Network Security Technologies
Network Security Technologies
This domain tests configuration and analysis of Huawei firewall networking and protection features: security zones and interzone policies, stateful inspection, NAT, IPsec/SSL VPN, DSVPN, IPS, antivirus, URL filtering, and application control. Questions often combine several features in one traffic path.
Core rules
- Security policy is evaluated top-down; first match wins. Keep specific rules above broad rules, and use hit counts to find shadowed rules.
- Stateful inspection creates a session for permitted flows; return traffic is allowed by the session, not by a separate reverse policy. ASPF handles application-layer inspection and NAT ALG behavior.
- IPsec has two phases: IKE negotiates the SA and peer identity; IPsec protects data. Proposals, pre-shared keys/certificates, local/remote IDs, and interesting traffic must match on both peers.
- NAT changes addresses before or after policy depending on direction and platform; always verify the post-NAT five-tuple against the policy and session table.
- Content security features need valid licenses and up-to-date signatures; without them, IPS/AV may pass traffic or fail open according to profile settings.
Worked example
A branch behind NAT must reach HQ over IPsec. On both firewalls, configure matching IKE and IPsec proposals, pre-shared key, and the branch and HQ subnets as interesting traffic. Permit IKE UDP 500 and 4500 and ESP in the underlying policy, and exempt the tunnel traffic from source NAT. If phase 1 is up but phase 2 fails, compare proxy IDs and proposals. Reasoning: IKE proves peer identity, but IPsec SA selection depends on matching selectors; a NAT exemption error can hide the real subnet.
Traps
Assuming a reverse policy is needed for return traffic; mismatched proxy IDs; permitting only the tunnel endpoints; and forgetting that URL filtering and IPS require decrypted or reassembled traffic.