Huawei HCIP-Security (H12-721/722/723) cheat sheet

CIA triad: Confidentiality (encryption/access control), Integrity (hashing, digital signatures), Availability (redundancy, anti-DDoS); a control is judged by which leg it protects.

Threat classification by vector: reconnaissance (scanning, sniffing), exploitation (buffer overflow, injection), malware (virus, worm, trojan, ransomware), and DoS/DDoS (SYN flood, UDP flood, reflection).

Defense in depth layers on Huawei gear: border firewall (USG) → IPS → antivirus/content filtering → endpoint (HiSec Endpoint) → management/audit; each layer assumes the previous one failed.

Zone-based security model: interfaces are assigned to security zones (Trust, Untrust, DMZ, Local); inter-zone traffic is denied by default and permitted only by explicit policy.

Security level (0-100) is a zone attribute; packets flow from higher to lower level only if a policy permits, and return traffic is statefully matched by the session table.

Attack surface reduction rule: the Local zone (device itself) should expose only management protocols, restricted by source-address and service ACLs.

Malware propagation stage model: exploitation → download/dropper → persistence → C2 beaconing → lateral movement; IPS and antivirus signatures target different stages.

Compliance framing: graded protection (MLPS 2.0) maps requirements to technical controls such as identity authentication, audit logging, and intrusion prevention.

USG session setup order: route lookup → inter-zone check → security policy match → server-map/ASPF check → session creation; no matching policy means drop with a logged deny.

Security policy match order is top-down; the first matching rule wins, and the implicit default is deny. Use specific rules above broad rules.

A security policy defines source zone/address, destination zone/address, user, service/application, action (permit/deny), and optional time range and content-security profile.

Stateful inspection: the first packet creates a session entry; subsequent packets in either direction match the session table and bypass policy re-evaluation unless the session is torn down.

ASPF/server-map handles multi-channel protocols (FTP active mode, SIP, H.323) by opening predicted data connections tied to the control session.

Policy granularity options: address objects/groups, service objects, application identification (App-ID), and user identity (by IP, by user, by user group).

Long-connection and aging: sessions have TCP/UDP/ICMP aging timers; applications such as SIP or database connections may need longer timers or session aging adjustments.

Policy verification workflow: display security-policy, display session table, and packet capture/trace features to confirm which rule matched.

NAT types on USG: source NAT (SNAT, including NAT No-PAT and PAT), destination NAT (NAT Server), and bidirectional/NAT64 variants.

NAT Server maps public IP:port to a private server; the generated server-map entry allows external clients to initiate and permits return traffic without an inbound policy in the same zone pair if configured as such.

Source NAT with PAT rewrites source address and port to a pool address; No-PAT keeps the source port and requires a one-to-one address ratio.

NAT policy vs interface NAT: NAT policies are matched top-down like security policies and take precedence over interface-based NAT configuration.

Hairpin NAT (internal users reaching an internal server via its public address) requires source NAT plus server-map handling so return traffic returns through the firewall.

Routing precedence on USG: longest-prefix match first; among equal prefixes, lower preference wins; static routes default preference 60, directly connected 0, OSPF 10, IS-IS 15, BGP 255.

Policy-based routing (PBR) overrides the routing table for matched traffic and is evaluated before normal route lookup; use it for multi-ISP egress selection.

NAT and routing interaction: destination NAT is applied before route lookup for the translated destination, while source NAT is applied after route lookup on egress.

IPsec phases: IKE phase 1 builds the ISAKMP SA (main or aggressive mode), phase 2 builds IPsec SAs (quick mode) for ESP/AH.

IKEv1 main mode = 6 messages; aggressive mode = 3 messages; IKEv2 = 4 messages (IKE_SA_INIT + IKE_AUTH).

IPsec transform set components: protocol (ESP/AH), encryption (e.g., AES), authentication/hash (SHA), and PFS for phase 2 key freshness.

IPsec SA is unidirectional; each tunnel consumes two SAs (inbound and outbound), each identified by SPI, destination IP, and protocol.

NAT traversal (NAT-T) encapsulates ESP in UDP 4500 when NAT is detected; IKE uses UDP 500, and IPsec ESP is IP protocol 50.

DSVPN (Dynamic Smart VPN) uses mGRE plus NHRP so spokes with dynamic addresses register with the hub and build direct spoke-to-spoke tunnels; shortcut tunnels bypass the hub for data.

SSL VPN access modes: web proxy (URL rewriting), file sharing, and network extension (full tunnel via virtual NIC); users are authenticated by local, RADIUS, or certificate.

GRE is a stateless tunnel (IP protocol 47) that carries multicast and non-IP protocols but provides no encryption; combine with IPsec for confidentiality.

IPS signature action types: alert, block/drop, and sometimes reset; the profile selects which signature groups are enabled and their severity thresholds.

Detection methods: signature/pattern matching, anomaly detection, and protocol/state anomaly; evasion techniques include fragmentation overlap, URL encoding, and session splicing.

IPS placement options: inline (blocking, adds latency) vs out-of-band/IDS (detect only); USG inline IPS is applied in the security policy as a content-security profile.

Signature categories typically include exploit, malware, botnet/C2, scanning, and protocol-anomaly; tuning means disabling noisy signatures rather than disabling whole categories.

False positive handling: adjust the signature action to alert, add an exception by source/destination, or update the signature library before considering a global disable.

IPS depends on correct application/protocol identification; encrypted traffic requires SSL decryption (where supported) before inspection.

Threat log fields to correlate: signature ID, severity, source/destination, action taken, and the matching session; these feed the device's threat report.

Performance rule: enabling all signature groups increases CPU load; enable only the groups relevant to the protected assets and test throughput impact.

Antivirus scanning modes: full-file scan vs streaming (fast) scan; streaming scan inspects while forwarding and cannot fully reassemble very large files.

File-reputation and cloud lookup complement local signatures; unknown files may be sent for sandbox analysis where the platform supports it.

Content filtering (URL filtering) categories are matched against a URL category database; uncategorized URLs follow the default action.

File blocking policy matches by file type/extension and direction (upload/download) and is applied as a content-security profile in the policy.

Email security functions: spam filtering, phishing detection, and attachment scanning; these are separate profiles from the web antivirus profile.

Application-layer content security requires the traffic to be decrypted when encrypted, and requires the correct protocol/application to be identified first.

Profile binding rule: content-security profiles are attached to a security policy and apply only to traffic permitted by that policy; deny rules never invoke them.

Malware containment: quarantine or block the file, log the session, and optionally reset the connection to prevent the download completing.

App-ID identifies applications by signature (protocol behavior), not just port; the same port can carry multiple applications and the same application can use multiple ports.

Identification stages: protocol/port pre-identification → signature match → heuristic/behavioral detection → unknown-application classification.

SA (signature identification) vs AC (application control) categories: applications are grouped by category and risk level for policy authoring.

Bandwidth management (QoS) hierarchy: traffic policy (classifier) → traffic behavior (committed rate, peak rate, priority) → applied to interface or policy.

Committed bandwidth (CIR) guarantees a minimum rate; peak bandwidth (PIR) caps the maximum; excess traffic is dropped or remarked when the PIR is exceeded.

Per-IP bandwidth limiting prevents a single host from exhausting a shared pipe; per-user limiting requires identity-based policy.

Priority queues (e.g., EF/AF classes) let latency-sensitive traffic such as VoIP be scheduled ahead of bulk downloads.

Application-based QoS: apply bandwidth limits to a specific application (e.g., P2P) while leaving other traffic unshaped.

Dual-system hot standby: two USGs form an active/standby pair; HRP (Huawei Redundancy Protocol) synchronizes sessions, configuration, and some state over the heartbeat link.

HRP roles: active and standby; the standby device receives synchronized sessions and takes over on failure. HRP status can be checked with display hrp state.

VRRP provides the virtual gateway IP that hosts use; the master router owns the VIP, and priority plus preemption determine mastership.

Split-brain prevention: HRP heartbeat must traverse a direct link or a redundant path; if both devices become active, duplicate sessions and asymmetric routing occur.

Hot-standby requirements: identical software versions, matching interface numbering, and synchronized time; mismatched versions block HRP synchronization.

Link reliability tools: BFD for fast failure detection (millisecond), IP-link to track reachability of a target, and Eth-Trunk for link aggregation redundancy.

Failover triggers: interface down, HRP heartbeat loss, BFD-detected peer failure, or manual switchover; test failover after any configuration change.

Asymmetric traffic handling: session synchronization lets the standby forward return traffic even if the forward path traversed the active device.

Log destinations: local buffer, syslog server, and the log server in the management plane; severity levels from emergency (0) to debug (7).

Session and policy diagnostics: display firewall session table, display security-policy rule, and packet capture on the interface to confirm forwarding.

Common troubleshooting order: physical/link → routing → NAT → security policy → session/ASPF → content security → application.

Debug commands (debugging) are CPU-intensive; enable only for the specific module and disable immediately after capturing output.

Log content fields: time, source/destination, zone, policy name, action, application, and threat signature; correlate by session ID.

NTP synchronization is required for meaningful correlation of logs across devices; unsynchronized clocks break incident timelines.

Backup and version control: export configuration before changes, and record the software/signature versions in the incident record.

Health monitoring: check CPU/memory, session table utilization, and interface error counters; a full session table causes new connections to be dropped.

NAC (network admission control) flow: identity authentication (802.1X, MAC, or Portal) → posture/compliance check → authorization (VLAN or ACL) → admission.

802.1X roles: supplicant (client), authenticator (switch/AC), authentication server (RADIUS); EAP encapsulation carries credentials.

Portal authentication is used where 802.1X is impractical; the user is redirected to a web page and authenticated before being granted access.

Posture check verifies antivirus status, patch level, and unauthorized software; noncompliant endpoints are quarantined or given limited access.

HiSec Endpoint provides host-level antivirus, EDR-style detection, and centralized management; it complements the network-side firewall.

Campus segmentation: separate guest, employee, and IoT traffic by VLAN and security zone, then enforce inter-zone policy at the firewall or switch ACL.

Rogue device and ARP spoofing defenses: DHCP snooping, dynamic ARP inspection, and port security limit unauthorized endpoints on access ports.

Least privilege for access: grant the minimum VLAN/ACL authorization for the role, and log authentication and authorization events for audit.