advertisement
Hardware Guide
Revision B
McAfee Next Generation Firewall
Models 5201, 5205, 5206
Thank you for choosing a McAfee
®
Next Generation Firewall (McAfee NGFW) 3U appliance. Familiarize yourself with the appliance ports and indicators and learn how to install the appliance safely.
Appliance features
Familiarize yourself with the front panel, back panel, and indicator lights.
Model 5201, 5205, and 5206 features
The figures and tables show the appliance components.
Front panel
1
2
1
Interface module slots 1–6 (left to right)
2
Console port (speed 9600 bps; not used on 5206 appliances)
3
Indicator lights
4
Power button
5
Solid-state drives (SSDs) (only the left drive is used)
5201 and 5205 appliance back panel
1
AC or DC power connectors
2
IPMI port (usage not recommended)
3
Console port (not used)
4
PS/2 ports
5206 appliance back panel
5
USB ports
6
VGA port
7
Fixed Ethernet ports
1
AC or DC power connectors
2
IPMI port (usage not recommended)
3
Console port (speed 9600 bps)
4
USB ports
5
Fixed Ethernet ports
6
VGA port
Ethernet port names
Ethernet port names are based on the slot and port numbers. The first number in the name represents the slot on the appliance. The second number represents the port on the slot. Example: eth2_0 is located on port 0 of slot 2.
Component Slot number Slot location Port numbers
Fixed Ethernet ports
0 Back panel eth0_0 and eth0_1.
Interface modules 1–6
The slot numbers for the interface modules start from 1 and increase from left to right.
Front panel The port numbers start from 0 and increase from left to right.
Example: The port farthest to the left in slot 1 is eth1_0.
Front panel indicator lights
Indicates a power supply cable is detached.
When flashing, indicates a fan failure.
When continuously on, indicates an overheat condition, which can be caused by cables obstructing the airflow in the system or the ambient room temperature being too warm.
When flashing, indicates network activity on the onboard Ethernet interface 1. The interface is on the back panel of the appliance.
When flashing, indicates network activity on the onboard Ethernet interface 0. The interface is on the back panel of the appliance.
When flashing, indicates SSD activity.
Indicates power is supplied to the system power supply units. This indicator is illuminated when the system is operating normally.
SSD indicators
3
4
Number
1
2
Indicator
Power
Disk
Fixed Ethernet port indicators
Status
Blue
Unlit
Explanation
An SSD is in the bay.
This indicator is not used.
Number
1
2
Indicator
Activity
Link
Color
Yellow
Unlit
Green
Amber
Explanation
Link OK, blinks on activity.
No link or the speed is 10 Mbps.
Speed is 100 Mbps.
Speed is 1 Gbps.
Interface modules
McAfee NGFW appliances support four types of modules.
• Copper
• Fiber
• SFP
• Placeholder
Do not remove any stickers from modules — they contain important information.
Copper interface modules
McAfee NGFW appliances support these copper interface modules.
Dual-port modules
• MOD-EM1-10G-2 (10G2) — 10 gigabit interface module
• MOD-EM1-10G-2-B (10G2B) — 10 gigabit bypass module
Number Component
1 Release lever
2 Activity/link indicator
3 MOD-EM1-10G-2 (10G2) — Link speed indicator
MOD-EM1-10G-2-B (10G2B) — Link speed/ bypass/disconnect indicator
Color Description
N/A N/A
Green Link OK, blinks on activity.
Yellow 1 Gbps link.
Green 10 Gbps link.
Amber 1 Gbps link, blinks in disconnect mode.
Green 10 Gbps link, blinks in bypass mode.
Quad-port modules
• MOD-EM1-GE-4 (GE4) — Gigabit interface module
• MOD-EM1-GE-4-B (GE4B) — Gigabit bypass module
2
3
Number Component
1 Release lever
Activity/link indicator
MOD-EM1-GE-4 (GE4) — Link speed indicator
Color Description
N/A N/A
Green Link OK.
Green 1 Gbps link.
Amber 100 Gbps link.
MOD-EM1-GE-4-B (GE4B) — Link speed/ bypass/disconnect indicator
Yellow 1 Gbps link, blinks in disconnect mode.
Green 100 Mbps link, blinks in bypass mode.
Unlit 10 Mbps link.
5
6
Six-port gigabit interface module
MOD-EM1-GE-6 (GE6)
Number
1
2
3
Component
Release lever
Activity/link indicator
Link speed indicator
Eight-port gigabit interface module
MOD-EM1-GE-8 (GE8)
Color
N/A
Green
Green
Description
N/A
Link OK.
1 Gbps, 100 Mbps, or 10 Mbps link.
Number
1
2, 5
3, 6
Component
Port numbers 0–7
Activity/link indicator
Link speed indicator
4 Release lever
Color
N/A
Green
Yellow
Green
Unlit
N/A
Description
N/A
Link OK, blinks on activity.
1 Gbps link.
100 Mbps link.
10 Mbps link.
N/A
Fiber interface modules
McAfee NGFW appliances support these fiber interface modules.
Dual-port bypass modules
• MOD-EM1-GE-SX-2-B (GESX2B) — Gigabit bypass module
• MOD-EM1-10G-SR-2-B (10GSR2B) — 10 gigabit bypass module
• MOD-EM1-10G-LR-2-B (10GRL2B) — 10 gigabit bypass module
2
3
Number Component
1 Release lever
Activity/link indicator
MOD-EM1-10G-SR-2-B, MOD-EM1-10G-LR-2-B
— Link speed/bypass/disconnect indicator
MOD-EM1-GE-SX-2-B — Link speed/bypass/ disconnect indicator
Color Description
N/A N/A
Green Link OK.
Blue 10 Gbps link.
Green Blinks in bypass mode.
Green 1 Gbps link, blinks in bypass mode.
Yellow Blinks in disconnect mode.
Quad-port gigabit bypass module
MOD-EM1-GE-SX-4-B (GESX4B)
Number Component
1
2
Release lever
Activity/link indicator
Color Description
N/A N/A
Green Link OK.
7
Number Component
3 Link speed/bypass/disconnect indicator
Color Description
Green 1 Gbps link, blinks in bypass mode.
Yellow Blinks in disconnect mode.
SFP interface modules
McAfee NGFW appliances support these SFP interface modules.
Dual-port 10 gigabit interface module (SFP+)
MOD-EM1-10G-SFP-2 (10GSFP2)
2
3
Number
1
Component
Release lever
Activity/link indicator
Link speed indicator
Color
N/A
Green
Blue
Quad-port interface modules
• MOD-EM1-GE-SFP-4 (GE4SFP) — Gigabit interface module (SFP)
• MOD-EM2-10G-SFP-4 (10GSFP4) — 10 gigabit interface module (SFP+)
Description
N/A
Link OK.
10 Gbps link.
8
Number Component
1 Release lever
2 Activity/link indicator
Color Description
N/A N/A
Green Link OK.
Number Component
3 MOD-EM1-GE-SFP-4 (GE4SFP) — Link speed indicator
MOD-EM2-10G-SFP-4 (10GSFP4) — Link speed indicator
Color Description
Yellow 1 Gbps link.
Blue 10 Gbps link.
Amber 1 Gbps link.
Placeholder modules
A placeholder module (MOD-PH) does not contain a network interface card or any ports.
If you do not have interface modules that contain a network interface card for all slots in the modular appliance, you must insert placeholder modules in the remaining slots.
Precautions
The precautions provide safety guidance when working with McAfee NGFW appliances and electrical equipment.
Safety precautions
Read the safety information and follow the procedures whenever you are working with electronic equipment.
General safety
Follow these rules to ensure general safety.
• Keep the area around the appliance clean and free of clutter.
• The appliance weighs approximately 44 lbs (20 kg) when fully loaded. When lifting the appliance, two people at each end should lift slowly with their feet spread out to distribute the weight. Always keep your back straight and lift with your legs.
• Use a regulating uninterruptible power supply (UPS) to keep your system operating if there is a power failure and to protect the appliance from power surges and voltage spikes.
• If you need to switch off or unplug the appliance, always wait at least five seconds before turning on or plugging in the appliance again.
Operating precautions
• Do not open the power supply casing. Only the manufacturer's qualified technician can access and service power supplies.
• Keep the cover in place when the appliance is on to ensure proper cooling. Failure to adhere to this guidance could void your warranty.
For additional safety information, see the McAfee Network Security Device Product Safety and
Regulatory Compliance Hardware Guide at PD23573 .
9
10
Electrical safety precautions
Follow basic electrical safety precautions to protect yourself from harm and the appliance from damage.
• Know the locations of the power on/off button and the emergency turn-off switch, disconnection switch, or electrical outlet for the room. If an electrical accident occurs, this allows you to quickly turn off power to the system.
• When working with high-voltage components, do not work alone.
• Turn off the system and disconnect the power before removing or installing system components.
• When working with electrical equipment that is turned on, use only one hand. This is to avoid making a complete circuit, which causes an electric shock. Use extreme caution when using metal tools, which can easily damage any electrical components or circuit boards the tools come into contact with.
• Do not use mats designed to decrease electrostatic discharge as protection from electric shock.
Instead, use rubber mats that have been specifically designed as electrical insulators.
• The power supply cable must include a grounding plug and must be plugged into a grounded electrical outlet.
Power supply safety precautions
Depending on the type of power supply that your McAfee NGFW appliance uses, different safety precautions and installation guidelines apply.
AC power supplies
The appliance has 1–2 connectors for an AC power supply. The appliance inlet is the disconnect device.
DC power supplies
• The appliance must be used in a restricted access location and users must be well trained to operate it.
• The outlet for the appliance must be installed near the appliance and be easily accessible.
• The appliance must be protected against electric shock and must have, at minimum, a 15 AWG wire provided for the DC power supply.
• The mains supply plug on the power supply cable is the disconnect device on the appliance. To disconnect the appliance, you must first disconnect the mains, then disconnect the ground.
Install the appliance
Prepare and install the appliance in your network.
Before you begin
• You have installed a Security Management Center (SMC) on a separate server.
• You have configured the Security Engine element (Firewall, IPS, or Layer 2 Firewall) in the Management Client, and saved the initial configuration on a USB drive.
For additional information on SMC installation and initial configuration, see the McAfee
Next Generation Firewall Installation Guide.
• You have inspected the appliance, the delivery box, and all components included in the shipment.
Do not use damaged appliances or components.
Tasks
•
Install the SSD if it is not already installed.
•
Install an interface module on page 12
If needed, install any interface modules.
•
Rack-mount the appliance on page 12
The rack-mounting procedure varies depending on the type of rack unit. If needed, see the documentation for your rack unit.
•
Connect the network, management, and power supply cables.
Install the SSD
Install the SSD if it is not already installed.
There are two SSDs on the front panel of the appliance. Use only the drive on the left.
Task
1
McAfee recommends using a grounding strap when handling an SSD.
Uninstalled SSDs are sensitive to damage from electrostatic discharge.
2
Press the release button on the SSD to release the lever.
3
Insert the SSD into the bay.
4
Push the lever down to lock the SSD into position.
See also
11
12
Install an interface module
If needed, install any interface modules.
Before you begin
• Read the safety precautions.
• To avoid damaging the modules or the appliance, do not install or remove any interface modules if the appliance is turned on.
• Make sure any interface modules you install are the correct type for your appliance.
You must install an interface module or a placeholder module in each slot before making the appliance operational.
Task
1
McAfee recommends fastening a grounding strap to your wrist, contacting your bare skin. Attach the other end of the strap to the appliance.
2
Locate the slot to install the module in.
3
Push the module into the slot.
The module is seated correctly when the front panel of the module is slightly above the front panel of the appliance.
Make sure that the sticker on the module cover faces up on 5201 and 5205 appliances. On 5206 appliances, the sticker is on the right.
Do not insert the module in the wrong orientation. Inserting the modules incorrectly might damage the appliance and the modules and voids the warranty.
See also
Rack-mount the appliance
The rack-mounting procedure varies depending on the type of rack unit. If needed, see the documentation for your rack unit.
• Read the safety precautions before you rack-mount the appliance.
• Due to the size and weight of the appliance, use a four-post rack. Do not install the appliance into a two-post rack, which can damage the appliance and void the warranty.
• Do not install the appliance into a Telco rack, which can damage the appliance.
• Do not install the appliance upside down.
Tasks
•
Install the appliance in a four-post rack on page 13
Use the rack-mounting rails to secure the appliance in the rack.
See also
Preparing for rack-mounting
The appliance delivery includes the mounting screws and the rail assemblies or rack-mounting brackets to install the system into the rack.
Determine the placement of each component in the rack.
• Install the heaviest components on the bottom of the rack first. Install components from the bottom to the top.
• The appliance must be connected to a grounded power outlet.
• Use a UPS to protect the appliance from power surges and voltage spikes, and to keep your system operating if there is a power failure.
• To maintain proper cooling, always keep the front door of the rack and all panels and components on the appliances closed when not servicing.
Install the appliance in a four-post rack
Use the rack-mounting rails to secure the appliance in the rack.
Use rail sets of these lengths for installing the appliance in the rack.
• 19–26.6 inches
• 26.5–36.4 inches
Task
1
Locate the two pairs of brackets, two inner rails that attach to the appliance, and two outer rails that attach to the rack.
The rails are marked with "L" for left and "R" for right.
1
Outer rail
2
Inner rail
3
Locking tab
2
Detach the inner rails from the outer rails by pressing the locking tab to release the inner rails.
3
Locate the rail buttons on the side of the appliance and the corresponding holes on an inner rail.
13
14
4
Align the holes against the corresponding buttons. When all are aligned, push the holes toward the corresponding buttons.
1
Front of appliance
2
Top of appliance
3
Screws
5
Secure the rail to the appliance with a screw.
6
Attach the second inner rail to the other side of the appliance.
7
Insert the outer rails to the rack.
If necessary, push the locking tab on the rail to pull out the outer rails.
8
Attach the outer rails to the rack with two screws through the holes at the ends of the rails.
9
Line up the rear of the inner rails with the front of the extended outer rails.
1
Top of appliance
2
Front of appliance
10 Slide the inner rails into the outer rails, keeping the pressure even on both sides.
You might have to press the locking tabs when inserting the rails.
When the appliance is pushed completely into the rack, the locking tabs click as the rails lock.
Connect the cables
Connect the network, management, and power supply cables.
The Intelligent Platform Management Interface (IPMI) port on the back panel is not supported. Do not connect a cable to the IPMI port. The IPMI uses DHCP to acquire an IP address. If an unauthorized user determines the IPMI IP address and the system credentials, the user can access and manage the appliance remotely and compromise the security of the system.
Tasks
•
Connect network and management cables on page 17
Connect the appliance to your networks. The management connection allows you to view the system console.
•
Connect network cables to SFP ports on page 17
If you installed an SFP interface module on the appliance, insert the copper or fiber-optic
SFP transceiver into the module and connect the cables.
•
Connect the power supplies on page 17
Connect cables to the power supplies on the back of the appliance.
Network settings and cables
Follow these network settings and cable guidelines.
Copper cable types
Use CAT 6 cables for gigabit networks and CAT 5e cables for other networks.
15
16
(IPS and Layer 2 Firewall only) Always use standard cabling methods. Use crossover cables to connect the appliance to hosts and straight cables to connect the appliance to switches or hubs.
Speed and duplex settings
Network interfaces at both ends of each cable must have identical speed and duplex settings. This includes the automatic negotiation setting. If one end of the cable uses autonegotiation, the other end must also use autonegotiation. Gigabit standards require interfaces to use autonegotiation — fixed settings are not allowed at gigabit speeds.
(IPS and Layer 2 Firewall only) The settings for inline interfaces must be identical. All four interfaces
— the pair on the appliance and the interfaces on the two devices connecting to the appliance — must have the same speed and duplex settings configured.
Ethernet port mapping
For appliances that have removable interface modules, Ethernet port names are based on the slot and port numbers. The first number in the name represents the slot on the appliance, and the second number represents the port on the slot. Example: eth2_0 is located on port 0 of slot 2.
• Slot 0 contains the fixed Ethernet ports.
• Slots 1 and higher contain the ports on the interface modules. The port numbers start at 0 and increase from left to right.
For more information on Ethernet port names and slot locations on the appliance, see Appliance
features.
During the initial configuration of the appliance, the Ethernet ports are mapped to the interface IDs that you defined in the Management Client.
The Engine Configuration wizard displays the mapping between the interface IDs and port names.
Interface IDs appear in the Id column and port names appear in the Name column.
This mapping can change if you replace an interface module. If the new module has a larger number of Ethernet ports, the interface IDs for the new ports start from the next free interface ID number. Use the new interface IDs to configure new interfaces in the Management Client, then refresh the policy on the engine to transfer the changes. See the McAfee Next Generation Firewall Administrator's Guide for more information.
Do not select the Clear action when modifying interface IDs in the Engine Configuration wizard. Selecting
Clear removes all mapping information between interface IDs and Ethernet ports, and restores the default values.
Example: You have seven interfaces numbered 1–7, which includes a four-port module installed in slot
1.
Figure 1 Original interface ID mapping
If you replace the four-port module installed in slot 1 with a two-port module, eth1_2 with ID 4 and eth1_3 with ID 5 are removed.
Figure 2 Changed interface ID mapping
See also
Connect network and management cables
Connect the appliance to your networks. The management connection allows you to view the system console.
Ethernet ports are mapped to interface IDs during the initial configuration. The ports and port numbers of the physical appliance must match the interface definitions and interface IDs configured for the engine in the Management Client.
Task
1
Determine which Ethernet ports to use and connect the ports to your networks.
2
Connect a monitor to the VGA port on the back panel of the appliance and a keyboard to a USB port.
Connect network cables to SFP ports
If you installed an SFP interface module on the appliance, insert the copper or fiber-optic SFP transceiver into the module and connect the cables.
Task
1
Insert the SFP transceiver in the port slot until you feel the connector on the transceiver snap into place.
Make sure that the latch on the SFP transceiver is up when you insert the SFP transceiver in the port slot.
2
If the SFP transceiver has a rubber plug, remove the plug.
3
Connect the copper or fiber-optic cable to the SFP transceiver.
Each SFP port must match the wavelength specifications at the other end of the cable. The cable must not exceed the stipulated cable length for reliable communications.
Connect the power supplies
Connect cables to the power supplies on the back of the appliance.
Before you begin
See Safety precautions for information about power supplies.
McAfee highly recommends these configurations.
17
• Connect both power supplies to a power source. This ensures that the appliance can function if one of the power connections fails.
• Use a UPS to ensure continuous operation and minimize the risk of damage to the appliance in case of sudden loss of power. For a truly redundant power supply, connect each power connector on the appliance to a different UPS, so that the failure of one UPS does not cut power to both power supplies.
Task
1
Connect the power cables to the AC or DC power connectors on the back of the appliance.
2
Plug the power cord into a grounded, high-quality power strip that offers protection from electrical noise and power surges.
See also
Maintenance
McAfee NGFW appliances ship with several replaceable components.
Tasks
•
Turn off the appliance on page 19
McAfee NGFW 3U appliance hardware components are not hot-swappable. Turn off the appliance and disconnect power before replacing any hardware component.
•
Replace the power supply on page 19
The AC power supplies are replaceable.
•
Replace the appliance fans on page 19
Replace failed fans to ensure proper cooling of the appliance.
•
Replace an SSD with another of the same model.
•
Replace an interface module on page 21
Replace an interface module with the same type or a different type of module.
•
Remove SFP transceivers on page 22
Remove or replace an SFP transceiver.
See also
18
Turn off the appliance
McAfee NGFW 3U appliance hardware components are not hot-swappable. Turn off the appliance and disconnect power before replacing any hardware component.
Task
1
Connect to the engine command line. Depending on your appliance type, use one of these options.
• Connect a keyboard to a USB port and a monitor to the VGA port, then press Enter.
• Connect a computer running a terminal emulator program to the appliance console port, then press Enter.
• Connect using SSH.
SSH access is not enabled by default.
2
Enter the logon credentials.
The user name is root and the password is the one you set for the appliance.
3
Enter the command halt.
4
Unplug all power cords from the system or the wall outlets.
McAfee recommends fastening a grounding strap to your wrist so that it contacts your bare skin and attaching the other end of the strap to the appliance.
Replace the power supply
The AC power supplies are replaceable.
Do not open the casing of a power supply module. Power supply modules can only be repaired by a qualified technician from the manufacturer.
Task
1
Turn off the appliance and disconnect any power cables.
2
Locate the release tab above the power supply module.
3
Push the release tab to the right to release the power supply module from its locking position.
4
Pull out the power supply module using the handle provided.
5
Push the replacement power supply module into the power bay until it clicks in place.
Replace the appliance fans
Replace failed fans to ensure proper cooling of the appliance.
There are three front fans and two back fans on the appliance.
McAfee recommends that you replace all appliance fans at the same time. If one of the fans fails, the other fans might need replacement.
Task
1
Turn off the appliance and disconnect any power cables.
2
McAfee recommends fastening a grounding strap to your wrist so that it contacts your bare skin and attaching the other end of the strap to the appliance.
3
Remove the two screws on the left and right sides that secure the top cover to the appliance.
19
4
Press the release tabs to release the cover from the locking position.
20
1
Release tabs
5
Push the cover toward the rear of the appliance and slide the cover off of the appliance.
1
Fan 3
2
Fan 2
3
Fan 1
4
Fan 6
5
Fan 5
6
Press the release tab on the side of the appliance fan to release the fan from the locking position.
1
Release tab of front fan
2
Release tab on back fan
7
Remove the fan from the appliance and slide the new fan into the fan housing.
Replace the SSD
Replace an SSD with another of the same model.
There are two SSD on the front panel of the appliance. Use only the drive on the left.
Task
1
McAfee recommends using a grounding strap when handling an SSD.
Uninstalled SSDs are sensitive to damage from electrostatic discharge.
2
Turn off the appliance and disconnect any power cables.
3
Press the release button to release the lever that locks the SSD into position.
4
Pull the lever carefully and remove the SSD from the bay.
5
Press the release button on the new SSD to release the lever.
6
Insert the SSD into the bay.
7
Push the lever down to lock the SSD into position.
See also
Replace an interface module
Replace an interface module with the same type or a different type of module.
If the number of ports in the old and new module are the same, the mapping between the Interface
IDs stays the same. If the number of ports in the new module is different from the old module, you might need to modify the interface definitions.
Task
1
Turn off the appliance and disconnect any power cables.
2
McAfee recommends fastening a grounding strap to your wrist so that it contacts your bare skin and attaching the other end of the strap to the appliance.
21
22
3
Release the module from its locking position by pressing the lever right on the appliance, holding the lever down, and pulling the module carefully out of the slot using the handle or the knob on the module's front panel.
If the unlocked module does not move, keep the release lever down, press the module gently toward the back of the slot, and pull the module again by the handle or the knob.
4
Insert the new module.
5
Connect the cables and plug the power cables to the system and to the wall outlets.
6
Turn on the appliance.
To ensure proper cooling, do not turn on the appliance if you have not installed an interface module or a placeholder module in each slot.
7
If the number of ports in the new module differs from the old module, update the interface configuration.
a
In the Management Client, modify the interface definitions as needed.
b Refresh the policy to transfer the interface changes to the engine.
See also
Network settings and cables on page 15
Remove SFP transceivers
Remove or replace an SFP transceiver.
Invisible laser radiation is emitted from the end of a fiber-optic cable and from the fiber port. Do not stare into the beam and avoid direct exposure to the beam.
Task
1
Turn off the appliance and disconnect any power cables.
2
Unplug all power cables from the system or the wall outlets.
3
Disconnect the cable from the SFP transceiver.
4
Pull down the latch on the transceiver and carefully pull the SFP transceiver out of the port slot.
5
If needed, insert a replacement SFP transceiver in the slot.
See also
Connect network cables to SFP ports on page 17
Find product documentation
On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more.
Task
1
Go to the ServicePortal at https://support.mcafee.com
and click the Knowledge Center tab.
2
In the Knowledge Base pane under Content Source, click Product Documentation.
3
Select a product and version, then click Search to display a list of documents.
Copyright © 2015 McAfee, Inc. www.intelsecurity.com
Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others.
B00
23
advertisement
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Related manuals
advertisement