1.6 in
Weight: 1360 g — 2.99 lb
Power requirement: 12V 4.5A
2.2 Front View
2.2 Rear View
PSU1, PSU2 Status LEDs
Bypass Status Led
Fan Status LED
Ethernet management
interface 10 / 100 Mbps
Serial Management
interface 115200 / 8 / 1 / n
1, 2
3
4
5
6
1
2
3
4
5 7 89106
QSFP+ interfaces, accepting copper/fiber
modules, used for connecting to monitored
security appliances. (40Gbps)
In-Line network ports, accepting MTP optical
fiber connections. (40Gbps)
Rx / Tx activity LEDs for NET A & NET B
Rx / Tx activity LEDs for TAP A & TAP B
7
8
9
10

6
. CONNECTING POWER AND STARTUP
The system powers on when one of the power supplies is connected to the main
power.
▶Note: The use of both power supplies is recommended to ensure
fail-safe operation.
The F1-40G-BP is equipped with status and activity leds. For more details on status
leds color and coding, please see 2.4 Led Functionality chapter.
2.4 LED Functionality
Bypass LED
1 LED
2 LED
FAN, Bypass, 1, 2
Fan LED
PSU is operating normally
PSU1 is connected
Link up @ 10 / 100 Mbps
Unit is rebooting
Link up with activity.
PSU1 not connected or not working
PSU2 not connected or not working
PSU2 connected
PSU is operating normally
OVP: Over Voltage Protection
UVP: Under Voltage Protection
Monitored appliance is down, bypass is
activated.
Green
Green
Green
link Amber
Orange
act Blinking
Green
Orange
Orange
Green
Orange
Orange
LED FUNCTION / STATE MEANING / CONTROL

7
. ACCESSING THE FGBP BYPASS TAP
System access can be achieved through serial or Ethernet connection. By default, the
unit network interface has DHCP enabled.
For accessing the unit through the serial connection, follow these steps:
1. Power up the unit.
2. Wait for the unit to boot.
3. Connect your computer to the serial administration interface.
4. Using any terminal software (xterm, PuTTY, etc.), use the following
connection settings: 115200 baud rate, 8 bit, no parity, 1 bit stop.
Login, using the following credentials:
◉Username: master
◉Password: master
For accessing the unit through its IP address, either in CLI mode (ssh) or via web
interface (BP Manager), follow these steps:
1. Power up the unit.
2. Wait for the unit to boot.
3. Connect the Ethernet management port to the local network. By
default, the DHCP is enabled.
▶Note: The IP must first be discovered in the network, in case it is
not allocated by the gateway, using a mac allocation table. As an
alternative, the IP can be obtained by connecting to the unit through its
serial interface and running the network.status command.

8
CONFIGURATION
. WEB ADMINISTRATION
The F1-40G-BP can be administered either in CLI mode or in a graphical
OS and platform independent web-based interface, called BP Manager.
▶Note: BP Manager can only administer and monitor a single F1-40G-BP unit.
Grouped by functionality, there are six menu tabs displayed in the left side of the
screen:
◉Device Status
◉Port Management
◉Global Statistics
1.1 Device Status
The Device Status page displays the device status and sensors information. Without
logging in, this menu is the only one available. The following information is displayed:
◉Revision information (model number, sw/hw revision)
◉Administrator information (user name, phone number, email address)
◉Bypass
◉Administration
◉Logs
4. Type the device IP in a browser. Alternatively, connect via SSH, using
the unit’s IP address.
5. Login with the default credentials. (master:master). Modify the default
admin account, if desired.
6. Login again, using the modified username:password combination.

9
◉Date and time information
◉Network details
◉Sensors (the air temperature is measured in proximity of the fans block, the
system temperature is measured within the forwarding plane chip).
◉Temperature readings for CPU, system and external air.
1.2 Ports Management
The Port Management page displays the name, link status and speed of all interfaces.
1.3 Statistics
The Global Statistics page displays the counters for each interface, oering an
overview on all data flow:
◉Rx good packets: all packets received in good shape are counted here.
◉Rx CRC error packets: all packets received, failing the CRC error checking
(the Heartbeat packets or the network traic which are sent to the monitored
appliance come back corrupted - having the wrong Ethernet FCS) are
counted here.
◉Dropped packets: all packets dropped so that Heartbeat packets could be
injected in case of a 100% network bandwidth utilization, are counted here.
◉Rx Heartbeat packets: all Heartbeat packets (replied from an ALIVE
monitored appliance) received in good shape are counted here.

10
1.4 Bypass Settings
The Bypass page represents the heart of F1-40G-BP functionality configuration,
allowing the user to custom tailor the unit’s behavior, given various environment
scenarios. For more information regarding operation scenarios, please goto
Operation Use Cases chapter.
MANUAL BYPASS: This checkbox allows the user to force the unit to bypass the traic
regardless of other bypass related rules.
IN CASE MANUAL BYPASS IS ON: This option is only relevant when Manual Bypass
options is ON, allowing the user to configure whether the TAP mode is ON and the
data is being replicated or the TAP mode is o.
IN CASE OF POWER FAILURE: This selection allows the user to program the physical
(passive) bypass to be activated or deactivated in case of a power loss in the unit.
IN CASE OF HEARTBEAT FAILURE: This selection allows the user to program the
bypass behavior in case of a Heartbeat timeout. The timeout is also user customizable
in the Heartbeat failure timeout field.
IN CASE THE TAP LINK IS DOWN: This selection allows the user to program the
bypass behavior in case the TAP link is down.
HEARTBEAT A, B: There are two sections, one corresponding to the Heartbeat packet
sent from NET A port to NET B port and one corresponding to the Heartbeat packet
sent from NET B port to NET A port, allowing the user to customize these packets
and save/load them to/from a local location.
◉The Heartbeat packets (A,B) can be either edited in the HEX editor or
selected from a list of pre-defined signatures.

11
◉These buttons allow the user to tailor the size of the Heartbeat
custom packet. There is a minimum and a maximum size allowed. Added
blocks ( ) of information to the custom packet are initially filled with “00”,
which can be changed as desired.
H E ART BE AT R ATE : Allows the user to change the rate at which Heartbeat packets are
sent to the monitored appliance. The rate can be set in nanoseconds, microseconds,
milliseconds, seconds, or minutes.
HEARTBEAT FAILURE TIMEOUT: Allows the user to set a specific time interval that
will be allowed to elapse between sending and receiving a Heartbeat packet. The
interval can be set in nanoseconds, microseconds, milliseconds, seconds, or minutes.
If this interval is exceeded, the behavior is interpreted as failure and the Bypass is set
to ON or OFF, depending on how the “IN CASE OF HEARTBEAT FAILURE (timeout)”
option is configured.
HEARTBEAT RECOVERY AFTER: After a Heartbeat timeout occurs, it is important
not to consider the appliance alive again (or the network being up again) after only
receiving a single Heartbeat packet. It is safer to receive at least 2 or more Heartbeat
packets to be sure the service is alive again. This option allows the user to configure
the number of these consecutive received Heartbeats, after a Heartbeat failure, after
which the system enables or disables the Bypass behavior contrary to the selection
user made on the “In case of Heartbeat failure (timeout)” option.
+ -
+

12
1.5 Administration
The Administration page allows changing system related settings.
The Setup tab allows editing the administration contact details, the system date and
time and the network address.
▶Note: In case the IP is changed from static to dynamically allocated
(DHCP), the new IP must first be discovered or allocated by the gate-
way (using a MAC address allocation table). Also, disabling the network
interface will make the web interface unavailable, in which case a serial
connection to the unit must be established to reactivate the network inter-
face (see CLI Administration for additional details).
The Firmware Update tab allows the system to be updated to a new version, from a
locally stored update file.
▶Note: Please do not unplug the power cable during the update process.
The device will reboot once the installation is complete and the webpage
will be reloaded.
▶Note: Please do not unplug the power cable during the update process.
The device will reboot once the installation is complete and the webpage
will be reloaded.

13
The SNMP tab allows the users to enable and configure the Simple Network Manage-
ment Protocol (SNMP).
SNMP v1 and v2c use a community string for authentication, sent as clear text, an
approach less than ideal, security wise. This is why SNMPv3 has been developed,
improving on v1 and v2c by introducing the following security features:
◉Message integrity: prevents packets to be intercepted or tampered with during
transit.
◉Authentication: ensures the message comes from a valid source.
◉Encryption: scrambles the contents of the packets to avoid deciphering in case of
interception by third parties.
The SNMP service allows users to configure the following security options:
◉SNMP communities: (for SNMP v1 and v2c) Allows adding, deleting or editing
SNMP communities, used for establishing trust without standard credentials.
◉SNMP users: (for SNMP v3 only) Allows adding, deleting and editing SNMP
users, including their security level and authentication/privacy type and hash.
◉SNMP trap_sinks: Allows adding, deleting and configuring hosts which SNMP
notifications (traps) will be sent to.
▶Note: Every time an entry is added, the change must be applied by
clicking . Navigating away from the SNMP tab without applying
changes will result in losing the latest changes.
The SNMP management information base (MIB) used for managing the entities in the
secured accessed network can also be downloaded from this tab, by clicking on

14
.date_time.> .users.list
Users: master
.date_time.>
1.6 Logs
The Logs page displays Bypass and System logs for the specified period. To change
the period, select the desired From and Until dates, and click the View button. The
displayed log files can be downloaded either individually, by clicking the Download
button next to the desired file’s name, or as a single file, by clicking the Download
range button.
. CLI ADMINISTRATION
After logging into the system, the user has access to all available commands. Useful
commands to navigate the console:
◉‘ls’ or ‘help’ for available branches.
◉TAB autocompletes commands and also shows the available branches.
◉Ctrl+D cancels a command.
◉‘.’ returns to initial branch.
◉‘..’ returns to previous branch.
◉PgUp and PgDown scrolls the console.
◉CTRL+C closes the terminal.
Commands residing in one branch can also be executed from dierent branches,
using the [.] prefix, provided the path and the command name is known, for example:

15
The following commands are available in the CLI:
date_time show: Displays the date.
set: Allows the user to set the date and time.
factory_reset Should the system become corrupted or the main
parameters need to be restored to their default values, this
option resets the device to the factory state and reboots the
system.
▶Note: Another way of resetting the device to factory defaults is to interrupt
the boot sequence and press a key when prompted:“F1-40G-BP failed to boot
on last attempt and has now successfully booted in recovery mode. Press
any key within 10 seconds to install the base firmware or wait for the unit to
attempt a new boot sequence.”
hostname Uniquely identifies each unit with a label, a useful feature in
case multiple devices are connected within the same
network or to the same host machine, having the
remote_logging feature enabled.
firmware_update Allows the user to update the system’s firmware from an
URL address.
port_speed show: Displays the fiber link speed. It can be 1G,
10G and 40G.
set: Allows the user to change the fiber link speed between
1G, 10G and 40G.

16
network settings edit: Allows the user to set the IP acquisition mode of the
unit to either DHCP or STATIC. In case STATIC is selected,
the user has to input the IPv4, network mask, gateway and
DNS address.
interface.disable: Disables the Ethernet interface. The serial
management port will still be operating.
▶Note: if connected through ssh via Ethernet port, after
disabling the network interface, the session will be lost.
interface.enable: Allows the user to re-enable the Ethernet
interface. The network configuration before disabling the
Ethernet interface will be restored.
reset: Allows the user to reset the Ethernet interface to its
default configuration: interface:enabled, DHCP: active.
show: Displays the network parameters of the unit: IP, Mask,
Gateway, DNS and MAC address.
reboot Immediately reboots the system, keeping all configurations
intact.
remote_logging In case a rsyslog service is set up on the connected
network, enabling this option will result in sending the
bypass log or the system log to the remote rsyslog service.
disable/enable: Disables or enables the feature.
show: Displays whether the feature is enabled or disabled.
targets: Allows the user to configure the remote machine
running the rsyslog service which the bypass log or the
system log will be sent to.