H3C New OS - 磐宁 NingOS

https://www.h3c.com/cn/Service/Document_Software/Document_Center/Server/Catalog/Server_Parts/NingOS/Default.htm

https://www.h3c.com/cn/Service/Document_Software/Software_Download/Server/Catalog/system/system/NingOS/

H3C iMC new version running on NingOS + MariaDB

https://www.h3c.com/cn/Service/Document_Software/Document_Center/SDN/Catalog/IMC/IMC_V7/Installation/Installation_Manual/H3C_7.3-21299/02/?CHID=1063390

Reference:

https://www.chinaz.com/2023/0611/1533035.shtml

https://www.huanqiu.com/article/4DH5fdJ7eGp

H3C New OS - 磐宁 NingOS

H3C firewall SSL weak cipher

Nessus vulnerability scan report about H3C firewall SSL weak cipher 

Go to "Objects" -> "SSL" -> "SSL Server Policies"

You will found that even you select "TLS 1.2" and Cipher suites "High level":

SSL_RSA_with_AES_128_CBC_SHA

SSL_RSA_with_AES_256_CBC_SHA

You still false in the security scanning report and it will show weak cipher.

Solution:

Use the following 4 Cipher:

 

https://www.tenable.com/plugins/nessus/156899 

After change the cipher under firewall GUI, then SSH to the firewall

 

> system-view

 

] undo ip https enable

 

] ip https enable

 

] save force

 

] exit

 

>

 

H3C firewall SSL weak cipher

H3C Firewall Change admin portal certificate

1. Go to H3C Firewall -> SSL -> SSL Server Policies to create a new Policy e.g. "abc_2024-2026"

2. Create a PKI Domain for new cert installation

3. Go to PKI -> Certificate -> Import 2 CA cert and 1 local cert

CA to provide TWO CA cert (.cer) (When install second CA, just ignore the cert will be replace warning) and One local cert (.pfx) (RSA 2048) (This local cert need to includ private key and also ignore the cert will be replace warning)

4. SSH to the firewall 

 > show current-configuration (Enable logging on putty before run this command) 

 > system-view ] undo ip https enable 

 ] ip https ssl-server-policy <New Policy Name which is you create at step1> 

 ] ip https enable 

 ] save force 

 ] exit 

 >

H3C Firewall Change admin portal certificate

H3C Security Management Platform - Firewall Management like Fortimanager

The H3C Security Management Platform running on H3Linux―H3C proprietary Linux operating system

H3Linux是基于CentOS进行封装的，所以安装过程和CentOS基本一致（CentOS操作系统最小化安装部署）

H3C Security Management Platform - Firewall Management like Fortimanager

H3C IPS upgrade firmware

H3C IPS upgrade firmware

1. Download the latest version of H3C firmware https://h3csoftware.site/cloud/index.php/s/FDcQBsoz1KRGzsF

 

2. Upload the SECPATH5080T-CMWxxxxxx.ipe to the H3C IPS:

3. Select the new boot and system files uploaded from the extraction by the H3C device from xxx.ipe:
   

4. Click "Operations", apply to all location:
   

5. Click "Close"
   

6. Go to maintenance, select reboot and save the running configuration for all contexts
   

 

7. Waiting for 15 mins, then it will back to online with latest firmware
   

H3C IPS upgrade firmware

H3C firewall considersation

1. Copy firewall rule will go to the last firewall rule (the button of the rule set), when you have few hundred firewall rule, administration will be painful.
2. Traffic log need local harddisk of the firewall, syslog cannot cover. Need to aware to buy firewall with local harddisk.

H3C firewall considersation

Fortinet Fortigate Firewall and H3C Switch OSPF network type

In 6.x OS, Fortigate Firewall OSPF in GUI running on "broadcast" network type. You need to check your H3C OSPF is running which network type.

Network type:

broadcast: Broadcast.
non-broadcast: Non-broadcast.
point-to-point: Point-to-point.
point-to-multipoint: Point-to-multipoint.

point-to-multipoint-non-broadcast: Point-to-multipoint and non-broadcast.

If the network type is mis-match between Fortigate and H3C switches, you will see the neighbour but cannot update route in the routing table.

Fortinet Fortigate Firewall and H3C Switch OSPF network type

Tencent Cloud Direct Connect routing constrain

Limitations: 

1. Cannot accept over 100 route via BGP
   
2. Support Statics Route and BGP only

Solution:

Fortinet Fortigate to do OSPF route summarisation and then redistribute to BGP to Tencent cloud

Remark: H3C switch OSPF limitations is cannot summarise route to next hop.

Tencent Cloud Direct Connect routing constrain

Server management tool

 

Brand	HPE	DELL EMC
Server Setup	Service Pack for ProLiant (SPP)	OpenManage
Out of band management	iLO Advanced	iDRAC Enterprise
Centralized Server Management	Oneview and InfoSight	OpenManage Enterprise
Vmware Intergration	HPE OneView for VMware vCenter	OpenManage Integration for VMware vCenter (OMIVV)
Vmware customerized images by Vmware	Yes	Yes

 

 

Brand	Lenovo	Huawei
Server Setup	XClarity Administrator	FusionServer Tools
Out of band management	XClarity Controller (XCC) Enterprise	iBMC
Centralized Server Management	XClarity Administrator	FusionDirector
Vmware Intergration	XClarity Integrator for Vmware vCenter	FusionDirector Integrator for VMware vCenter
Vmware customerized images by Vmware	Yes	Yes

 

Brand	xFusion	H3C
Server Setup	FusionServer Tools	H3C Server Installation and Startup Service, Global Version
Out of band management	iBMC	HDM
Centralized Server Management	FusionDirector	FIST
Vmware Intergration	FusionPlugin	H3C FIST for VMware vCenter Plug-in
Vmware customerized images by Vmware	Yes	Yes

 

Brand	Inspur	ZTE
Server Setup	ISIB/ISPIM	Internal test version. Not for sale.
Out of band management	ISBMC	BMC
Centralized Server Management	ISPIM Enterprise	Internal test version. Not for sale.
Vmware Intergration	ISPIM for Vmware vCenter / vLCM	No
Vmware customerized images by Vmware	Yes	No

Server management tool

Cisco Huawei H3C Ruijie

 

	Cisco	Huawei	H3C
Router	Cisco ISR 4431	AR6140-9G-2AC	H3C MSR3610-X1
Switch	Cisco WS-C3850-48T	S5731-H48T4XC	H3C S5130S-28S-HI
Switch	Cisco C9300	24-port:  S5731-H24T4XC (non-PoE)  S5731-H24P4XC (PoE) 　 48-port  S5731-H48T4XC (non-PoE)  S5731-H48P4XC (PoE)	24-port: H3C S5560X-30C-EI (non-POE) H3C S5560X-30C-PWR-EI (POE) 　 48-port H3C S5560X-54C-EI (non-PoE) H3C S5560X-54C-PWR-EI (PoE)
Switch	Cisco Nexus 9500	CE16800 series Cisco N9504: Huawei CE16804	H3C S12500X-AF series
Switch	Cisco Nexus 9300	1/10GE Base-T: CE6870 25GE SFP28: CE6865	H3C S6800 series
Wifi	Cisco AIR-AP3802I-S-K9	AirEngine 6760-X1	H3C WA66 series WiFi6
Firewall	5508-X, 5525-X	ASA5508: Huawei USG6525E SA5525: Huawei USG6585E	ASA 5508-X——H3C SecPath F1030 ASA 5525-X——H3C SecPath F1050

 

 

	Cisco	H3C	Ruijie
Router	Cisco ISR 4431	H3C MSR3610-X1	RG-EG3250
Switch	Cisco WS-C3850-48T	H3C S5130S-28S-HI	RG-S5750C-48GT4XS-H
Switch	Cisco C9300	24-port: H3C S5560X-30C-EI (non-POE) H3C S5560X-30C-PWR-EI (POE) 　 48-port H3C S5560X-54C-EI (non-PoE) H3C S5560X-54C-PWR-EI (PoE)	24 port: RG-S5750C-28GT4XS-H(non-PoE) RG-S5750C-28SFP4XS-H 24 port SPF: RG-S5750C-28SFP4XS-H 48 port: RG-S5750C-48GT4XS-H(non-PoE) RG-S5750-48GT4XS-HP-H(POE) 48 port SPF: RG-S5750C-48SFP4XS-H
Switch	Cisco Nexus 9500	H3C S12500X-AF series	RG-N18000-X series
Switch	Cisco Nexus 9300	H3C S6800 series	RG-S6500 Series Switches RG-S6220-H Series Switches
Wifi	Cisco AIR-AP3802I-S-K9	H3C WA66 series WiFi6	RG-AP840-I
Firewall	5508-X, 5525-X	ASA 5508-X——H3C SecPath F1030 ASA 5525-X——H3C SecPath F1050	N/A

 

Cisco Huawei H3C Ruijie

China Server Vendor Model

 

 

Device Type	Brand	Model	Sub Model	Inspur
RackMount Server	HPE	ProLiant	DL380 Gen 10	Inspur NF5280M5 2U 2CPU Rack Mount
Blade Server	HPE	Synergy	480 Gen 10	Inspur i24 Multi-Node 2U Rack Mount Inspur i48 Multi-Node 4U Rack Mount
HCI	HPE	Simplivity	380 Gen 10	Inspur NF5280M5 HCI Inspur i24 2U 4-Node HCI Platform
HPC	HPE	HPE Apollo	6500	Inspur NF5468M5 4U High Density GPU

 

 

Device Type	Brand	Model	Sub Model	H3C
RackMount Server	HPE	ProLiant	DL380 Gen 10	H3C UniServer R4900 G5
Blade Server	HPE	Synergy	480 Gen 10	H3C UniServer B5700 G5
HCI	HPE	Simplivity	380 Gen 10	H3C UIS-Cell 3000 6000 G3 / G6
HPC	HPE	HPE Apollo	6500	H3C XG310 GPU

China Server Vendor Model

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor

 

 

Brand	Model	Hillstone (E series)	Hillstone(A series)	H3C	Huawei	Sangfor
Sophos	XGS 3100	E5568	SG-6000-A3700	H3C SecPath F5030	USG6620E	NGAF M5800
Sophos	XGS 3100	E3965	SG-6000-A2800	H3C SecPath F1070	USG6610E	NGAF M5600
Sophos	XGS 2100	E3965	SG-6000-A2700	H3C SecPath F1070	USG6575E	NGAF M5400
Sophos	XGS 5500	E5960	SG-6000-A5200	H3C SecPath F5060	USG6610E	NGAF M6000
Sophos	XGS 136	E3662	SG-6000-A2000	H3C SecPath F1070	USG6585E	NGAF M5300

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor