Network Security Architecture and Zone Design
Zone model on Huawei USG
- Local (100): the firewall itself; management traffic such as SSH, HTTPS and SNMP to the device is Local-zone traffic.
- Trust (85): internal user networks.
- DMZ (50): servers reachable from the internet.
- Untrust (5): the internet.
- Custom zones can be added. Priority is an attribute; it does not by itself permit traffic. USG security policy is interzone and defaults to deny.
Design rules
- Put public servers in the DMZ, never in Trust; DMZ to Trust must be denied.
- Management access should be limited to a dedicated zone or source address, and the Local-zone policy must permit it explicitly.
- Deployment modes: routed (each interface has an IP and routes between zones), transparent (bridging, no IP change), and mixed.
- High availability: two USGs in active/standby with HRP for session and configuration synchronization and VGMP for failover; heartbeat links should be direct.
- Redundancy: dual uplinks, link aggregation, dual power.
Worked example
Requirement: internet users reach only the DMZ web server on TCP 80, while internal users reach the internet. Reasoning: create Untrust to DMZ with destination 10.1.1.10/32 and service HTTP, action permit; create Trust to Untrust for browsing; do not add DMZ to Trust. If the server has a private address, publish it with NAT Server separately.
Traps that cost marks
- Assuming a higher-priority zone can initiate to a lower one without a policy; on USG it cannot.
- Forgetting that traffic to the firewall itself needs a Local-zone policy.
- Placing a database server in the DMZ and allowing DMZ to Trust temporarily.
- Designing HA without checking that HRP heartbeat interfaces are directly connected.