Web: Example for Configuring the FW to Interwork with the HiSec Insight (Mirroring Traffic Through the Switch)

Procedure

1. Set interface IP addresses and assign the interfaces to security zones.
   1. Choose Network > Interface.
   2. Click of GE0/0/1 and set the parameters as follows.

      IP Address	1.1.1.1
      Subnet Mask	255.255.255.0
      Security Zone	untrust

   3. Click OK.
   4. Configure GE0/0/2 based on the preceding step.

      IP Address	10.1.1.1
      Subnet Mask	255.255.255.0
      Security Zone	trust

   5. Configure GE0/0/3 based on the preceding step.

      IP Address	10.1.2.1
      Subnet Mask	255.255.255.0
      Security Zone	dmz

2. Configure security policies to ensure that users in the enterprise network, HiSec Insight, and FW can communicate.
   1. Configure a security policy to allow the HiSec Insight flow probe to transfer files from the FW's Local zone to the DMZ where the HiSec Insight resides.
   2. Choose Policy > Security Policy > Security Policy.
   3. Click Add.
   4. Configure the following parameters for the security policy.

      Name	policy_to_cis
      Source Zone	local
      Destination Zone	dmz
      Action	Permit

   5. Click OK.
   6. Configure a security policy to allow users in the enterprise network to access the Internet.

      Name	policy_to_Internet
      Source Zone	trust
      Destination Zone	untrust
      Action	Permit

3. Create an API administrator and use local authentication. The user name and password can be customized. After this administrator account is created, remember the user name and password. When the HiSec Insight system communicates with the FW, this administrator account shall be used for authentication.

   Choose System > Administrator > Administrator and click Add.

   

4. Configure the HiSec Insight interworking function.
   1. Choose System > Setup > HiSec Insight Interworking.
   2. Enable the HiSec Insight interworking function.
   3. Enable RESTCONF.

      You can use the default configuration or modify the configuration according to the actual networking requirements.

   4. Enable Blacklist Status to enable the blacklist function.
   5. Set other parameters for HiSec Insight interworking.

      You can use the default configuration or modify the configuration according to the actual networking requirements.

   6. Click Apply.
5. Configure the port mirroring function on the switch.

   This example uses Huawei S9700 to describe how to configure the port mirroring function. For the configurations of other functions, refer to the product documents of the S9700.

   1. Configure GigabitEthernet 0/0/2 as the observing interface.

      <Switch> system-view
      [Switch] observe-port 1 interface GigabitEthernet 0/0/2

   2. Configure GigabitEthernet 0/0/1 as the mirroring port to mirror incoming traffic.

      [Switch] interface GigabitEthernet 0/0/1
      [Switch-GigabitEthernet0/0/1] port-mirroring to observe-port 1 inbound
      [Switch-GigabitEthernet0/0/1] quit