How to Configure Security Policies to Allow HTTP, HTTPS, and RESTCONF

The firewall provides an easy-to-use web UI. You can access the HTTP server service on the firewall through a browser to perform most configuration and management tasks. By default, the HTTPS service is enabled on a firewall. The service port number is 8443 and cannot be changed. HTTP page access requests initiated by the browser will be redirected to HTTPS pages.

RESTCONF provides core NETCONF functions using HTTP methods. The programming interface complies with the RESTful style of the IT industry and provides users with the capability of efficiently developing web O&M tools. RESTCONF is based on the HTTPS service. The default service port is 8447. (In some firewall versions, the HTTP service can be used, and the HTTP service port is 8448.)

Figure 7-4 HTTP and RESTCONF traffic

Security policies need to be configured for traffic from the browser to the web UI or from the RESTCONF interface to the firewall. Security policies also need to be configured for the traffic for access to the web UI or RESTCONF interface of a switch. The following uses HTTPS (port 443) and RESTCONF (port 8443) as examples to describe the security policies that permit access to the switch.