HP TippingPoint Next Generation Firewall Hardware Specification and Installation Guide Abstract This guide describes the HP TippingPoint Next Generation Firewall Appliance hardware specifications, chassis components, and installation requirements and instructions. This information is intended for network and security administrators, or IT specialists responsible for installation and setup of the NGFW Appliance.
Legal and notice information © Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company makes no warranty of any kind with regard to this material, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
Table of Contents About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .ix Target Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Document Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Attach Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Check LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 A Connector and Cable Pinout Specifications . . . . . . . . . . . . .
List of Figures Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure 1-1 - HP TippingPoint NGFW S1050F Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1-2 - HP TippingPoint NGFW S3020F Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1-3 - HP TippingPoint NGFW S8010F Appliance . . . . . . . . . . . . . . . . . . . . . . . . .
vi
List of Tables Table Table Table Table Table Table Table Table Table Table Table Table Table 1 - Document Typographic conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x 2 - Customer Support Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xi 1-1 - Hardware Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
viii
About This Guide The HP TippingPoint Next Generation Firewall (NGFW) provides a high performance enterprise-class application-aware firewall and VPN terminator with HP TippingPoint IPS and other DPI capabilities. This guide summarizes the features and capabilities provided by the NGFW Appliance.
Document Conventions This guide uses the following document conventions. • Typefaces, page 2 • Document Messages, page 2 Typefaces HP TippingPoint publications use the following typographic conventions for structuring information: Document Typographic Conventions Convention Element Medium blue text: Link Cross-reference links and e-mail addresses Blue, underlined text (http://www.hp.
IMPORTANT: Another type of note that provides clarifying information or specific instructions. TIP: Tips provide helpful hints and shortcuts, such as suggestions about how you can perform a task more easily or more efficiently. Customer Support HP TippingPoint is committed to providing quality customer support to our customers. Each customer is provided with a customized support agreement that provides detailed customer and support contact information.
HP Contact Information For the name of the nearest HP authorized reseller, see the contact HP worldwide web site: • http://www.hp.com/country/us/en/wwcontact.
1 Overview The HP TippingPoint Next Generation Firewall is the latest offering in the comprehensive security suite of HP TippingPoint products. The Next Generation Firewall (NGFW) is a high-performance, enterprise-class solution that offers a range of appliances designed to address the needs of various network topologies. The NGFW Appliances offer protection for networks ranging from single-point-of-entry networks to complex enterprise networks and data centers.
The following figure shows an NGFW S1000 Series Appliance: Figure 1-1 HP TippingPoint NGFW S1050F Appliance For technical specifications and additional details about the S1050F appliance, see ”HP TippingPoint S1000 Series” on page 5. HP S3000 Series Appliances The HP S3000 Series comprises 2U form-factor appliances designed for medium-sized deployments, such as on university campuses.
The following figure shows an NGFW S8000 Series Appliance: Figure 1-3 HP TippingPoint NGFW S8010F Appliance For technical specifications and additional details about these models, see ”HP TippingPoint S8000 Series” on page 15.
4 Overview
2 HP TippingPoint S1000 Series This information describes the components, chassis, requirements, and installation specifics of the HP TippingPoint S1000 Series Next Generation Firewall Appliances.
Chassis Back Panel The following illustration shows a rear-panel view of an S1050F appliance.
Fans and Power Supplies The S1050F appliance includes one power supply and three cooling fans. These components are not customer-replaceable. For more information about these components, see ”Power Supply and Fan Modules” on page 33. External Storage Card The S1050F appliance includes a CFast card slot. The external storage card stores system logs, snapshots, and other system data.
WARNING! Do not attempt to install a DC power supply into an NGFW Appliance. The NGFW Appliance does not contain the grounding capability for safe installation of a DC power supply. Bodily harm and damage to the system could result. Cabling Requirements The S1050F appliance ships with the following cables: • One AC power cable • Null modem cable for the serial console management port (DB-9 to RJ-45) shown in Figure 2-3 on page 7.
3 HP TippingPoint S3000 Series This information describes the components, chassis, requirements, and installation specifics of the HP TippingPoint S3000 Series Next Generation Firewall Appliances.
Chassis Back Panel The following illustration shows the rear-panel view of an S3000 Series appliance.
• Flashing Yellow — Hardware problem detected. Software running normally. • Off — Appliance power is off. Fans and Power Supplies The S3000 Series appliances include two power supplies and three cooling fans. These components are hot-pluggable. For more information about these components, see ”Power Supply and Fan Modules” on page 33. External Storage Card The S3000 Series appliances include a CFast card slot. The external storage card stores system logs, snapshots, and other system data.
Model Requirements The following topics describe the power and cabling requirements for the S3000 Series appliances. • ”Power Requirements” on page 12 • ”Cabling Requirements” on page 12 Power Requirements The S3000 Series appliances require one input of Alternating Current (AC) that must meet the following requirements: • AC: Voltage 100V – 240V; 12 – 6 amp; 47 – 63 Hz WARNING! Do not attempt to install a DC power supply into an NGFW Appliance.
Table 3-2 S3000 Series Appliance Hardware Specifications Specification Description Humidity: 5% to 95% (non-condensing) External interfaces • 1 – 1GbE copper management port • 1 – 1 RJ-45 console port • 8 – 1GbE copper ports • 8 – 1GbE SFP fiber ports • 1 external storage card drive Hardware Installation and Configuration For general instructions on installing the NGFW Appliance, see ”Installing the NGFW Appliance” on page 21.
14 HP TippingPoint S3000 Series
4 HP TippingPoint S8000 Series This information describes the components, chassis, requirements, and installation specifics of the HP TippingPoint S8000 Series Next Generation Firewall Appliances.
NOTE: The S8000 Series appliances have two dedicated high availability (HA) ports. For more information about HA configurations, refer to the Concepts and Deployment Guide. Chassis Back Panel The following illustration shows the rear-panel view of an S8000 Series appliance.
Alert Indicator The Alert indicator is located on the right side of the front panel and indicates the current status of the software processes and the hardware. • Solid Green — Both the hardware and the software processes are running normally. • Solid Yellow — System is booting. If the solid yellow indicator remains after startup, a software problem has been detected. Hardware status is undefined. • Flashing Yellow — Hardware problem detected. Software running normally. • Off — Appliance power is off.
The management port LEDs indicate link and activity state, as described in the following table. Table 4-1 Management Port LED Descriptions LED Type Color Description Link Green Link is active at 1000Mbps. Off Link is inactive, or is active at 10Mbps or 100Mbps. Blinking amber Data traffic is passing. Off No traffic is passing. Activity Eight 1GbE SFP fiber ports and four 10GbE SFP+ ports are also available on the S8000 Series appliances.
Technical Specifications The S8000 Series appliances have the following hardware specifications: Table 4-2 S8000 Series Appliance Hardware Specifications Specification Description Dimensions (unpackaged) 2U – 3.46 in (H) x 16.77 in (W) x 18.70 in (D) (8.80 cm x 42.60 cm x 47.50 cm) Weight 26.26 lbs (11.
20 HP TippingPoint S8000 Series
5 Installing the NGFW Appliance After you have completed preparation procedures and unpacked the HP TippingPoint NGFW Appliance, you are ready to install and configure the components. Have the CLI Reference available for configuration information reference. After installation of the hardware components, complete the OBE Setup Wizard requirements as part of the installation and configuration procedures.
• Bracket screws for attaching the brackets to the chassis. Your NGFW Appliance can be stored on a desktop, on a shelf, or in a rack. If you are bolting the appliance to the rack, follow these guidelines. WARNING! To prevent bodily injury when mounting or servicing this unit in a rack, you must take special precautions to ensure that the system remains stable. • If the rack comes with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack.
mid-mount. Figure 5-2 S1000 Series Chassis with Front Mounting in a Two-Post Rack Figure 5-3 S1000 Series Chassis with Mid-Mounting in a Two-Post Rack Four-Post Rack Mount for 1U Chassis 1. After attaching the front rack-mounting brackets to the appliance as described in ”Two-Post Rack Mount for 1U Chassis”, attach the two slide-bracket screws (provided in the kit) on each side of the chassis. 2.
rear-mount brackets attached. Figure 5-4 S1000 Series Chassis in a Four-Post Rack Rack-Mounting the S3000 or S8000 Series Models The S3000 and S8000 Series models are 2U appliances that you can install using a front mount or mid-mount in a two-post rack, or front and rear mount in a four-post rack. Two-Post Rack Mount for 2U Chassis You can choose to install your chassis into a two-post rack using a front mount or a mid-mount: 1.
Figure 5-6 S3000 or S8000 Series Model with Front Mounting in a Two-Post Rack Figure 5-7 S3000 or S8000 Series Model with Mid-Mounting in a Two-Post Rack Four-Post Rack Mount for 2U Chassis The S3000 and S8000 Series models ship with a slide rail kit to mount the appliance to a four-post rack. Slide rail kits are also available for order from TippingPoint. Refer to the instructions in the slide rail kit for information about installing the slide rails.
Use Figure 5-8 as a reference for how a 2U chassis is installed in a four-post rack with slide rails. Figure 5-8 S3000 or S8000 Series Chassis in a Four-Post Rack Connect the Power Supply After you have bolted the appliance to the rack, attach the power supply AC connections. To turn power on for the S1050F appliance, flip the power switch on the back panel of the appliance. To turn the power on for the S3000 or S8000 appliance, use the power button located on the front panel of the appliance.
4. Using the NGFW LSM or the command line interface, configure your firewall rules according to your traffic flow requirements. For more information about HP TippingPoint NGFW Appliance network configuration and connections, refer to the Local Security Manager User Guide and the CLI Reference. Check LEDs When you connect power to the appliance, the system completes a series of component checks. It then displays LEDs to show the status of each component.
28 Installing the NGFW Appliance
A Connector and Cable Pinout Specifications This information provides connector and pinout information for the NGFW Appliance and contains the following topics: • ”RJ-45 (COM) Console” on page 29 • ”RJ-45 Ethernet Connectors” on page 29 • ”Pluggable Transceivers” on page 30 RJ-45 (COM) Console The following figure displays the RJ-45 connector and Table A-1 shows the RJ-45 console connector pinouts.
Table A-2 RJ-45 Ethernet Connector Pinouts Pin Number Signal Name 7 Ground (GND) 8 Ground (GND) NOTE: These ports can auto-negotiate their mode and can automatically detect whether they should operate in straight-through or cross-over mode. Use the following pinout information when your RJ-45 device is operating in 1000Mbps (1GbE) mode.
Next Generation Firewall Hardware Specification and Installation Guide 31
32 Connector and Cable Pinout Specifications
B Power Supply and Fan Modules This appendix provides installation instructions for power supply modules and fans. The following subjects are discussed. • ”The S3000 or S8000 Series AC Power Supply” on page 33 • ”NGFW Fans” on page 34 WARNING! This product might have more than one power supply source. All power sources must be removed to de-energize the unit. NOTE: The S3000/S8000 Series appliances have hot-swappable fans and power supplies. They have no other serviceable parts inside.
WARNING! Do not attempt to install a DC power supply into an NGFW Appliance. The NGFW Appliance does not contain the grounding capability for safe installation of a DC power supply. Bodily harm and damage to the system could result. When the AC power supply has been securely placed in the appliance, use the following procedure to connect power to the AC power supply: 1. Locate the male power input on the back of the chassis. 2. Plug one end of a standard female power plug into the power input. 3.
The NGFW Spare Fan (5066-3329) is a replacement unit and can only be used with NGFW S3000/S8000 Series appliances. Figure B-2 NGFW Fan Unit 1 Attachment Screw Knobs 2 Fan Assembly Before you begin, determine which fan assembly is faulty and needs to be replaced. When a fan module fails or its RPM rate falls below a certain threshold, the system generates a warning or critical alarm message in its logs.
36 Power Supply and Fan Modules
C Using the External CFast Storage Card This information describes the external storage card and provides the following topics: • ”About the External CFast Storage Card” on page 37 • ”CFast Card Commands” on page 38 About the External CFast Storage Card All NGFW Appliances come with a pre-formatted external CFast storage card. NOTE: Only CFast cards available from HP TippingPoint have been validated to achieve optimal performance with HP TippingPoint products. Other vendor cards are not supported.
CFast Card Commands The following table lists the commands used to manage the external storage card in the CLI. Refer to the CLI Reference for detailed documentation of these commands. Table C-1 External Storage Card Commands Command Description user-disk format Formats a card. Any existing data on the card will be erased. NOTE: Only cards that are mounted and formatted manually by the user will be mounted automatically by the appliance when it boots.
Table C-1 External Storage Card Commands Command Description show user-disk Shows the card’s operation status, capacity, used and free space, and whether it is encrypted. master-key set Encrypts the external CFast card and the system keystore using the system master-key. You are prompted to enter a master-key that is between 9 and 32 characters in length, contains a combination of numbers and uppercase and lowercase letters, and that has at least one special character (for example, !@#).
40 Using the External CFast Storage Card
Index A S AC power supply 33 S1000 Series models 1 overview 1 S1050F appliance back panel 6 cabling requirements 8 external CFast card 7 fans 7 features 6 front panel 5 management port 7 overview 5 ports 7 power indicator 6 power requirements 7 power supply 7 power switch 6 technical specifications 8 S3000 Series models 2 overview 2 S3010F appliance back panel 10 cabling requirements 12 external CFast card 11 fans 11 features 10 front panel 9 management port 11 overview 9 ports 11 power button 10 power r
S8005F appliance back panel 16 cabling requirements 18 external CFast card 17 fans 17 features 16 front panel 15 management port 17 overview 15 ports 17 power button 16 power requirements 18 power supplies 17 technical specifications 18 S8010F appliance back panel 16 cabling requirements 18 external CFast card 17 fans 17 features 16 front panel 15 management port 17 overview 15 ports 17 power button 16 power requirements 18 power supplies 17 technical specifications 18 small form-factor pluggable transceive
