Security Troubleshooting and Optimization
Security Troubleshooting and Optimization
This domain tests systematic fault isolation and performance tuning on Huawei security devices. Expect scenarios involving policy mismatch, NAT, routing asymmetry, VPN negotiation, HA failover, resource exhaustion, and signature or license problems.
Core rules
- Work the path: interface and link state, zone binding, route, NAT, security policy, session, inspection, then application. Do not change multiple variables at once.
- Use evidence: display security-policy rule all, display firewall session table, display ip routing-table, display ike sa, display ipsec sa, and logbuffer. Hit counts show which rule matched; a zero count may mean no traffic or a different rule.
- Check symmetry. Asymmetric routing breaks stateful inspection and NAT; verify return path and HA active/standby state.
- Confirm licenses, signature versions, time, and disk space. Content inspection can degrade or fail if updates are stale.
- Optimize by reordering and consolidating policies, removing shadowed rules, tuning session aging, controlling log volume, and sizing CPU, memory, and session tables against peak load.
Worked example
Users lose HTTPS access after a policy change. The route and interface are up, but no session appears. The engineer checks the policy list and finds a broad deny rule above the new permit rule. After moving the specific permit above the deny and clearing only the test flow, HTTPS works. Reasoning: first-match evaluation means rule order, not rule existence, determines the result. If a session had existed but reset, the next checks would be NAT, ASPF, MTU, and server-side policy.
Traps
Resetting all sessions in production; assuming a policy is wrong when the route is missing; ignoring asymmetric traffic in dual-ISP designs; and tuning thresholds without baseline data.