Huawei HCIP-Security (H12-721/722/723) key terms

A logical grouping of interfaces on a Huawei firewall that share the same trust level. Security policy rules are written between zones rather than between individual interfaces, simplifying rule design and audit.

The predefined zone that represents the firewall device itself, including its own IP addresses. Traffic destined to or sourced from the device, such as management access and routing protocol packets, is matched against the local zone.

An ordered set of rules that permits, denies, or inspects traffic based on zone pair, source and destination addresses, service, application, user, and time. The first matching rule is applied, so order matters.

A policy whose source and destination are different security zones, for example trust to untrust. It controls traffic passing through the firewall and typically carries the main permit and deny logic of the enterprise edge.

A policy applied to traffic where source and destination belong to the same security zone. It is used when interfaces are grouped in one zone but traffic between them must still be filtered or inspected.

The implicit action taken for traffic that matches no explicit rule. On Huawei USG devices the default is usually deny, so any permitted flow must be covered by an explicit policy or a related session.

A stateful table tracking established flows, including addresses, ports, protocol, and state. Return traffic of an existing session is allowed without a separate rule, which is the basis of stateful inspection.

A firewall technique that records each permitted flow in a session table and lets only the return traffic of that flow back in. It avoids opening wide inbound rules for reply packets of outbound connections.

Application Specific Packet Filter, a Huawei feature that inspects application-layer control channels and dynamically opens the data ports they negotiate, for example FTP active mode or SIP media. It complements basic stateful inspection.

A rule set that determines which traffic is translated and how, using source NAT, destination NAT, or both. It is matched in order and is commonly combined with security policy to control which translated flows are permitted.

Translation of the source address and optionally port of outbound packets so that internal hosts appear as a public address. It conserves public IPv4 addresses and hides internal addressing from external networks.

Translation of the destination address of inbound packets, typically mapping a public address to an internal server address. It is used to publish internal services without exposing their real addresses.

A Huawei configuration object that publishes an internal server to external clients by mapping a public address and port to a private address and port. It is effectively a destination NAT with an optional port translation.

Network Address Port Translation, also called PAT or address overloading, translates both address and port so many internal hosts share one public address. Port allocation must be tracked to keep return traffic unambiguous.

An application layer gateway that rewrites embedded addresses and ports inside payloads of protocols such as FTP, SIP, or H.323. Without it, those protocols break when the control channel is translated.

A suite of protocols that authenticates and encrypts IP packets at Layer 3. It uses IKE for key negotiation and ESP or AH for data protection, and is the standard choice for site-to-site VPNs.

Internet Key Exchange negotiates security associations for IPsec in two phases: phase 1 builds a protected management channel, and phase 2 negotiates the data SAs. It authenticates peers by pre-shared key or certificates.

A one-way security association identified by a security parameter index, defining algorithms, keys, and lifetime for protected traffic. A bidirectional IPsec tunnel therefore consists of two SAs, one per direction.

Encapsulating Security Payload is the IPsec protocol that provides confidentiality through encryption and optional integrity through authentication. It is preferred over AH when NAT traversal is required because it does not protect the outer IP header.

A mechanism that encapsulates ESP packets in UDP port 4500 so they can pass through NAT devices, and detects NAT presence during IKE negotiation. It is required when IPsec peers sit behind address translation.

A secret string configured identically on both IPsec peers to authenticate IKE negotiation. It is simple to deploy but must be long and random, since compromise of one peer exposes the shared secret.

A remote access VPN that uses TLS to protect traffic between a client or browser and the gateway. It works through NAT and web proxies, supports per-application access, and is suited to mobile and partner users.

A Huawei SSL VPN object that binds authentication, address pool, and access policy to a listening address and port. Multiple virtual gateways can coexist on one firewall to serve different user groups.

Generic Routing Encapsulation tunnels one protocol inside another, typically carrying multicast or non-IP traffic over an IP network. It provides no encryption, so it is often combined with IPsec for confidentiality.

Dynamic Smart VPN is a Huawei technology that lets branch routers with dynamic addresses build tunnels to a hub and then to each other, using NHRP to resolve addresses. It supports direct spoke-to-spoke traffic.

Next Hop Resolution Protocol maps a tunnel address to the current public address of a peer, allowing dynamic VPN members to find each other. In DSVPN it lets spokes register with the hub and resolve peer addresses.

A rule in an intrusion prevention engine that describes a pattern or behavior indicating an attack, such as a malicious payload string or protocol anomaly. Signatures carry severity and action, and must be kept current.

A Huawei configuration object that groups signature actions, severity thresholds, and exception lists and is applied to traffic by a security policy. It defines what the intrusion prevention engine does when a signature matches.

An intrusion detection method that models correct protocol behavior and flags deviations, such as malformed headers or illegal state transitions. It can catch unknown attacks that signature matching misses.

A configuration object specifying which file-transfer protocols to scan, maximum file size, and the action to take on infected files. It is referenced by a security policy to inspect content passing through the firewall.

A cloud or local lookup that rates a file hash as malicious, suspicious, or trusted before or during scanning. It reduces the load on local antivirus engines and helps identify newly seen malware.

An isolated execution environment that detonates suspicious files and observes their behavior to detect unknown malware. Verdicts are fed back to the firewall so later traffic carrying the same file can be blocked.

The process of recognizing the application behind a flow, by signature, behavior, or heuristics, rather than relying only on port number. It enables application-based policy, QoS, and precise blocking of evasive traffic.

A Huawei predefined or custom application object produced by application identification, such as a specific web service or peer-to-peer client. Security policies and bandwidth policies reference SA objects by name.

A QoS feature that limits or guarantees the rate of traffic matching a class, for example per user, per application, or per interface. It is used to contain bandwidth-hungry applications and protect business-critical flows.

A Huawei object that defines a committed rate, peak rate, and priority for a traffic class, and is referenced by a bandwidth policy. It shapes matching flows without writing per-interface rate limits.

Huawei Redundancy Protocol synchronizes configuration and session state between the active and standby firewalls in a hot standby pair. It allows traffic to continue after a failover without re-establishing existing sessions.

Virtual Router Redundancy Protocol lets two or more routers share a virtual IP address and MAC, with one master forwarding traffic. On Huawei firewalls it works with HRP to trigger failover of the gateway address.

A deployment where two firewalls form an active and standby pair, sharing state through HRP and gateway status through VRRP. If the active device fails, the standby takes over with minimal interruption.

A set of features such as BFD, link quality detection, and multi-link load balancing that detect path failure and steer traffic to a working link. It keeps VPN and internet access available when one uplink degrades.

The firewall function that records traffic, threat, and system events and can forward them to a syslog server or analyzer. Logs are the primary evidence for troubleshooting, auditing, and incident investigation.

A diagnostic action that records packets on an interface or for a matching flow so they can be decoded and compared with policy and session state. It is often the fastest way to prove whether traffic arrives and leaves.

A Huawei security analytics platform that collects telemetry from firewalls and endpoints, correlates events, and presents threat visualization. It supports detection of advanced threats across the campus and data center.