Firewall Security Policies

What this chapter covers

Firewall Security Policies is 10% of the Huawei HCIA-Security H12-711 exam. It covers how firewalls developed, how a Huawei USG or HiSecEngine firewall divides the network into security zones, how stateful inspection and the session table work, how security policies are matched and configured, and where firewalls are placed in real security solutions.

Questions are single-answer, multiple-answer without a stated count, true/false, drag and drop and typed fill-in-the-blank, often "Which of the following statements is true?". Many show a firewall topology figure, a security-policy configuration or display firewall session table output and ask whether traffic is permitted.

It has 2 outline topics, and two pages cover them.

How the topics fit together

Zones say where traffic comes from and goes to, the security policy decides whether the first packet may pass, and the session table lets the rest of the flow through quickly. The application scenarios then show the same mechanism at the internet edge, in front of servers and inside the intranet.

Learn the default zones and the first packet process first. Almost every later firewall chapter, from NAT to hot standby, builds on the session table.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with tables and examples.
• What to remember for the exam: the facts to memorize.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read each configuration snippet and say what it does before reading the explanation. The exam often shows a short policy and asks which traffic is permitted or which zone pair it controls.