3900 Appliances Hardware

Before you start, make sure you have these items:

• A UL listed two-hole grounding lug, similar to Panduit LCD10-14A-L.

• Copper grounding wire 18 AWG (the insulation color must be green and yellow to meet the IEC/UL 62368-1 CL5.6.2.2 requirement or the insulation color must comply with your local electrical regulations).

• Grounding design that complies with the country or local electrical codes.

• A wire crimping tool suitable for the grounding lug type.

• A screwdriver suitable for the grounding screws.

Prerequisites:

1. Insert the grounding wire in the lug (connector).

2. Use the crimping tool to crimp the lug onto the grounding wire.

3. Place the screwdriver near the appliance rear panel.

Procedure:

1. On the appliance rear panel, locate the metal grounding plate (on the far right).

2. Remove two screws from the metal grounding plate (depends on which direction you want to attach the grounding lug, vertically or horizontally).

3. Attach the grounding lug to the grounding plate.

   

4. Make sure the two holes in the grounding lug are aligned with the corresponding holes in the grounding plate.

5. Insert the first grounding screw through one of the holes in the grounding lug so it goes into the corresponding hole in the grounding plate.

6. Use a screwdriver to tighten the first screw (maximum torque of 6 kgf×cm).

7. Insert the second grounding screw through the second hole in the grounding lug so it goes into the corresponding hole in the grounding plate.

8. Use a screwdriver to tighten the second screw (maximum torque of 6 kgf×cm).

In 3970 / 3980 Appliances, the shipping carton contains two restraint strips.

You can use these restraint strips to prevent accidental removal of the power cable.

To install the power cable restraint:

1. If a power cable is connected to the power supply inlet, disconnect it.

2. Find the restraint strip slot on top of the power supply inlet.

3. Make sure that the cable loop on the restraint faces the power supply inlet.

4. Insert the restraint strip anchor into the slot until it snaps and locks.

5. Connect the power cable to the power supply inlet.

6. Pull the restraint tab to the side to move the cable loop on the restraint strip.

7. Move the cable loop until you can wrap it around the power cable.

8. Insert the open side of the cable loop into the loop slot until it is tight against the power cable.

9. Make sure the cable loop is secured and the power cable cannot be removed.

   

The 3900 Appliances have two types of network ports:

• Regular physical ports.

• Switch ports.

Explanation about the regular physical ports:

• The regular (non-switch ports) connect to the CPU cores of the appliance directly.

• For the regular ports, the output of the Expert mode command "ethtool -i <Name of Interface>" shows:

  driver: net_cn10k version: DPDK <x.x.x>

• There are no changes in the traffic flow through the regular ports.

Explanation about the switch ports:

• The switch ports connect to the CPU cores of the appliance in this way:

  [Appliance Ports] <===> [CPU Port "eth-cpuport"] <===> [Master Port "eth-switch"] <===> [CPU Cores that run CoreXL and SecureXL]

• For the switch ports, the output of the Expert mode command "ethtool -i <Name of Interface>" shows:

  driver: DSA Pseudo Ethernet version: Version <x.x>

• In the Gaia OS, the internal CPU Port appears as the interface called "eth-cpuport" in the CPView tool and the Expert mode commands "ifconfig", "ethtool" and others.

• In the Gaia OS, the internal Master Port appears as the interface called "eth-switch" in the CPView tool and the Expert mode commands "ifconfig", "ethtool" and others.

• Gaia Portal and Gaia Clish do not show these internal interfaces "eth-cpuport" and "eth-switch".

• These internal interfaces "eth-cpuport" and "eth-switch" do not have an IP address.

• These internal interfaces "eth-cpuport" and "eth-switch" must always appear in various CLI outputs in the status "up" with the established link.

• You cannot change any settings on these internal interfaces "eth-cpuport" and "eth-switch".

• The CPView tool counts packets and bits through these internal interfaces "eth-cpuport" and "eth-switch" but excludes them from the "total" counters (on the Network > Interfaces > Traffic page).

• In some cases, the internal interface "eth-cpuport" may drop packets.

  For example, if the TX queue of an outgoing switch port is full.

  The CPView tool counts these drops and shows them on the Network > Interfaces > Traffic page > in the section Errors and Drops.

• In the output of the Expert mode command "ethtool -S" <Name of Interface>", the names of counters for the switch ports start with the string "sw_" (for example, "sw_rx_unicat_packets").

• Packet flow through a switch port:

  1. Traffic arrives at the appliance switch port.

  2. The switch port adds a Distributed Switch Architecture (DSA) tag to the packet.

     You can see this tag in traffic captured with the tools "tcpdump", "cppcap", and "fw monitor".

  3. The switch port forwards the packet with the DSA tag to the Master Port ("eth-switch") queue via the "eth-cpuport".

  4. One of the CoreXL SND instances takes the packet from the queue, removes the DSA tag, and forwards it to a CoreXL Firewall instance.

  5. The CoreXL Firewall instance forwards the first packet of a connection to Firewall (Slow (or F2F) path) for full inspection.

  6. Based on the Firewall decision, the subsequent packets of the connection go through the applicable path (Fast, Medium, or Slow).

  7. If the packet is allowed, SecureXL adds the applicable DSA tag to the packet and forwards the packet to the corresponding appliance port.