Home / Security

Security

Destination NAT on Huawei USG firewall

23 Apr, 2024 Security, Video 0

If you have an FTP server or any other server that you want to make available to internet users, just place the server in DMZ zone of your firewall e.g. Huawei USG and configure a destination NAT. You can then easly restrict IP addresses and protocols that can access your server. And this video is just about that 😉

USG firewall configuration script:

# interface GigabitEthernet1/0/1 undo shutdown ip address 10.0.100.1 255.255.255.252 # interface GigabitEthernet1/0/2 undo shutdown ip address 5.0.0.2 255.255.255.252 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/2 # firewall zone dmz set priority 50 add interface GigabitEthernet1/0/1 # ip route-static 0.0.0.0 0.0.0.0 5.0.0.1 # firewall detect ftp # nat server 0 protocol tcp global 6.6.6.1 ftp inside 10.0.100.2 ftp unr-route # nat address-group PUBLIC_OUT 2 mode no-pat global route enable section 0 6.6.6.1 6.6.6.1 # security-policy rule name PUBLIC_OUT source-zone dmz destination-zone untrust source-address 10.0.100.0 mask 255.255.255.252 action permit rule name PUBLIC_IN source-zone untrust destination-zone dmz source-address 1.1.1.1 mask 255.255.255.255 destination-address 10.0.100.0 mask 255.255.255.252 action permit # nat-policy rule name PUBLIC_OUT source-zone dmz destination-zone untrust source-address 10.0.100.0 mask 255.255.255.252 action source-nat address-group PUBLIC_OUT

PAT or no-PAT – source NAT on Huawei USG6000

21 Mar, 2024 IP Services, Security, Video 0

If you, for some reason, cannot use easy-ip NAT, you can use source NAT with NAT address pool. Depending on how many public IP addresses you have got, you can configure no-PAT option, when only IP address is translated or you can set PAT, in other words NAT with port translation to assure LAN users accessing Internet. Details in the video 😉

USG firewall configuration script:

# dhcp enable # interface GigabitEthernet1/0/0 undo shutdown ip address 10.0.0.1 255.255.255.0 service-manage ping permit dhcp select interface dhcp server excluded-ip-address 10.0.0.100 dhcp server static-bind ip-address 10.0.0.200 mac-address 5489-98b4-6a79 dhcp server dns-list 10.0.0.100 # interface GigabitEthernet1/0/2 undo shutdown ip address 5.0.0.2 255.255.255.252 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/2 # ip route-static 0.0.0.0 0.0.0.0 5.0.0.1 # nat address-group SOURCE-NAT 0 mode pat route enable section 0 6.6.6.0 6.6.6.0 OR nat address-group SOURCE-NAT 0 mode no-pat global route enable section 0 6.6.6.0 6.6.6.1 # security-policy rule name ALLOW source-zone local destination-zone trust destination-zone untrust action permit rule name NAT_EASY source-zone trust destination-zone untrust source-address 10.0.0.0 mask 255.255.255.0 action permit # nat-policy rule name SOURCE-NAT source-zone trust destination-zone untrust source-address 10.0.0.0 mask 255.255.255.0 action source-nat address-group SOURCE-NAT

Easy-IP source NAT on Huawei USG firewall

13 Mar, 2024 IP Services, Security, Video 0

A short video describing EASY-IP source NAT on Huawei’s USG firewall to assure that our intranet users can acccess the Internet.

The easy-ip is the easiest way to translate private IP addresses on your local area network when you have only one public IP address or the public IP address is assigned dynamically.

USG firewall configuration script:

# dhcp enable # interface GigabitEthernet1/0/0 undo shutdown ip address 10.0.0.1 255.255.255.0 service-manage ping permit dhcp select interface dhcp server excluded-ip-address 10.0.0.100 dhcp server static-bind ip-address 10.0.0.200 mac-address 5489-98b4-6a79 dhcp server dns-list 10.0.0.100 # interface GigabitEthernet1/0/2 undo shutdown ip address 5.0.0.2 255.255.255.252 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/2 # ip route-static 0.0.0.0 0.0.0.0 5.0.0.1 # security-policy rule name ALLOW source-zone local destination-zone trust destination-zone untrust action permit rule name NAT_EASY source-zone trust destination-zone untrust source-address 10.0.0.0 mask 255.255.255.0 action permit # nat-policy rule name NAT_EASY source-zone trust destination-zone untrust source-address 10.0.0.0 mask 255.255.255.0 action source-nat easy-ip #

DHCP IPv4 server on Huawei USG6000 firewall

14 Nov, 2023 IP Services, Security, Video 1

You know how to configure DHCP on Huawei router but have problem to do so on Huawei firewall? Take a few minutes and see how to do that.

DHCP IPv4 server that uses interface’s address pool to allocate IPv4 addresses to DHCP clients. The simplest way to implement DHCP on USG6000.

USG firewall configuration script:

# dhcp enable # interface GigabitEthernet1/0/0 undo shutdown ip address 10.0.0.1 255.255.255.0 service-manage ping permit dhcp select interface dhcp server excluded-ip-address 10.0.0.100 dhcp server static-bind ip-address 10.0.0.200 mac-address 5489-98b4-6a79 dhcp server dns-list 10.0.0.100 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0 # security-policy rule name ALLOW action permit #

fun with wildcard mask on Huawei device

18 Aug, 2020 Command Line, How To, Security 0

You, as the network administrator, were tasked with providing access to a network, where 4 machines have been connected.

It is simple task. Nothing can happen, but…

Everything is ready and you are checking connectivity between RT2 and those machines, and… To your suprise, you can only ping even-numbered IP addresses:

[RT2]ping 192.168.10.1
   PING 192.168.10.1: 56  data bytes, press CTRL_C to break
     Request time out
     Request time out
     Request time out
     Request time out
     Request time out

 [RT2]ping 192.168.10.2
   PING 192.168.10.2: 56  data bytes, press CTRL_C to break
     Reply from 192.168.10.2: bytes=56 Sequence=1 ttl=127 time=30 ms
     Reply from 192.168.10.2: bytes=56 Sequence=2 ttl=127 time=20 ms
     Reply from 192.168.10.2: bytes=56 Sequence=3 ttl=127 time=30 ms
     Reply from 192.168.10.2: bytes=56 Sequence=4 ttl=127 time=40 ms
     Reply from 192.168.10.2: bytes=56 Sequence=5 ttl=127 time=30 ms

 [RT2]ping 192.168.10.3
   PING 192.168.10.3: 56  data bytes, press CTRL_C to break
     Request time out
     Request time out
     Request time out
     Request time out
     Request time out

 [RT2]ping 192.168.10.4
   PING 192.168.10.4: 56  data bytes, press CTRL_C to break
     Reply from 192.168.10.4: bytes=56 Sequence=1 ttl=127 time=30 ms
     Reply from 192.168.10.4: bytes=56 Sequence=2 ttl=127 time=40 ms
     Reply from 192.168.10.4: bytes=56 Sequence=3 ttl=127 time=30 ms
     Reply from 192.168.10.4: bytes=56 Sequence=4 ttl=127 time=30 ms
     Reply from 192.168.10.4: bytes=56 Sequence=5 ttl=127 time=30 ms

Page 1 of 412 3 4 »