H3C SecPath F3000 OT Firewall-H3C

WelcomeuserNew H3C 退出

1. Have an accountLogin
2. Create an accountRegister

English

Home

Products and Solutions

Security

Products

Boundary Security

OT Firewall

H3C SecPath F3000 OT Firewall

Datasheet Download

The H3C OT Firewall is a security protection product developed and launched by New H3C Technologies Co., Ltd. for industrial control networks. It includes functions such as traditional firewall, intelligent learning of industrial control network traffic, deep resolution of industrial control protocol packets, and control of industrial control protocol commands.

Based on flow sessions, the H3C OT Firewall implements stateful inspection firewall functionality, intelligently detects TCP traffic state information, and performs control. It smartly conducts application layer inspection and opens dynamic ports, creating and deleting security policy rules for data packets targeting dynamically negotiated ports to allow or block relevant messages, adhering to the principle of security minimization.

The H3C OT Firewall supports various network security protection technologies, including VPN, NAT, and DoS attack protection. It provides access control, connectionless integrity, data source authentication, anti-replay, encryption, and traffic classification encryption services through IPSec VPN. It offers rich address translation services through SNAT and DNAT and supports various DoS attack protection features such as SYN-FLOOD and UDP-FLOOD. For industrial control networks and systems, the H3C OT Firewall supports deep resolution of mainstream industrial control network protocols, including Modbus/TCP, OPC Classic, OPC UA, DNP3, S7, S7 plus, IEC60870-5-104, MMS, and Ethernet/IP. Additionally, it intelligently protects industrial control traffic and provides command-level control based on an industrial control network whitelist. Furthermore, the firewall integrates an industrial control vulnerability database and an industrial control intrusion detection signature database to detect and block attacks and intrusion behaviors in the industrial control network using denylist technology.

Learn More

The following contents are complex, and it is recommended to browse on PC.

Enter c.h3c.com.cn on the PC browser and operate according to the page to synchronize to the PC and continue browsing.

Continue by mobile

Features

Industrial Grade High Availability

It uses industrial-grade hardware, a fanless fully enclosed design, and redundant power supplies, meeting the application requirements of harsh industrial environments. It provides comprehensive HA dual-machine hot backup technology, allowing smooth switchover to a backup device when one firewall fails, ensuring that there is no interruption of service during active/standby switchover. Additionally, the H3C OT Firewall supports BYPASS functionality, allowing network traffic to bypass directly when the device fails, preventing user service interruptions.

Employs Flow-Based Stateful Inspection Technology

Utilizes session-based stateful inspection technology

Integrates powerful session management core technology

Supports excellent performance for new connections per second

Features a robust forwarding acceleration system

Supports Deep Resolution of Various Industrial Protocols

The H3C OT Firewall supports a wide range of mainstream industrial control network protocols, including Modbus/TCP, OPC Classic, OPC UA, DNP3, S7, S7+, IEC60870-5-104, MMS, and Ethernet/IP, and can quickly capture and deeply resolve various data packets. The resolution engine meets the communication efficiency and redundancy mechanism requirements of industrial control systems during production and manufacturing processes.

Integrates Various Types Of Industrial Denylist Rules

The H3C OT Firewall comprehensively integrates various types of industrial denylist rule databases. The denylist rules are matching entries for industrial protocol denylist detection, with each rule targeting a specific industrial control security vulnerability attack. When industrial traffic with attack behaviors passes through the industrial firewall, it will be detected by the denylist to ensure the safe operation of the industrial network environment. The product includes over 1,000 signature libraries and uses feature matching and anomaly analysis methods to identify and block network attack behaviors (such as various DoS and DDoS attacks).

Specification

Hardware specifications

Item	H3C SecPath F3115-I	H3C SecPath F3135-I	H3C SecPath F3000-I100
Dimensions (W × D × H)	360mmx430mmx44mm	435mmx425mmx44.5mm	500mm440mm44mm
Height	1U	1U	1U
USB ports	2	2	2
Weight	7.2Kg	8.1Kg	12.5Kg
Power supply	AC 110V-240V 50HZ-60HZ 1+1 Modules	AC 110V-240V 50HZ-60HZ 1+1 Modules	150W AC 100V-240V 50Hz-60Hz DC 100V-370V 2 Modules
Power consumption	30 W	80 W	60 W
Fan	No Fan	No Fan	No Fan
Ports	1 × Console Port 6 × GE (1 × GE RJ45 MGMT Ports, 4 Bypass Ports)	1 × Console Port 4 × SFP + 5 × GE (4 Bypass Ports)	1 × Console Port 24 × GE + 8 × SFP + 4 × SFP+ 1 × MGMT Ports 1 × HA Ports
Expansion slots	1	1	1
Interface modules	IPC 8SFP IPC 4SFP IPC 4GE (2 Pairs of Bypass) IPC 2SFP+ IPC 2SFP+ (1 Pair of Bypas) IPC 4SFP+ IPC 4SFP+ (2 Paris of Bypass)	IPC 4SFP IPC 4GE (2 Pairs of Bypass) IPC 2SFP+ IPC 2SFP+ (1 Pair of Bypas) IPC 4SFP+ IPC 4SFP+ (2 Paris of Bypass)	IPC-G 4SFP+ IPC-G 4SFP
Storage	1T	1T	64G Flash
Memory	8GB	8GB	16GB
IP level	IP30	IP40	IP40
Temperature	Operating: 0°C～40°C, with hard disk 5°C～40°C Storage: Temperature：-40°C～70°C

Software specifications

Index		Description
Network features	Routing protocols	Supports static route, dynamic route, and policy-based routing (PBR).
	Network settings	Supports global DNS proxy. Supports global and interface DHCP Server proxy.
	High availability	Interfaces support power failure bypass, dual-machine hot standby, active-active mode, and active-passive mode.
	NAT policy	Supports one to one and many to one SNAT and DNAT address translation functions.
Traffic control	Traffic control	Supports traffic control, allowing configuration of upstream/downstream bandwidth policies based on IP address, class type (CT), and timing objects.
Network layer attack protection	DoS attack protection	Supports protection against three types of DDoS attacks: SYN Flood, ICMP Flood, and UDP Flood; also protects against three types of abnormal packet attacks: TearDrop, Land, and oversized ICMP.
Routing protocols	Industrial protocol deep resolution	Supports deep resolution of industrial control protocols such as Modbus, DNP3, and IEC104. OPC, CIP, S7, S7-plus, OPC DA, OPC UA, Bacnet, Ethernet IP can be resolved based on feature code or service code for communication filtering.
Routing protocols	Industrial protocol instruction level control	Supports instruction-level control functions for protocols, such as parsing and controlling data on a specific feature code or register address of the Modbus protocol.
Security policy	Security policy	Provides packet filtering strategies based on state checks, and can offer security protection strategy options for configuring intrusion detection and DDoS protection.
	Industrial control denylist feature count	The industrial control feature library contains more than 1000 entries.
	Industrial control whitelist learning	Supports self-learning of whitelists based on industrial control traffic, allowing for automatic generation of whitelist lists.
	Virus Scanning	Supports virus scanning for multiple protocols.
High availability	Dual Machine Hot Standby HA	Supports dual machine hot standby functionality. When the primary firewall experiences a power failure or other faults, the backup firewall can promptly detect and take over the primary firewall's operations.
Log management	Log management	Allows configuration of log storage threshold alarms and log forwarding functions.
Log management	Logging functions	Supports system logs, security logs, protection logs, NAT logs, DDoS logs, and industrial control logs, while also supporting log forwarding via syslog to a centralized industrial control security management platform.
Managing reports	Supports reporting	Can generate reports instantly and on a scheduled basis.
Collect diagnostic information	Supports network diagnostics	Supports network diagnostic functions.

Performance specifications

Item	H3C SecPath F3115-I	H3C SecPath F3135-I	H3C SecPath F3000-I100
Throughput	2Gbps	4Gbps	10Gbps
Concurrent sessions (Transparent mode)	100K	200K	1.3M
Concurrent sessions (Modbus sessions)	80K	100K	1.3M
New sessions per second	20K	40K	80K
Application throughput	700Mbps	800Mbps	3Gbps
Signature base size	10K	10K	10K
VPN throughput (512 Bytes)	20Mbps	30Mbps	70Mbps
VPN tunnels (IPSec/L2TP)	30/30	30/30	30/30

Networking Application

Traffic control and security protection between security zones

Critical devices protection

Security connections between disperse industrial networking

Ordering Information

Item		Description
Hardware Appliance	H3C SecPath F3115-I	H3C SecPath F3115-I Industrial Firewall Appliance
	H3C SecPath F3135-I	H3C SecPath F3135-I Industrial Firewall Appliance
	H3C SecPath F3000-I100	H3C SecPath F3000-I100 Industrial Firewall Appliance

Resources

Resource Center

Technical Documents

Software Download

H3C SecPath F3000 OT Firewall

Industrial Grade High Availability

Employs Flow-Based Stateful Inspection Technology

Supports Deep Resolution of Various Industrial Protocols

Integrates Various Types Of Industrial Denylist Rules

Hardware specifications

Software specifications

Performance specifications

Resource Center

Related Links

Cloud & AI

Intelligent Connection

Intelligent Computing

Intelligent Storage

Security

SMB Products

Intelligent Terminal Products

Industry Solutions

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Technical Blogs

Training & Certification

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Partner Business Management

Service Business

Profile

News & Events

Online Exhibition Center

Contact Us