CLI: Example for Configuring the FW to Interwork with the HiSec Insight (Mirroring Traffic Through the Switch)

Networking Requirements

The FW can interwork with the HiSec Insight to identify and block malicious sessions. As shown in Figure 1, the FW acts as the RESTCONF server, and the HiSec Insight as the RESTCONF client. The FW and HiSec Insight are reachable, and the FW uses the RESTCONF NBI to communicate with the HiSec Insight.

Service traffic is mirrored by the downstream switch to the HiSec Insight.

Figure 1 Interworking between the FW and HiSec Insight

Configuration Roadmap

Configure an API administrator for authentication for communication between the HiSec Insight and the FW.
Configure northbound RESTCONF interface.
Enable interworking with the HiSec Insight.
Configure the port mirroring function on the switch to mirror service traffic to the HiSec Insight.

Procedure

Set interface IP addresses and assign the interfaces to security zones.

Set the IP address of GigabitEthernet0/0/1 and add it to the Untrust zone.

[sysname] interface GigabitEthernet0/0/1
[sysname-GigabitEthernet0/0/1] ip address 1.1.1.1 24
[sysname-GigabitEthernet0/0/1] quit
[sysname] firewall zone untrust
[sysname-zone-untrust] add interface GigabitEthernet0/0/1
[sysname-zone-untrust] quit

Set the IP address of GigabitEthernet0/0/2 and add it to the Trust zone.

[sysname] interface GigabitEthernet0/0/2
[sysname-GigabitEthernet0/0/2] ip address 10.1.1.1 24
[sysname-GigabitEthernet0/0/2] quit
[sysname] firewall zone trust
[sysname-zone-trust] add interface GigabitEthernet0/0/2
[sysname-zone-trust] quit

Set the IP address of GigabitEthernet0/0/3 and add it to the DMZ.

[sysname] interface GigabitEthernet0/0/3
[sysname-GigabitEthernet0/0/3] ip address 10.1.2.1 24
[sysname-GigabitEthernet0/0/3] quit
[sysname] firewall zone dmz
[sysname-zone-dmz] add interface GigabitEthernet0/0/3
[sysname-zone-dmz] quit

Configure security policies to ensure that users in the enterprise network, HiSec Insight, and FW can communicate.

Configure a security policy to allow the HiSec Insight flow probe to transfer files from the FW's Local zone to the DMZ where the HiSec Insight resides.

[sysname] security-policy
[sysname-policy-security] rule name policy_to_cis
[sysname-policy-security-rule-policy_to_cis] source-zone local
[sysname-policy-security-rule-policy_to_cis] destination-zone dmz
[sysname-policy-security-rule-policy_to_cis] action permit
[sysname-policy-security-rule-policy_to_cis] quit

Configure a security policy to allow users in the enterprise network to access the Internet.

[sysname-policy-security] rule name policy_to_Internet
[sysname-policy-security-rule-policy_to_Internet] source-zone trust
[sysname-policy-security-rule-policy_to_Internet] destination-zone untrust
[sysname-policy-security-rule-policy_to_Internet] action permit
[sysname-policy-security-rule-policy_to_Internet] quit

Create an API administrator and use local authentication. The user name and password can be customized. After this administrator account is created, remember the user name and password. When the HiSec Insight communicates with the FW, the administrator account is used for authentication.
```
[sysname] aaa
[sysname-aaa] manager-user restconf-admin
[sysname-aaa-manager-user-restconf-admin] service-type api
[sysname-aaa-manager-user-restconf-admin] password cipher Hello@123
[sysname-aaa-manager-user-restconf-admin] quit
[sysname-aaa] quit
```

Configure a RESTCONF NBI.

[sysname] api
[sysname-api] api https port 8447 enable
[sysname-api] undo security server-certificate
[sysname-api] quit

Enable the blacklist function.
```
[sysname] firewall blacklist enable
```

Configure the HiSec Insight interworking function.

[sysname] apt-cis
[sysname-apt-cis] linkage enable
[sysname-apt-cis] blacklist aging-time 30
[sysname-apt-cis] log interval 1
[sysname-apt-cis] quit

Configure the port mirroring function on the switch.
This example uses Huawei S9700 to describe how to configure the port mirroring function. For the configurations of other functions, refer to the product documents of the S9700.
1. Configure GigabitEthernet 0/0/2 as the observing interface.
```
<Switch> system-view
[Switch] observe-port 1 interface GigabitEthernet 0/0/2
```
2. Configure GigabitEthernet 0/0/1 as the mirroring port to mirror incoming traffic.
```
[Switch] interface GigabitEthernet 0/0/1
[Switch-GigabitEthernet0/0/1] port-mirroring to observe-port 1 inbound
[Switch-GigabitEthernet0/0/1] quit
```

Verification

Run the display firewall blacklist item type apt-cis command to check the blacklists generated when the HiSec Insight delivers blocking instructions.

<sysname> display firewall blacklist item type apt-cis
IP/port/protocol/user                              Reason                         Insert Time            Age Time  HitTimes        
  ----------------------------------------------------------------------------------------------------------------------------      
 1.1.1.1 /any (src) /any/                           Apt-cis                       2017/02/16 16:59:55    Permanent 2

Run the display apt-cis statistics log command to check threat log statistics sent to the HiSec Insight.

<sysname> system-view
[sysname] diagnose
[sysname-diagnose] display apt-cis statistics log destination 10.1.1.1

Configuration Scripts

#
aaa
  manager-user restconf-admin                                                    
  password cipher @%@%r"4+){k0COFQte$ymxOMEk80.\ACNlhJgDNfvyN*CqfSk83E@%@%      
  service-type api  
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 undo shutdown
 ip address 10.1.1.1 255.255.255.0
 #
interface GigabitEthernet0/0/3
 undo shutdown
 ip address 10.1.2.1 255.255.255.0
#
 firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/2
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet0/0/3
#
api
 api https enable
#
security-policy
 default action permit
 rule name policy_to_cis
  source-zone local
  destination-zone dmz
  action permit
 rule name policy_to_Internet
  source-zone trust
  destination-zone untrust
  action permit
 group name https
#
apt-cis
 linkage enable
#
return