How to Configure a Firewall: Deployment and Advanced Settings

A firewall is a network security device that is usually located at the network border. It isolates networks of different security levels and protects one network from attacks and intrusions from another network. This "isolation" is not one-size-fits-all. It is controlled isolation, allowing legitimate traffic to pass through the firewall and forbidding illegal traffic to pass through the firewall.

As shown in Figure 1-1, the firewall is located at the enterprise-to-Internet egress to ensure intranet security. You can specify rules on the firewall to allow PCs on the intranet 10.1.1.0/24 to access the Internet and forbid Internet users to access the intranet host with the IP address 192.168.1.2.

Figure 1-1 Firewall's control over traffic forwarding

As shown above, firewalls are different from routers and switches. A router is used to connect different networks and ensure interconnection through routing protocols to make sure that packets are forwarded to destinations. A switch is usually used to set up a LAN to serve as an important hub for local area network communications. The switch quickly forwards packets through Layer 2/Layer 3 switching. A firewall is deployed at the network border to control the access to and from the network. Security protection is the core feature of a firewall. The essence of routers and switches is forwarding, and the essence of firewalls is control.

Firewalls control network traffic based on security zones and security policies, which will be described in the following sections.

As mentioned, firewalls are used to isolate networks of different security levels. A firewall identifies different networks by security zone. By assigning firewall interfaces to different security zones, the networks connected to the interfaces are classified into different security levels. Interfaces on the firewall must be added to security zones (except independent management interfaces on some models) to process traffic.

Security zones are designed to reduce network attack surfaces. Once security zones are defined, traffic cannot flow between security zones unless the administrator specifies valid access rules. To be specific, if a subnet is intruded, attackers can access only resources in a security zone corresponding to the subnet. Therefore, it is recommended that security zones be used for refined network partitioning.

Adding an interface to a security zone means that the network connected to the interface is added to the security zone, not the interface itself. Figure 1-2 shows the relationships between the interface, network, and security zone.

Figure 1-2 Interface, network, and security zone

Security zones of firewalls are divided into security levels from 1 to 100. A larger number indicates a higher security level. The firewall provides four default security zones: trust, dmz, untrust, and local. Administrators can also customize security zones to implement fine-grained control. For example, an enterprise divides firewall security zones according to Figure 1-3. The intranet interface is added to the trust zone, the extranet interface is added to the untrust zone, and the server interface is added to the DMZ. In addition, a security zone named visitor is defined as a guest zone.

An interface can be added to only one security zone. Multiple interfaces can be added to a security zone.

Figure 1-3 Dividing security zones

As shown in the preceding figure, there is a special security zone named local. The maximum security level is 100. local indicates the firewall itself. No interface can be added to the local zone, but all interfaces on the firewall belong to the local zone. It can be considered that packets sent by the firewall originate from the local zone and those received (not forwarded) by the firewall are destined for the local zone.

In addition to physical interfaces, the firewall also supports logical interfaces, such as sub-interfaces, VLANIF interfaces, and tunnel interfaces, which also need to be added to security zones.

As mentioned above, a firewall controls traffic through rules, which are called security policies. Security policies are a basic concept and core function of firewalls. Firewalls provide security management and control capabilities through security policies.

As shown in Figure 1-4, a security policy consists of matching conditions, an action, and a content security profile. You can perform content security detection functions, such as antivirus and intrusion prevention, for allowed traffic.

Figure 1-4 Security policy composition and web UI

Each preceding matching condition is optional in a security policy. Configured matching conditions are bitwise ANDed. That is, traffic is considered to match a security policy only when it matches all conditions in the security policy. If multiple values are configured in a matching condition, the values are bitwise ORed. That is, traffic matches the condition as long as it matches any value.

More specific matching conditions in a security policy will more accurately filter the traffic. You can use only the 5-tuple (source and destination IP addresses, source and destination ports, and protocol) as matching conditions. To configure security policies more accurately, you add more matching conditions, such as application and user identification.

Firewall-based security policies and local security policies

The traffic passing through a firewall, traffic sent by a firewall, and traffic received by a firewall are controlled by security policies. As shown in Figure 1-5, an intranet PC needs to log in to and manage the firewall through Telnet and access the Internet through the firewall. In this case, you need to configure security policies for the two types of traffic.

Figure 1-5 Firewall-based security policy and local security policy

In particular, this section will describe local security policies, that is, security policies related to the local zone. In the preceding example, the PC in the Trust zone logs in to the firewall and configures a security policy for the Trust zone to access the local network. If the firewall proactively accesses objects in other security zones, for example, when the firewall reports logs to a log server or connects to a security center to update signature databases, you need to configure security policies from the local zone to other security zones. To identify to which zones the firewall and external networks belong, note that the firewall itself is in the local zone. Adding an interface to a security zone indicates that only the network connected to the interface belongs to this security zone.

Default security policy and security policy list

The firewall has a default security policy named default, which blocks all interzone traffic by default. The default policy is always at the end of a policy list and cannot be deleted.

By default, security policies created by users are displayed from top to bottom in ascending order by creation time, and the newest security policy is prior to the default security policy. After receiving traffic, the firewall matches the traffic against security policies from top to bottom. Once a security policy is matched successfully, the firewall stops matching and processes the traffic according to the action specified in the security policy. If none of the manually created security policies is matched, the default security policy is used.

Therefore, the order for listing security policies determines whether policies are matched against as expected. After a security policy is created, you need to manually adjust its position in the list.

The IP address of a server within the enterprise network is 10.1.1.1. Users in the office area on the network segment 10.2.1.0/24 are allowed to access the server. The security policy policy1 is configured. After running for a period of time, two temporary office PCs (10.2.1.1 and 10.2.1.2) are forbidden to access the server.

The newly configured security zone policy policy2 is located below policy1. Because the address range of policy1 contains the address range of policy2, policy2 cannot be matched.

You need to manually move policy2 prior to policy1. After the adjustment, the security policies are as follows:

Therefore, when configuring a security policy, ensure the specific-before-general sequence for security policies. If a new security policy is added, pay attention to the relationship between the new security policy and existing ones. If the sequence is not as expected, adjust it.

For details about how to configure security policies, see Huawei Firewall Security Policy Essentials.

The following table lists the factory configurations of a firewall.

To restore factory configurations, choose System > Configuration File Management from the main menu on the web UI and click Restore Factory Settings.

Connect the management network interface, internal network interface GE0/0/2, and external network interface GE0/0/3, as shown in the following figure. Connect the management PC to the device's management network interface for login through the web UI. If the CLI is used, for the first login, use a console cable to connect the management PC's console port to the device's management network interface.

Figure 1-6 Cable connections to the firewall

A firewall works at Layer 3 by default and functions as the egress gateway to implement internal and external communication and protection. In this mode, the firewall forwards packets between network segments through routing protocols. Therefore, this access mode is also called routing mode.

When the firewall is deployed between the intranet and extranet, it is also responsible for translation between private IP addresses on the intranet and public IP addresses on the extranet, that is, the NAT function. Therefore, this access mode is also called NAT mode.

Figure 1-8 Firewall Layer 3 access networking

During initial access, you can use the quick wizard provided by the web UI to quickly connect the firewall to the Internet in one of the following enterprise-to-Internet access modes, before performing advanced configurations:

• Static IP: Select this access mode if you obtain a fixed IP address from a network service provider.
• PPPoE: Select this access mode if you obtain the username and password from a network service provider for dial-up.
• DHCP: Select this access mode if an IP address is automatically obtained from a network service provider.

After the quick wizard is executed, the basic configurations of the firewall are as follows:

• External network interface: Add the interface to the untrust zone and obtain a public IP address in an access mode selected by the administrator.
• Internal network interface: Add the interface to the trust zone and configure a private IP address for it. If the administrator has enabled the LAN DHCP service in the wizard, the DHCP server function is enabled on the internal network interface to assign IP addresses and DNS server addresses to LAN PCs.

  The internal network interface allocates the DNS server's IP address of the firewall to the LAN PC. The firewall functions as the DNS proxy to receive DNS requests from the PC and then sends the requests to the DNS server.

• Source NAT: An easy IP source NAT policy is available. The source IP addresses of all traffic whose outbound interface is the external network interface are translated into the external network interface's IP address.
• Route: A default route exists and its outbound interface is the external network interface. This route is used to forward traffic to the Internet.
• Security policy: The security policy is not configured. You need to manually configure the security policy to allow LAN users to access the Internet.

After the preceding configurations are complete, intranet PCs and firewalls can access the Internet. Perform the following operations to test the access to the Internet:

Test the access of an intranet PC to the Internet.

Enter a URL in the browser of the intranet PC to test whether the web page can be opened. If the web page fails to be opened, perform the following steps to rectify the fault:

1. Choose Network > Interface from the main menu. In the interface list, check whether the internal and external network interfaces of the firewall are Up. If the external network interface is Down, check whether the configurations on the firewall are consistent with the parameters provided by a network service provider.
2. Check whether the IP address and DNS server are correctly configured for the intranet PC. If the firewall is configured to assign IP addresses to the PC, run the ipconfig /all command in the CLI to check whether the PC can obtain an IP address and the DNS server's IP address through the firewall. If the PC cannot obtain an IP address, check the DHCP service configuration of the firewall.
3. Log in to the web UI of the firewall, choose Monitor > Diagnosis Center from the main menu, and click the Web Page Diagnosis tab. Enter the IP address and web page URL of the intranet PC, and click Diagnose. Rectify the fault according to diagnosis information.

Test the access of the firewall to the Internet.

Use the connectivity test function of a security center (isecurity.huawei.com) provided by the firewall web UI to test connectivity.

Choose System > Update Center from the main menu and click Server Connectivity Test. The check result page is displayed. If the connection fails, modify the connection as prompted.

Now, the firewall has been connected to the network and has basic security functions. Next, you can configure other advanced features. The following lists some common features. For details about how to configure them, see product documentation.

• Hot standby: Two firewalls are deployed for backup. If one firewall fails, the other firewall can quickly take over traffic of the faulty firewall, ensuring service traffic continuity.
• VPN: The firewall supports multiple types of VPNs, such as IPsec VPN, SSL VPN, L2TP VPN, and GRE, meeting branch interconnection and mobile office requirements.
• Intelligent uplink selection: When an enterprise accesses the Internet through multiple ISPs, the firewall provides dynamic and static intelligent uplink selection to adjust traffic distribution based on the traffic steering mode configured by an administrator to maximize link resource utilization.
• User authentication: A host dynamically obtains an IP address and multiple users log in to this host. IP address-based policy control cannot be performed on specific users. To address this issue, the firewall provides user authentication to control the rights of authenticated users.
• Content security: The basic security policy only controls whether to permit traffic. The firewall provides the content security function to deeply detect application-layer data based on the allowed traffic. Content security functions include intrusion prevention, antivirus, URL filtering, file filtering, content filtering, and mail filtering.
• Encrypted traffic detection: More application traffic is encrypted for transmission. You need to configure encrypted traffic detection to decrypt SSL traffic before performing content security detection.
• Bandwidth management: The bandwidth purchased by an enterprise is limited. Bandwidth management provides bandwidth limiting and bandwidth guarantee for key services to improve bandwidth utilization.

Logging is critical for monitoring network security, service running status, and firewall running status. An administrator periodically analyzes logs and adjusts firewall configurations to ensure continuous network protection.

The firewall supports various log types, such as session logs, traffic logs, policy matching logs, threat logs, and system logs. Table 1-3 lists common log types. For more information, see the corresponding product documentation.