Network Security, ACLs, and AAA
ACL questions test match order and implicit deny. Comware ACLs are numbered ranges for basic (2000-2999), advanced (3000-3999), and L2 (4000-4999); rules are evaluated top-down and the first match wins, with an implicit deny at the end. Know rule permit/deny, source/destination matching, and how ACLs are applied (packet-filter, NAT, QoS, routing policy). Traps: assuming order does not matter; forgetting that an empty ACL permits all (no rules means no deny); and confusing inbound vs. outbound application direction.
AAA covers authentication, authorization, and accounting via RADIUS, HWTACACS, or local. Know the scheme order (e.g., authentication-mode scheme with a server group and local fallback) and that HWTACACS separates authn/authz while RADIUS combines them. 802.1X, MAC authentication, and portal authentication are common access-control methods. Traps include assuming local users are tried first (server group order matters) and forgetting that authorization requires a domain or scheme binding.
Other security topics: SSH vs. Telnet, port security (max MACs, sticky MAC), DHCP snooping and dynamic ARP inspection, and URPF for spoofing prevention.
Worked example: a management ACL blocks SSH from a subnet. Check rule order - a broad deny above the permit will shadow it. Verify with display acl <number> and confirm the interface application direction. Rule of thumb: place specific permits above broad denies, and always add an explicit permit for management traffic before the implicit deny.