Eudemon Basic Function

and Configuration
T

www.huawei.com

HUAWEI TECHNOLOGIES CO., LTD. All rights reserved

 This section will introduce the modes of
operation for the Eudemon firewall, as
well as security area concepts, Access
Control Lists, Network Address
Translation etc, used to enhance the
defense capability of the firewall

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 2
 Upon completion of this section, you should
expect to :
 Build an understanding of security areas
 Understand the operational modes of a
firewall
 Acquire the knowledge to explain and
configure ACL & NAT

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 3
 Chapter 1 Security Zones

Chapter 2 Modes of Operation

Chapter 3 Access Control Lists

Chapter 4 Network Address Translation

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 4
 Firewall Security Zone

Interface 2
Local Zone Trust Zone
100 85
Zone defined
by user
DMZ Zone
50 UnTrust Zone Interface 3
5

Interface 1 Interface 4

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 5
 Security Zone Data Flow ---Inter-zone
inbound
Internal network

outbound

Eudemon
Local
Trust
E1/0/0 E1/0/2 External network

Eth1/0/1
Untrust
outbound
outbound
inbound
inbound
Server
Server
DMZ

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 6
 Security Zone Configuration

[Eudemon] firewall zone name userzone

[Eudemon-zone-userzone] set priority 60
[Eudemon-zone-userzone] add interface Ethernet 0/0/1

[Eudemon]display zone userzone

userzone
priority is 60
interface of the zone is (1):
Ethernet0/0/1

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 7
 Interzone policy configuration

[Eudemon]policy interzone trust untrust inbound

[Eudemon-interzone-trust-untrust]policy source any
[Eudemon-interzone-trust-untrust]action permit

PC PC PC
Trust Zone
Untrust Zone

Eudemon
Server Server

Internal network External network

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 8
 Chapter 1 Security Zones

Chapter 2 Modes of Operation

Chapter 3 Access Control Lists

Chapter 4 Network Address Translation

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 9
 Route Mode

10.110.1.254 202.10.0.1
PC PC PC
Trust Zone Untrust Zone

Eudemon
Server Server

Internal network External network

10.110.1.0/24 202.10.0.0/24

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 10
 Transparent Mode

PC PC PC
Trust
Untrust

Eudemon
Server Server

Internal network 202.10.0.0/24 External network

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 11
 Composite Mode

Eudemon （ active ）

PC PC PC
Trust
VRRP Untrust

Server Server

Internal network Eudemon （ standby ） External network

202.10.0.0/24 202.10.0.0/24

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 12
 Chapter 1 Security Zones

Chapter 2 Modes of Operation

Chapter 3 Access Control Lists

Chapter 4 Network Address Translation

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 13
 ACL Application
 Packet filtering

 Determine whether to discard or forward packet according to ACL

rule
 NAT

 Determine whether to implement NAT to which packet According

to ACL
 IPSec

 Determine whether to protect which packet according to ACL

 QoS
What is ACL?
 Classify flow according to ACL
Permit
 Routing policy
Deny
 Filter routes according to ACL

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 14
 ACL Classification

 Basic ACL （ range: 2000 ～ 2999 ）

 Use of source address to define the data flow

 Advanced ACL （ range: 3000 ～ 3999 ）

 Use of source address, destination address, source port number,

destination port number and protocol number, combined to define

the data flow.

 Firewall ACL （ range:5000 ～ 5499 ）

 Use of source address, destination address, destination port number

to define the data flow

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 15
 ACL Classification
acl [ number ] acl-number
rule [ rule-id ] { permit | deny } [ source { source-address
source-wildcard | any } ] [ time-range time-name ]
rule [ rule-id ] { permit | deny } protocol [ source { source-
address source-wildcard | any } ] [ destination { dest-address
dest-mask | any } ] [ source-port operator port1 [ port2 ] ] [
destination-port operator port1 [ port2 ] ] [ icmp-type
{ icmp-type icmp-code | icmp-message } ] [ precedence
precedence ] [ tos tos ] [ time-range time-name ]

Firewall ACL Advanced ACL Basic ACL

Match the route to an acl-number

Match the route to a rule-id

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 16
 ACL Application Example

FTP Server Telnet Server www Server

129.38.1.1 129.38.1.2 129.38.1.3

E0/0/0 129.38.1.5
Special PC in external network
Special PC in internal network Eudemon
202.39.2.3
129.38.1.4 E1/0/0
202.38.160.1

WAN

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 17
 ACL Application Example － Configuration
[Eudemon] acl number 3101
[Eudemon-acl-adv-3101] rule permit ip source 129.38.1.4 0
[Eudemon-acl-adv-3101] rule permit ip source 129.38.1.1 0
[Eudemon-acl-adv-3101] rule permit ip source 129.38.1.2 0
[Eudemon-acl-adv-3101] rule permit ip source 129.38.1.3 0
[Eudemon-acl-adv-3101] rule deny ip
[Eudemon-acl-adv-3101] quit
[Eudemon] acl number 3102
[Eudemon-acl-adv-3102] rule permit tcp source 202.39.2.3 0 destination 129.38.1.1 0
[Eudemon-acl-adv-3102] rule permit tcp source 202.39.2.3 0 destination 129.38.1.2 0
[Eudemon-acl-adv-3102] rule permit tcp source 202.39.2.3 0 destination 129.38.1.3 0
[Eudemon 200E-Ethernet1/0/0]firewall packet-filter 3101 outbound
[Eudemon 200E-Ethernet1/0/0]firewall packet-filter 3102 inbound

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 18
 Chapter 1 Security Zones

Chapter 2 Modes of Operation

Chapter 3 Access Control Lists

Chapter 4 Network Address

Translation

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 19
 NAT (Network Address Translation)

 NAT is used to translate IP addresses in IP data packet header

to alternative IP addresses.
 NAT can solve the following problems:

 IP address shortage

− Helps reserve public IP addresses

 Security element

− Shield private networks

 Enterprise combination

− Easy to merge networks

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 20
 Public and Private Addressing

192.168.0.2
192.168.0.1
LAN2

LAN1
Internet

192.168.0.1
Private address range:
10.0.0.0-10.255.255.255 LAN3
172.16.0.0-172.31.255.255
192.168.0.0-192.168.255.255

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 21
 Eudemon NAT
Data packet 1
Source 192.168.1.3
destination 202.120.10.2 Data packet 1 Server B
PC A source 202.169.10.1 202.120.10.2
Destination 202.120.10.2
192.168.1.3

Trust Eudemon Untrust

E0/0/0 E0/0/0
Internet
192.168.1.1 202.169.10.1

Data packet 2 Data packet 2

source 202.120.10.2
Source 202.120.10.2 destination 202.169.10.1
PC B
destination192.168.1.3
192.168.1.2 PC C
202.130.10.3

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 22
 Eudemon NAPT
Data packet 1 Data packet 1
source 192.168.1.3 source 202.169.10.1
Source port 1357 Source port 1357

Server B
Data packet 2 Data packet2
PC A source 192.168.1.3 source 202.169.10.1 202.120.10.2
192.168.1.3 Source port 2468 Source port 2468

Trust Eudemon Untrust

E0/0/0 E0/0/0
Internet
192.168.1.1 202.169.10.1
Data packet3 Data packet3
source 192.168.1.1 source 202.169.10.1
Source port 11111 Source port 11111
PC B
192.168.1.2 PC C
Data packet4 Data packet4 202.130.10.3
source 192.168.1.2 source 202.169.10.1
Source port 11111 Source port 22222

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 23
 Eudemon Internal Server NAT

Internet
Untrust Data packet 1
Data packet 2
source 202.168.0,2 source 202.168.0.11
E0/0/1 202.168.0.1/26
Destination destination 202.168.0.2
202.168.0.11
Data packet 1 Data packet 2
E1/0/0 192.168.1.1/24 source 202.168.0,2 source 192.168.0.101
ALG function destination destination 202.168.0.2
DMZ 192.168.0.101
202.168.0.11-192.168.1.101

Mail Server Web Server FTP Server

192.168.1.100/24 192.168.1.101/24 192.168.1.102/24

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 24
 Eudemon NAT Implementation

Eudemon

Private
ACL Public address
address

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 25
 Internal Server NAT Network

Internet
Untrust

202.168.0.1/24 E0/0/1
202.168.0.10-192.168.1.100
Internal network E0/0/0
192.168.0.0/24 202.168.0.11:80-192.168.1.101:8080
192.168.0.1/24
202.168.0.12:1021-192.168.1.102:ftp
192.168.1.1/24 E1/0/0
Trust
DMZ

Mail Server Web Server FTP Server

192.168.1.100/24 192.168.1.101/24 192.168.1.102/24

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 26
 Egress Network NAT Typical Configuration
[Eudemon] acl 2000
[Eudemon-acl-basic-2000]rule permit
[Eudemon-acl-basic-2000]quit
[Eudemon] nat address-group 1 202.168.0.10 202.168.0.20
Configure address pool
[Eudemon 200E]nat-policy interzone trust untrust outbound
[Eudemon 200E-nat-policy-interzone-trust-untrust-
outbound]policy 1
[Eudemon 200E-nat-policy-interzone-trust-untrust-outbound-
1]policy source 192.168.0.0 mask 24
[Eudemon 200E-nat-policy-interzone-trust-untrust-outbound-
1]address-group 1 no-pat Enable NAT function, bind address pool
[Eudemon 200E-nat-policy-interzone-trust-untrust-outbound-
1]action source-nat

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 27
 NAT Server Typical Configuration

[Eudemon] nat server global 202.168.0.10 inside 192.168.1.100

[Eudemon] nat server protocol tcp global 202.168.0.11 80 inside
192.168.1.101 8080
[Eudemon] nat server protocol tcp global 202.168.0.12 1021 inside
192.168.1.102 ftp
Configure mapping information between global
address and internal server address
[Eudemon 200E]policy interzone dmz untrust inbound
[Eudemon 200E-policy-interzone-dmz-untrust-inbound]policy 1
[Eudemon 200E-policy-interzone-dmz-untrust-inbound-1]policy
destination 192.168.1.0 mask 24
[Eudemon 200E-policy-interzone-dmz-untrust-inbound-1]policy
service service-set ftp
[Eudemon 200E-policy-interzone-dmz-untrust-inbound-1]action deny

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 28
 NAT Configuration Verification

[Eudemon 200E]display nat all

16:32:49 2012/08/01
NAT information on zone:
Total 0 items on the zone If address pool is imported, it
NAT information on interzone: can not be deleted directly.

Total 0 items
NAT address-group information:
number : 1 name : ---

startaddr : 202.168.0.10 endaddr : 202.168.0.20

reference : 1 vrrp : ---

vpninstance : public
Total 1 address-groups
HUAWEI TECHNOLOGIES CO., LTD.. T
All rights reserved Page 29
---- More ----
 Summary

 Which operational modes does Eudemon

support?
 What are the default Eudemon security
zones?
 What is the difference between a basic ACL
and an advanced ACL?
 Which forms of NAT does Eudemon support?

HUAWEI TECHNOLOGIES CO., LTD.. T

All rights reserved Page 30
Thank you
www.huawei.com T