ZoneBasedFirewall Huawei Eudemon

The huawei Eudemon  firewall meets the true definition of a ZoneBasedFirewall.

It's similar to  netscreen/SRX/PaloAlto  and uses a combination of ZBF  features such as security concepts and acls.

Here in this example, we will build a basic classic 3 zone  security concept ( untrust/dmz/trust ) and assign interfaces into the zones


zone =  utrust ( public internet )
zone =  trust ( inside )
zone =  dmz ( dmz services )

1st we build the interfaces

interface GigabitEthernet0/0/0

 description UNTRUSTED

 ip address  192.0.2.1 255.255.255.0

#

interface GigabitEthernet0/0/1

 description TRUST-zone

 ip address 192.168.100.1 255.255.255.0

  Vrrp vrid 11 virtual-ip 192.168.100.254 master

#

interface GigabitEthernet0/0/2

 description  DMZprimario

 ip address 192.168.101.1 255.255.255.0

  Vrrp vrid 12 virtual-ip 192.168.101.254 master

Next we assign the interfaces to our zones;

firewall zone untrust

  add interface GigabitEthernet0/0/0

    set priority 5

firewall zone trust

  add interface GigabitEthernet0/0/1

  set priority 100

firewall zone dmz

  add interface GigabitEthernet0/0/2

  set prior 50

 Finally we put the few misc items;

#

 ip route-static 0.0.0.0 0.0.0.0 192.0.2.254 description uplink_to_world

#

#

ip address-set LAN1 type group

 description         LANnetwork     

 address 0 192.168.100.0 mask 24

#

#

ip address-set DMZ1 type group

 description         DMZnetwork     

 address 0 192.168.101.0 mask 24

#

#

policy interzone trust untrust outbound

  policy 0

  action permit

  policy source address-set LAN1

#

policy interzone trust dmz outbound

 policy 0

  action permit

  policy source 192.168.101.0 0.0.0.255

#  my SNAT pool

nat adress-group 1 192.0.0.1 192.0.0.2

#

# SNAT for local LAN1 outbound 

nat-policy interzone trust untrust outbound

 policy 0

  action source-nat

  policy source address-set LAN1

  address-group 1

                                
         

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \