The last article dealt with outbound NAT. Let’s focus today on NAT server. NAT server enables private network servers to provide services for external networks with public IP addresses. In this lab, our enterprise provides FTP services for external users.

We can use the topology from the last post:

In our case AR router works as FTP server:

#
FTP server enable
aaa
 local-user labnario password cipher qGj8!H#yx.ajUn1vMEIB1lG#
 local-user labnario privilege level 3
 local-user labnario ftp-directory flash:
 local-user labnario service-type ftp
#
interface GigabitEthernet0/0/1
 ip address 172.16.1.254 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 172.16.1.1

Configuration of Internet router:

#
interface GigabitEthernet0/0/2
 ip address 1.1.1.2 255.255.255.0
#
ip route-static 1.1.1.100 255.255.255.255 1.1.1.1

Firewall USG5500 configuration

Set IP addresses of interfaces and add them to proper security zones:

[SRG]dis current-configuration interface GigabitEthernet 
#
interface GigabitEthernet0/0/1
 ip address 172.16.1.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 ip address 1.1.1.1 255.255.255.0

[SRG]display current-configuration configuration zone 
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/2
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet0/0/1

Configure interzone packet filtering to ensure that users in Untrust zone can access the FTP server in DMZ zone:

[SRG]display current-configuration configuration policy-interzone 
#
policy interzone dmz untrust inbound
 policy 1
  action permit
  policy service service-set ftp
  policy destination 172.16.1.254 0

Configure internal server. Create a mapping relation between public and private IP addresses of FTP server:

[SRG]nat server 0 protocol tcp global 1.1.1.100 ftp inside 172.16.1.254 ftp

Configure the NAT ALG function for the DMZ-Untrust interzone to ensure that the server provides FTP services for extranet users normally:

[SRG]display current-configuration configuration interzone 
#
firewall interzone dmz untrust
 detect ftp

What is NAT ALG for? NAT translates only IP addresses in IP packet headers and port information in TCP/UDP packet headers. In our case, the firewall must identify the IP address and port number in the payload field of the FTP application, to continue NAT processing. Without NAT ALG, the NAT process fails.

Verification of NAT server

[SRG]display firewall session table verbose
 Current Total Sessions : 1
  ftp  VPN:public --> public
  Zone: untrust--> dmz  TTL: 00:10:00  Left: 00:09:52
  Interface: GigabitEthernet0/0/1  NextHop: 172.16.1.254  MAC: 54-89-98-91-56-e2
  <--packets:6 bytes:363   -->packets:8 bytes:364
  1.1.1.2:61428+->1.1.1.100:21[172.16.1.254:21]

[SRG]display nat server 
Server in private network information:
 id                : 0                  
 zone              : ---           
 interface         : ---           
 global-start-addr : 1.1.1.100           global-end-addr   : ---                
 inside-start-addr : 172.16.1.254        inside-end-addr   : ---                
 global-start-port : 21(ftp)             global-end-port   : ---                
 insideport        : 21(ftp)            
 globalvpn         : public              insidevpn         : public             
 protocol          : tcp                 vrrp              : ---                
 no-reverse        : no                 

  Total   1 NAT servers

[SRG]display firewall server-map 
11:30:50  2015/04/22
 server-map item(s) 
 ------------------------------------------------------------------------------
 Nat Server, any -> 1.1.1.100:21[172.16.1.254:21], Zone: ---
   Protocol: tcp(Appro: ftp), Left-Time: --:--:--, Addr-Pool: ---
   VPN: public -> public

 Nat Server Reverse, 172.16.1.254[1.1.1.100] -> any, Zone: ---
   Protocol: any(Appro: ---), Left-Time: --:--:--, Addr-Pool: ---
   VPN: public -> public


<Internet>ftp 1.1.1.100
Trying 1.1.1.100 ...
Press CTRL+K to abort
Connected to 1.1.1.100.
220 FTP service ready.
User(1.1.1.100:(none)):labnario
331 Password required for labnario.
Enter password:
230 User logged in.

[ftp]

I am often asked how to find syslog commands on Huawei devices. As one is familiar with Cisco‘s devices, he is looking for “logging” command in Huawei’s VRP. And this is the main problem. Remember that equivalent of Cisco’s logging is info-center on Huawei.

The information center functions as an information hub. The information center manages most output information. Output information is classified and then effectively filtered. Together with debugging commands and the SNMP module, the information center provides powerful support for the network administrator to monitor the operation of devices and locate faults.

Generally speaking, the information center distributes three types of information with eight severity levels to ten information channels, and then outputs that information in different directions.

Today I decided to create a simple cheat sheet, describing Huawei’s information center:

As a graphical user interface is useless in case of routers and switches, it looks useful when configuring a firewall. Of course it is my point of view. I do not go into what is better for you. I like using CLI but, sometimes, it is worth to simplify your daily routine. The first step is to configure HTTPS access to webUI of USG6300. This is what we will focus today.

Well known topology from the last post:

Configure IP address of firewall’s interface and add it to trust zone:

[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]ip address 172.16.1.1 24

[USG6300]firewall zone trust
[USG6300-zone-trust]add interface GigabitEthernet 0/0/7

Enable HTTPS server on that interface:

[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]service-manage https permit

Create two administrator’s accounts:

#
 manager-user web_lab
  password cipher %@%@`ruiCXfgEFCJGnNu0!<@&bYP@.eMJIk7-H&m&h&[xo11Oh_Z%@%@
  service-type web
  level 15
  ftp-directory hda1:
  ssh authentication-type password
  ssh service-type stelnet
 #
 manager-user web_lab_2
  password cipher %@%@S0e84!g|rRX38&1S*-l;h*!ub`{@$-`o0=71fW<8Ch{9g0'"%@%@
  service-type web
  level 15
  ftp-directory hda1:
  ssh authentication-type password
  ssh service-type stelnet
#

Why two accounts? Because we will assign different roles for these 2 administrators to show you such possibility. We will use the default system-admin role for one administrator and a new created web-admin role for the second one.

#
role system-admin
  description system-admin
 dashboard read-write
 monitor read-write
 policy read-write
 object read-write
 network read-write
 system read-write

#
role web_lab
 dashboard none
 monitor
  read-only session statistic statistic-acl
  none packet-capture diagnose
 policy none
 object none
 network none
 system none
#

Then we can bind our administrators to properly defined roles:

[USG6300-aaa]bind manager-user web_lab role system-admin
[USG6300-aaa]bind manager-user web_lab_2 role web_lab

Enable HTTPS server with default certificate and set the service port:

[USG6300]web-manager enable
 Enable http server successfully !
[USG6300]web-manager security enable port 8443
 Enable http security-server successfully ! web-manager

Let’s verify what will happen if we use both accounts to get to GUI of the firewall.

Open a browser and enter https://172.16.1.1:8443.

As you can notice, the access varies depending on the assigned role for administrators.

A new box for fun 🙂

Thanks to my colleagues I have opportunity to test Huawei Secospace USG6300.

A rental period is not long, so let’s start from the beginning.

Telnet and SSH

Configure IP address of firewall’s interface and assign it to trust zone:

[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]ip address 172.16.1.1 24

[USG6300]firewall zone trust
[USG6300-zone-trust]add interface GigabitEthernet 0/0/7

Enable telnet and SSH services on that interface:

[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]service-manage telnet permit
[USG6300-GigabitEthernet0/0/7]service-manage ssh permit

Create local users for telnet and SSH access:

[USG6300]aaa
[USG6300-aaa]manager-user vty_labnario
[USG6300-aaa-manager-user-vty_labnario]password cipher Labnario123
[USG6300-aaa-manager-user-vty_labnario]service-type telnet
[USG6300-aaa-manager-user-vty_labnario]level 15

#
 manager-user ssh_labnario
  password cipher %@%@*;-$=&1LSK4n^9Tn)Ny!H,#w3&0~LrT%*W@gFyXV4LT,"2)$%@%@
  service-type ssh
  level 15
  ftp-directory hda1:
  ssh authentication-type password
  ssh service-type stelnet
 #

Set authentication method for VTY interfaces:

[USG6300]user-interface vty 0 4
[USG6300-ui-vty0-4]authentication-mode aaa

Enable servers for configured services:

[USG6300]telnet server enable
[USG6300]stelnet server enable

To complete SSH configuration, create RSA key:

[USG6300]rsa local-key-pair create
12:06:32  2015/03/31
The key name will be: USG6300_Host
The range of public key size is (512 ~ 2048).
NOTES: A key shorter than 2048 bits may cause security risks.
       The generation of a key longer than 512 bits may take several minutes.
Input the bits in the modulus[default = 2048]:
Generating keys...
.+++
.............+++
.............++++++++
.............++++++++

[USG6300]

Let’s verify access to the device:

***********************************************************
*           All rights reserved 2014                      *
*       Without the owner's prior written consent,        *
* no decompiling or reverse-engineering shall be allowed. *
* Notice:                                                 *
*      This is a private communication system.            *
*   Unauthorized access or use may lead to prosecution.   *
***********************************************************

Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.

Login authentication


Username:vty_labnario
Password:
Note: The max number of VTY users is 5, and the current number
      of VTY users on line is 1.
NOTICE:This is a private communication system.
       Unauthorized access or use may lead to prosecution.
<USG6300>
First time login or password is overtime, Please change your password.
Please input new password:**********
Please confirm new password:**********
Note: The max number of VTY users is 5, and the current number
      of VTY users on line is 1.
NOTICE:This is a private communication system.
       Unauthorized access or use may lead to prosecution.
<USG6300>

login as: ssh_labnario
ssh_labnario@172.16.1.1's password:

***********************************************************
*           All rights reserved 2014                      *
*       Without the owner's prior written consent,        *
* no decompiling or reverse-engineering shall be allowed. *
* Notice:                                                 *
*      This is a private communication system.            *
*   Unauthorized access or use may lead to prosecution.   *
***********************************************************

Note: The max number of VTY users is 5, and the current number
      of VTY users on line is 1.
  ----------------------------------------------------------------------------
  User last login information:
  ----------------------------------------------------------------------------
  Access Type: SSH
  IP-Address : 172.16.1.10
  Time       : 2015-03-31 12:08:16 +01:00
  State      : Login Succeeded
  ----------------------------------------------------------------------------
<USG6300>
Note: The max number of VTY users is 5, and the current number
      of VTY users on line is 1.
NOTICE:This is a private communication system.
       Unauthorized access or use may lead to prosecution.
<USG6300>

As you could see, password must be changed after the first login. You can disable modifying the password by the command:

[USG6300-aaa]undo manager-user password-modify enable

SFTP

As secure FTP is related to SSH, let’s try to finish this article with SFTP configuration:

#
 manager-user sftp_lab
  password cipher %@%@!siuS<f},>]>IM,2!|,#K!ul&;<u1g4:%'e8[NIfPZF@*'{v%@%@
  service-type ssh
  level 15
  ftp-directory hda1:
  ssh authentication-type password
  ssh service-type sftp
#
[USG6300]sftp server enable
Info: Succeeded in starting the SFTP server.

To verify, we can use PSFTP software:

psftp> open 172.16.1.1
login as: sftp_lab
Using username "sftp_lab".
sftp_lab/172.16.1.1's password:
Remote working directory is /
psftp>