Stonesoft StoneGate FW-1020 User manual

Appliance Installation Guide
StoneGate FW-1020/1050/1200
IPSSMC SSL VPNFW VPN
book_cover_template_installation_guides_fw.indd 2 29.8.2008 12:45:17

2
Legal Information
End-User License Agreement
The use of the products described in these materials is subject to the then current end-user
license agreement, which can be found at the Stonesoft website:
www.stonesoft.com/en/support/eula.html
General Terms and Conditions of Support and Maintenance
Services
The support and maintenance services for the products described in these materials are
provided pursuant to the general terms for support and maintenance services and the
related service description, which can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/terms/
Replacement Service
The instructions for replacement service can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/return_material_authorization/
Hardware Warranty
The appliances described in these materials have a limited hardware warranty. The terms of
the hardware warranty can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/warranty_service/
Trademarks and Patents
The products described in these materials are protected by one or more of the following
European and US patents: European Patent Nos. 1065844, 1189410, 1231538, 1259028,
1271283, 1289183, 1289202, 1313290, 1326393, 1379046, 1330095, 131711,
1317937 and 1443729 and US Patent Nos. 6,650,621; 6 856 621; 6,885,633;
6,912,200; 6,996,573; 7,099,284; 7,127,739; 7,130,266; 7,130,305; 7,146,421;
7,162,737, 7,234,166, 7,260,843, 7,280,540; 7,302,480, 7,386,525 and 7,406,534;
and may be protected by other EU, US, or other patents, or pending applications. Stonesoft,
the Stonesoft logo and StoneGate, are all trademarks or registered trademarks of Stonesoft
Corporation. All other trademarks or registered trademarks are property of their respective
owners.
Disclaimer
Although every precaution has been taken to prepare these materials, THESE MATERIALS
ARE PROVIDED "AS-IS" and Stonesoft makes no warranty to the correctness of information
and assumes no responsibility for errors, omissions, or resulting damages from the use of
the information contained herein. All IP addresses in these materials were chosen at random
and are used for illustrative purposes only.
Copyright © 2008 Stonesoft Corporation. All rights reserved. All specifications are subject to
change.
R
ev
i
s
i
on:
SGAIG
_
FW
-
1200
_
1020
_
1050
_
20081112

Introduction 3
Introduction
Thank you for choosing Stonesoft’s StoneGate appliance. This guide
provides instructions for the initial hardware installation and the
maintenance of the FW-1020, FW-1050, and FW-1200 appliances. See
Product Documentation, on page 5 for information on other available
documentation.
The use of the appliance is subject to the acceptance of the End User
License Agreement, which can be found at the Stonesoft website.
You must have a working Management Center on a separate server to
bring the appliance(s) operational. The system architecture is explained
on the next page. See the StoneGate Management Center Installation
Guide for instructions on how to install the Management Center.
Contents
Getting Started ............................ 4
Safety Precautions ....................... 6
Front Panel .................................. 8
Unpacking the Appliance .............. 10
Rack-Mounting............................. 10
Connecting the Cables ................. 18
Initial Configuration ...................... 19
Command-Line Management......... 28
Maintenance Operations............... 28
Appendix: Port Indicators.............. 31
Caution – Never open the covers of the appliance! There are no user
serviceable parts inside. Opening the covers may lead to serious
injury and will void the warranty. Read the Safety Precautions, on
page 6 before you conduct any installation or maintenance operations
on the appliance.

4Getting Started
Getting Started
StoneGate System Components
Illustration 1 StoneGate Components
The illustration above shows all available StoneGate components. Out of
these, you need the following components to have an operational
Firewall/VPN system:
1. A Management Server, which stores the configuration of the
system. In most environments, it is best to have just one common
Management Server for all firewall and IPS engines.
2. At least one Log Server to handle and store logs and alerts (can
be installed simultaneously on the same machine with the
Management Server).
3. At least one Management Client that you use to connect to the
Management Server to change settings and monitor the system.
4. The Firewall Engines that handle the actual traffic processing (in
this case, the FW-1020, FW-1050, or FW-1200 appliance).
5. Licenses for each component except the Management Client(s).
Generate appliance licenses at the Stonesoft website with the
POS (proof-of-serial-number) code attached to the appliance.
The Monitoring Server and the Monitoring Client are optional
components that are available on separate order.
StoneGate IPS engines can be added to the same system for unified
management and incident handling.

GettingStarted 5
Installation Procedure
The appliance installation involves the following mandatory steps:
1. Configure the Firewall element in the Management Center (see the
separate Firewall/VPN Installation Guide or the online help of the
Management Client).
2. Save the initial configuration to receive a one-time password for
establishing trust between the appliance and the Management
Server (see the separate Firewall/VPN Installation Guide).
3. Install the appliance into a rack and connect the cables as
instructed in this guide.
4. Perform the initial configuration and establish contact between the
appliance and the Management Server (see Initial Configuration,
on page 19).
Product Documentation
The following documentation covers the StoneGate Firewall/VPN
products:
• The Management Center Installation Guide and the Firewall/VPN
Installation Guide explain how to install the Management Center and
how to configure your firewalls’ basic settings.
• The online help of the Management Client contains the step-by-step
instructions for the daily configuration and management of your
system.
• The Administrator’s Guide contains the same information as the
online help, but in PDF form.
• The Management Center Reference Guide and the Firewall/VPN
Reference Guide contain background and reference information that
helps you to plan and understand your system.
Finding the Documentation
Press F1 while in any Management Client window to view the online
help.
All PDF guides are available:
• On the Management Center CD-ROM (in the Documentation folder)
• At the Stonesoft Website at http://www.stonesoft.com/en/support/
technical_support_and_documents/manuals/.
Install the free Adobe Reader program to view the PDF documents
(available at www.adobe.com/reader/).

6Safety Precautions
Safety Precautions
The following safety information and procedures must be followed
whenever working with electronic equipment. However, please be
advised that StoneGate Appliances are not end-user serviceable, and
you must never open the appliance covers for any reason. Doing so may
lead to serious injury and will void any hardware warranty that may be
associated with your appliance.
Electrical Safety Precautions
Basic electrical safety precautions should be followed to protect yourself
from harm and the appliance from damage:
• Be aware of the locations of the power on/off switch as well as the
room's emergency power-off switch, disconnection switch, or
electrical outlet. If an electrical accident occurs, you can then quickly
cut power to the system.
• Do not work alone when working with high voltage components.
• Use only one hand when working with powered-on electrical
equipment. This is to avoid making a complete circuit, which will
cause electrical shock. Use extreme caution when using metal tools,
which can easily damage any electrical components or circuit boards
they come into contact with.
• Do not use mats designed to decrease electrostatic discharge as
protection from electrical shock. Instead, use rubber mats that have
been specifically designed as electrical insulators.
• The power supply cord must include a grounding plug and must be
plugged into a grounded electrical outlet.
Caution – Never open the appliance covers! There are no user
serviceable parts inside. Opening the covers may lead to serious
injury and will void the warranty.
General Safety Precautions
Follow these rules to ensure general safety:
• Keep the area around the appliance clean and free of clutter.
• We recommend using a regulating uninterruptible power supply (UPS)
to protect the appliance from power surges, voltage spikes and to
keep your system operating in case of a power failure.

SafetyPrecautions 7
ESD Precautions
Electrostatic discharge (ESD) is generated by two objects with different
electrical charges coming into contact with each other. An electrical
discharge is created to neutralize this difference, which can damage
electronic components and printed circuit boards. Use a grounded wrist
strap designed to prevent static discharge.
Note – Use a UPS (Uninterruptible Power Supply) in critical
environments with your StoneGate appliance. If after a brief power
outage your StoneGate appliance only partially starts up (for example,
the power light is on, but the appliance does not connect) turn the
appliance off for five seconds and then back on.
Operating Precautions
Care must be taken to assure that the cover is in place when the
appliance is operating to ensure proper cooling. If this rule is not strictly
followed, the warranty may become void. Do not open the power supply
casing. Power supplies can only be accessed and serviced by a qualified
technician of the manufacturer.
Operating and Storage Temperatures
The allowed operating temperature of the appliance is +10...+35ºC. The
allowed storage temperature is 0...+70ºC. Do not operate or store the
appliance in temperatures outside these limits.
Lithium Battery Precautions
Caution – Do not change the battery; the battery must be replaced by
authorized service personnel only. Danger of explosion if battery is
incorrectly replaced. Replacement battery must be same or equivalent
type recommended by the manufacturer. Used batteries must be
discarded according to the manufacturer’s instructions. Short-
circuiting the battery may heat the battery and cause severe injuries.

8Front Panel
Front Panel
Illustration 2 Front Panel
Note – Standby power is supplied to the system even when the
appliance is turned off.
The connectors are explained in detail in Connecting the Cables, on
page 18.
Front Panel Indicators
The front panel has five LED indicators. They provide you with critical
information related to different parts of the system.Table 1 presents the
indicators (from left to right).
Table 1 Front Panel Indicators
Indicator Explanation
Indicates power is being supplied to the system's
power supply unit. This LED is illuminated when the
system is operating normally.
Indicates hard drive activity when flashing.
Power
button
Connectors for
system
administration
Six or eight ethernet ports
Reset
button
Indicator
Lights

FrontPanel 9
For more information on port indicators, see Appendix: Port Indicators,
on page 31.
Indicates traffic on eth 0 (identically to the
corresponding LED in the port).
Indicates traffic on eth 1 (identically to the
corresponding LED in the port).
Indicates an overheat condition in the appliance. This
may be caused by cables obstructing the airflow in the
system or the ambient room temperature being too
warm.
Table 1 Front Panel Indicators (Continued)
Indicator Explanation

10 Unpacking the Appliance
Unpacking the Appliance
Inspect the box the appliance was shipped in and note if it was
damaged in any way. If the appliance itself shows damage, file a damage
claim with the carrier who delivered it. Confirm that the Stonesoft anti-
tamper tape on the appliance is intact.
Rack-Mounting
This section provides information on installing the StoneGate appliance
into a rack unit.
Caution – Read the Safety Precautions, on page 6 before proceeding.
Preparing for Rack-Mounting
The appliance delivery includes two sets of rail assemblies, two sets of
rail-mounting brackets, and screws for attaching the rails and the
brackets.
Caution – Read the sections below before you begin the installation.
Choosing a Setup Location
Decide on a suitable location for the rack unit that will hold the
appliance:
• The appliance must be situated in a clean, dust-free area that is well
ventilated.
• Avoid areas where heat, electrical noise and electromagnetic fields
are generated.
• Leave enough clearance in front of the rack to enable you to open the
front door completely (~63 cm/25 inches).
• Leave enough clearance in the back of the rack to allow for sufficient
airflow and ease in servicing (~76 cm/30 inches).
Rack Precautions
• Ensure that the leveling jacks on the bottom of the rack are fully
extended to the floor with the full weight of the rack resting on them.
• In single rack installation, attach stabilizers to the rack.
• In multiple rack installations, couple the racks together.

Rack-Mounting 11
• Always make sure the rack is stable before extending a component
from the rack.
• Extend only one component at a time—extending two or more
simultaneously may cause the rack to become unstable.
Device Precautions
Caution – Never open the appliance covers! There are no user
serviceable parts inside. Opening the covers may lead to serious
injury and will void the warranty.
• Review the electrical and general safety precautions in Safety
Precautions, on page 6.
• Determine the placement of each component in the rack before you
install the rails.
• Install the heaviest appliance components on the bottom of the rack
first, and then work up.
• The appliance must be connected to a grounded power outlet.
• Use a regulating uninterruptible power supply (UPS) to protect the
appliance from power surges, voltage spikes and to keep your system
operating in case of a power failure.
• Always keep the rack's front door and all panels and components on
the appliances closed when not servicing to maintain proper cooling.
Before Installing the Appliance Into a Rack
1. Make sure that the rack is securely anchored onto an unmovable
surface or structure before installing the appliance into the rack.
2. Unplug the power cord(s) of the rack before installing the
appliance into the rack.
3. Make sure that the system is adequately supported. Make sure
that all the components are securely fastened to the appliance to
prevent components falling off from the appliance.
4. Be sure to install an AC power disconnect for the entire rack
assembly. This power disconnect must be clearly marked.
5. The rack assembly must be properly grounded to avoid electric
shock.
6. The rack assembly must provide sufficient airflow to the appliance
for proper cooling.

12 Rack-Mounting
Installing the Appliance into a Rack
This section provides information on installing the StoneGate appliance
into a rack unit. There are a variety of rack units on the market, so the
assembly procedure may differ slightly from what is instructed. Refer to
the instructions that came with the rack unit you are using.
Installing the Appliance into a Telco Rack
If you are installing the appliance into a Telco type rack, follow the
general directions below. The main difference in the installation
procedure is the positioning of the rack brackets to the rack. Space
them apart just enough to accommodate the width of the Telco rack.
Identifying the Sections of the Rack Rails
You have received two rack rail assemblies with the appliance. Each of
these assemblies consist of three sections: an inner fixed rail that
secures to the appliance and an outer fixed rack rail that secures
directly to the rack itself. A sliding rail guide sandwiched between the
two should remain attached to the fixed rack rail. (See Illustration 3.)
The inner and outer rails must be detached from each other to install.
TTo detach the inner rails
Illustration 3 Identifying the Sections of the Rack Rails
1. Pull the inner rail out as far as possible. You should hear a "click"
sound as a locking tab emerges from inside the rail assembly and
locks the inner rail.
2. Depress the locking tab to pull the inner rail completely out.
3. Repeat for the other side’s rack rail assembly.
Inner Rail
(to be attached to
the appliance) Outer rail
(to be attached to
the rack)

Rack-Mounting 13
Locking Tabs: As you have seen, both rails have a locking tab, which
serves two functions.
• To lock the appliance into place when installed and pushed fully into
the rack, which is its normal position.
• To lock the appliance in place when fully extended from the rack to
prevent the appliance from coming completely out of the rack when
you pull it out for servicing.
TTo attach the inner rails to the appliance
1. Position the inner rail sections you just removed along the side of
the appliance making sure the screw holes line up. Note that
these two rails are left/right specific.
Illustration 4 Attaching the Inner Rail to the Appliance
2. Screw the rail securely to the side of the appliance with the
supplied screws.
3. Repeat the procedure for the other side of the appliance.
4. When installing to a four-post Telco rack, attach the rail brackets.
If you are installing the appliance into a two-post Telco rack,
proceed to Installing the Appliance into a Two-Post Telco Rack, on
page 14.
TTo attach the outer rails to the rack
1. Determine where you want to place the appliance in the rack.
2. Position the fixed rack rail/sliding rail guide assemblies at the
desired location in the rack, keeping the sliding rail guide facing
the inside of the rack.
3. Screw the assembly securely to the rack using the brackets
provided.

14 Rack-Mounting
4. Attach the other assembly to the other side of the rack, making
sure both are at the exact same height and with the rail guides
facing inward.
You should now have rails attached to both the appliance and the rack
unit. The next step is to install the appliance into the rack.
Note – Do not install the appliance upside down.
TTo install the appliance into the rack
1. Line up the rear of the inner rails with the front of the outer rails.
2. Slide the inner rails into the outer rails, keeping the pressure even
on both sides (you may have to depress the locking tabs when
inserting). When the appliance has been pushed completely into
the rack, you should hear the locking tabs "click".
3. Finish by inserting and tightening the thumbscrews that hold the
front of the appliance to the rack.
Proceed to Connecting the Cables, on page 18.
Installing the Appliance into a Two-Post Telco Rack
Once you have detached the inner rails from the rail assembly and
attached them to the appliance, you can continue installing the
appliance into a two-post Telco rack.
TTo attach the outer rails to the two-post Telco rack
1. Locate a pair of front (short) and rear (long) brackets supplied with
the appliance. The front brackets are marked with Up/Front Arrows
and the back brackets with Up/Rear arrows.
2. Secure the front (short) bracket (marked with Up/Front Arrows) to
the outer rail with two screws (see Illustration 5.)
Illustration 5 Securing Front Bracket to Outer Rail

Rack-Mounting 15
3. Attach the front (short) bracket to the front end of the rack and
secure it to the rack with two screws and two washers. See
Illustration 6.
Illustration 6 Attaching Front Bracket to Two-Post Telco Rack
4. Attach the rear (long) bracket to the rear end of the rack, and
secure it to the rack with two screws and two washers. See
Illustration 7.
Illustration 7 Attaching Rear Bracket to Two-Post Telco Rack

16 Rack-Mounting
5. Repeat steps 2-4 to install the other outer rail to the other side of
the rack.
TTo install the appliance into the two-post Telco rack
1. Measure the depth of your rack and adjust the length of the rails
accordingly.
2. Secure the rails to the appliance with screws (see Illustration 8).
Illustration 8 Securing the Rails to the Appliance
3. Line up the rear of the inner rails with the front of the outer rails.
Note – Do not install the appliance upside down.
4. Slide the inner rails which are attached to the appliance into the
outer rails on the rack. Keep the pressure even on both sides (you
may have to depress the locking tabs when inserting). When the
appliance has been pushed completely into the rack, you should
hear the locking tabs "click" (see Illustration 9).

Rack-Mounting 17
Illustration 9 Installing the Appliance into the Two-Post Telco Rack
5. Finish by inserting and tightening the thumbscrews that hold the
front of the appliance to the rack.
Proceed to Connecting the Cables, on page 18.

18 Connecting the Cables
Connecting the Cables
Illustration 10 Front Panel
TTo connect the cables
1. Choose one of the following:
• Connect a monitor to the VGA port and a keyboard to either of the
two USB ports.
• Or connect the supplied null-modem cable to the serial port and
to another computer that you will use for a terminal connection.
2. Connect the power cable to the AC power connector on the back of
the appliance.
3. Connect network cables to the ethernet ports (six in FW-1020,
eight in FW-1050 and FW-1200).
• You are free to choose which ethernet ports you connect to which
network. The ethernet ports are mapped to Interface IDs during
the initial configuration. The port number labels indicate the
numbering of the ethernet ports on the appliance.
Connecting the Appliance to the Power Supply
Plug the power cord into a grounded, high-quality power strip that offers
protection from electrical noise and power surges. We highly recommend
using an uninterruptible power supply (UPS) to ensure continuous
operation and minimize the risk of damage to the appliance in case of
sudden loss of power.
Note – Standby power is supplied to the system even when the
appliance is turned off.
Two USB ports
Serial port VGA monitor
Six or eight ethernet portsPS/2 keyboard

InitialConfiguration 19
Initial Configuration
To start using the appliance, you must activate the network interfaces
and establish a secure connection to the Management Server as
outlined in the sections below.
To successfully complete this configuration, the following prerequisites
must be met:
• The Firewall element must be defined in the Management Center
• If you use the configuration wizard to configure the engine, you must
have created a one-time password for this engine.
• If you want to import some of the initial configuration information in
the configuration wizard, save the initial configuration on a USB stick
or a floppy disk.
• If you want to configure the engine automatically with a USB stick,
save the initial configuration on a USB stick.
See the Firewall/VPN Installation Guide for details.
Note – The appliance must contact the Management Server before it
can be operational.
Connecting to the Appliance
You may not need to connect to the appliance at this point if you import
a configuration from a USB stick as explained in Configuring the Engine
Automatically, on page 20, and you are not interested in the console
messages that are displayed during this process.
In other cases, you need a physical connection to the appliance using a
monitor and keyboard or a serial cable connection from a computer with
a terminal program. By default, the monitor and keyboard connection is
enabled and the serial console is inactive. If you want to use a serial
connection, follow the instructions directly below. To use a monitor and
keyboard, just boot up the appliance.
TTo connect using a serial cable
1. Connect the serial cable supplied with the appliance to the serial
port on the appliance and to a computer.
2. On the computer, open a terminal with settings 9600bps, 8
databits, 1 stopbit, no parity.
3. Power on the appliance.

20 Initial Configuration
4. Press a key on your keyboard when you see “Press any key”. The
message is shown four times. If you do not press a key within this
time, the serial console remains inactive and you must reboot the
appliance to try again.
5. A boot menu is shown. Select the Switch to serial console option.
The appliance boots up with the serial console activated.
• The keyboard and display console is now inactive and must be
activated in a similar way before you can use it.
• To define two active consoles, use the command
sg-bootconfig. For usage, see “Command Line Tools” in the
Firewall/VPN Reference Guide, Administrator’s Guide or online
help of the Management Client.
There are two ways to configure the engine software.
• You can configure the engine automatically with a USB stick (see
Configuring the Engine Automatically below).
• If the automatic configuration is not possible or desired, you can use
the engine configuration wizard (see Configuring the Engine with the
Configuration Wizard, on page 21).
Configuring the Engine Automatically
The automatic configuration requires that you have a suitable
configuration saved on a USB memory stick. See the Firewall/VPN
Installation Guide or the online help of the Management Client for
details.
If you want to check the configuration before it is activated, follow the
instructions in Configuring the Engine with the Configuration Wizard, on
page 21, and import the configuration manually.
TTo import and activate a configuration from a USB
memory stick
1. Insert the USB stick that contains the configuration saved in your
Management Client in one of the USB ports on the appliance.
2. Turn on the appliance using the power on/off button. The
appliance automatically imports the configuration from the USB
stick and then tries to make the initial contact to the Management
Server.
• If the connection is successful, the appliance automatically
reboots itself and the engine configuration is finished.