Firewall Intrusion Prevention Technologies

What this chapter covers

Firewall Intrusion Prevention Technologies is 10% of the Huawei HCIA-Security H12-711 exam. It covers the kinds of intrusion a network faces, how IDS and IPS differ, how a USG firewall detects attacks with IPS signatures and signature filters, and how its antivirus function finds and handles viruses in files.

Questions are single-answer, multiple-answer without a stated count, true/false, drag and drop and typed fill-in-the-blank, often "Which of the following statements is true?". Some show a firewall topology figure or a security policy that references an IPS or antivirus profile, and ask what happens to the matching traffic.

It has 3 outline topics, and two pages cover them.

How the topics fit together

The intrusion overview names the threats, and intrusion prevention explains how the firewall inspects packet contents against signatures to stop them. Antivirus applies the same content inspection to files carried by web, mail and file sharing protocols.

Both IPS and antivirus are profiles. They inspect only traffic that a security policy permits and references them, and their signature databases need a valid license to update.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with tables and examples.
• What to remember for the exam: the facts to memorize.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read each configuration snippet and say what it does before reading the explanation. The exam often shows a short configuration and asks which traffic is permitted, translated or allowed to log in.