F5000 | HP 200 Unified Threat Management (UTM) Appliance guide

•Support for management by its own Web-based management system or by IMC

The F1000-E uses a multi-core processor and provides the following interfaces:

•Four combo interfaces, for fiber/copper port switching

•Two interface module expansion slots, which support the following interface modules: 4GBE, 8GBE, 1EXP, and 4GBP.

Appearance

Figure 3 Front view

1: AC power switch (ON/OFF)	2: RPS receptacle (RPS)
3: CF card slot (CF CARD)	4: Device-mode USB port 1 (USB 1)
5: Host-mode USB port 0 (USB 0)	6: Console port (CONSOLE)
7: AUX port (AUX)	8: AC-input power receptacle (–100 to 240 VAC @ 50 or 60 Hz; 2.5 A)

Figure 4 Rear view

1:	Grounding screw and sign	2:	Combo interfaces (0 to 3)
3:	Interface module slot 2	4:	Interface module slot 1

F5000

Overview

The F5000 provides security protection for large enterprises, carriers, and data centers. It adopts multi-core multi-threaded and ASIC processors to construct a distributed architecture, which allows for the separation of the system management and service processing, making it a firewall that has the highest, distributed security processing capability.

The F5000 supports the following functions and features:

3

Image 9

HP 200 Unified Threat Management (UTM) Appliance manual F5000

Contents

HP Firewalls and UTM Devices Page Contents Page Iii Page F1000-A-EI/F1000-S-EI OverviewOverview Appearance Front view F1000-E F5000 Aspf Firewall modules Enhanced firewall modules Firewall module for 5800 switches UTM products U200-A front view U200-A F1000-A-EI/F1000-S-EI Application scenariosU200-S Firewall application VPN application Virtual firewall application F1000-E Firewall modules F5000 Clound computing data center application Enhanced firewall modules Enterprise network applicatoin Remote access application UTM Network diagram Login methods at a glance Login overviewLogin methods Login method Default setting and configuration requirements User interface Login method CLI login method and user interface matrixCLI user interfaces User interface assignmentPage Parameter Default Default console port propertiesLogging in to the CLI Logging in through the console port for the first time Connection description Setting the properties of the serial port Configuring console login control settings Authentication Configuration tasks Reference Mode Configuring none authentication for console loginCommand Remarks Last-number Configuring scheme authentication for console login Configuring password authentication for console login Password Configuration GuideDomain domain-name Hwtacacs-scheme-name Speed speed-value Configuring common console user interface settings optional Logging in through Telnet Telnet login Device role Requirements Telnet server and Telnet client configuration requirements Configuring none authentication for Telnet login Telnetting to the device without authentication Configuring password authentication for Telnet login Password authentication interface for Telnet login Configuring scheme authentication for Telnet login User only depend on the user Step Command Remarks Configuring common VTY user interface settings optional Command Using the device to log in to a Telnet serverCharacter Value To use the device to log in to a Telnet server Logging in through SSH SSH server and client requirements Configuring the SSH server on the device Ldap-scheme-name Using the device to log in to an SSH server Local login through the AUX portStarted Command Reference Ssh2 server AUX login diagram Hardware Feature compatible Configuring none authentication for AUX login Configuring password authentication for AUX login Password authentication interface for AUX login Configuring scheme authentication for AUX login Apply the specified AAA Ip alias ip-address port-number Configuring common settings for AUX login optional Display type of both the device Default AUX port properties Login procedure Connecting the AUX port to a terminal Power on the device and press Enter at the prompt Task Command Remarks Displaying and maintaining CLI loginInclude regular-expression Regular-expression Send all num1 aux console Available in user view Vty num2 Configuration guidelines Logging in by using the default Web login settingsLogging in to the Web interface Configuring Web login Adding a Web login account Basic Web login configuration requirements Configuring Http loginObject Requirements Web captcha verification-code Configuring Https login Interface interface-type Interface-numberVerification-code Policy-name VPN Configuration Guide Mask mask-length Https Http login configuration example Displaying and maintaining Web loginConfiguration procedure Network requirements Https login configuration example # Enable the Https service # Associate the Https service with SSL server policy mysslConfigure the host Https client # Create RSA local key pairs Failure to access the device through the Web interface Troubleshooting Web browserSymptom Configuring the Internet Explorer settings Internet Explorer setting Click OK in the Security Settings dialog box Configuring Firefox Web browser settings Firefox Web browser setting Configuring Snmp access Accessing the device through SnmpConfiguring SNMPv3 access Prerequisites Ipv6 ipv6-acl-number See Getting Started Command Reference Configuring SNMPv1 or SNMPv2c accessPriv-password acl acl-number acl ipv6 ipv6-acl-number Notify-view acl acl-number acl StepCommand Remarks Snmp login example# Enable the Snmp agent # Configure an Snmp groupPage Feature and hardware compatibility Logging in to the firewall module from the network deviceLogging in to the firewall module from the network device Configuring the Acsei protocol Resetting the system of the firewall module Configuring Acsei server on the network device Acsei timersAcsei starts up and runs in the following procedures Acsei startup and running Displaying and maintaining Acsei server and client Configuring Acsei client on the firewall moduleNetwork requirements Client-id # Set the clock synchronization timer to 10 minutes Configuration procedure# Set the monitoring timer to 10 seconds # Log in to the firewall modulePage Basic configuration Performing basic configuration in the Web interfaceOverview Click Next For basic configuration appears Basic configuration wizard-1/6 Click Next For configuring service management appears Basic configuration wizard-2/6 basic information Basic configuration wizard-3/6 service management Assign IP addresses to the interfaces Another service Configuration items Click Next For configuring NAT appearsConfigure the parameters as described in Table IP/Wildcard Basic configuration wizard-6/6 Performing basic configuration at the CLI Interface interface-type Global-nameIp address ip-address mask-length mask Zone name zone-name id zone-id Configuration Configuring the device name at the CLI Configuring the device name in the Web interfaceManaging the device Hardware Supported storage medium Configuring the system time in the Web interface Configuring the system timeDisplaying the current system time Calendar Configuring the network time Source Interface Configuring the time zone and daylight saving time This example, Device a is the firewall Date and time configuration example Configuring the local clock as the reference clock Configuration guidelines Configuring the system time at the CLI Date-time System time configuration resultsZone-offset Date-time ± zone-offset Zone-offset + Date-time ± zone-offset + To change the system timeSummer-offset Both date-time Setting the idle timeout timer in the Web interface Setting the idle timeout timer at the CLITo set the idle timeout timer To enable displaying the copyright statement Configuring bannersEnabling displaying the copyright statement Banner message input modes To configure banners Configuring the maximum number of concurrent users Configuring the exception handling method Rebooting the deviceRebooting the firewall in the Web interface Rebooting the firewall at the CLI Rebooting devices immediately at the CLIScheduling a device reboot Job configuration approaches Scheduling jobsComparison of non-modular and modular approaches Scheduling a job in the modular approach Scheduling a job in the non-modular approachJob job-name View view-name Scheduled job configuration example Time time-id at time date command command# Create a job named pc1, and enter its view # Create a job named pc2, and enter its view Setting the port status detection timer# Create a job named pc3, and enter its view # Display information about scheduled jobs Configuring basic temperature thresholds Configuring temperature thresholds for a device or a moduleConfiguring advanced temperature thresholds To set the port status detection timer Monitoring an NMS-connected interface Clearing unused 16-bit interface indexes Verifying transceiver modules Verifying and diagnosing transceiver modulesDiagnosing transceiver modules Interface-number begin Command Reference Displaying and maintaining device managementSee Getting Started Task Command Remarks Task Command Remarks Configuring a local user in the Web interface Managing usersUser levels Click Add Configure a local user, as described in Table Click Apply Configuration example Service type feature and hardware compatibilityItem Description Configuring a local user at the CLI Controlling user loginsConfiguring Telnet login control Source sour-addr sour-wildcard Configuring source IP-based Telnet login controlVpn-instancevpn-instance-name Ipv6-address prefix-length Telnet login control configuration example Configuring source MAC-based Telnet login controlRule-string Getting Started Configuring source IP-based Snmp login control Ipv6 ipv6-acl-number Snmp login control configuration exampleRead-view write-viewwrite-view Group-name acl acl-number acl ipv6 Configuring source IP-based Web login control Configuring Web login control Logging off online Web users Web login control configuration exampleSource sour-addr sour-wildcard N/A any time-range User-id user-nameuser-name Field Description Displaying online users Command conventions Using the CLICommand conventions Convention Description CLI views Using the undo form of a command Entering system view from user view Task CommandReturning to the upper-level view from any view Returning to user view from any other view Accessing the CLI online help Editing a command line Entering a commandAbbreviating commands Command line editing keys Configuring and using hotkeys Configuring and using command keyword aliasesTo configure a command keyword alias Usage guidelines Enabling redisplaying entered-but-not-submitted commands System-reserved hotkeysHotkey Function Using the command history function Understanding command-line error messagesCommon command-line error messages Error message Cause Setting the command history buffer size for user interfaces Viewing history commandsPausing between screens of output Controlling the CLI output Filtering the output from a display command Special characters supported in a regular expressionCharacter Meaning Examples String1string2string2. string1string2\1\2 Contain stringstring. string1string2\2 repeatsString1string2string1string2 Matches character1character2 A being character2, but does not match 2a Configuring user privilege and command levels Configuring a user privilege level Command levels and user privilege levelsLevel Privilege Default set of commands Last-num1 vty first-num2 Last-num2 Management and Maintenance By default, the user privilege level Switching the user privilege level Privilege level switching authentication modes Authentication mode Keywords DescriptionInformation, see Access Control Configuration Guide Information required for user privilege level switching Switching to a higher user privilege level Changing the level of a command Saving the running configurationTo change the level of a command View command Support and other resources Contacting HPRelated information Symbols Command conventionsConventions GUI conventions Port numbering in examples Network topology icons Index 144