Network Security and Services Fundamentals (ACL, AAA, NAT, DHCP)
ACLs
Huawei ACL ranges: basic 2000-2999 (source IP only), advanced 3000-3999 (source/destination IP, protocol, ports), Layer 2 4000-4999, user 6000-6999. Rules are evaluated top-down on first match, so order matters - a permit-any placed above a deny makes the deny unreachable. Note the trap: Huawei ACLs do not end with an implicit deny, so unmatched traffic is permitted unless you add an explicit deny rule; always verify with counters.
AAA
AAA = authentication, authorization, accounting. RADIUS is the usual choice for network access (UDP 1812/1813), HWTACACS for device administration (TCP 49, encrypts the whole body). Local users are the fallback when the server is unreachable.
NAT
Static NAT is one-to-one; dynamic NAT uses a pool without port translation; NAPT (address-pool with PAT) and Easy IP (uses the interface address) multiplex many inside hosts onto one address. NAT Server publishes an internal server via a public address and port. Traffic must be routed to the NAT device, and FTP/ICMP need ALG or special handling.
DHCP
Client and server exchange Discover → Offer → Request → Ack (DORA); release uses DHCPRELEASE, renewal starts at 50% of lease and rebinds at 87.5%. A relay agent sets the giaddr so the server can pick the right pool; Option 82 carries relay information, Option 43 hands out vendor data such as an AC address. Pools define network, mask, gateway, DNS and exclusions; DHCP snooping blocks rogue servers by trusting only uplink ports.
Worked example
LAN 192.168.1.0/24 must reach the Internet through 200.1.1.1/30: configure an address pool, apply nat outbound on the WAN interface, and add a default route to 200.1.1.2.