Firewall User Management Technologies · Topic 2 of 2
Firewall User Authentication and Application
Learn USG firewall user types, Portal, SSO and exemption authentication, authentication policies, user groups and user based security policies for H12-711.
- 5 min
- The firewall has three user types: administrators, internet access users and access users.
- Administrators log in through console, Telnet, SSH or HTTPS web; the default account is
adminand must change its password at first login. - Internet access users are identified by Portal authentication, SSO, authentication exemption, or not at all.
What it is
Firewall user authentication ties network traffic to a person instead of only an IP address. Once the firewall knows that 192.168.1.20 is Alice in the sales group, its security policies, bandwidth rules and logs can work by user and group.
A USG firewall handles three kinds of users, and each kind is authenticated in its own way.
How it works
The three types of firewall users
| User type | Who they are | How they connect |
|---|---|---|
| Administrators | People who manage the firewall | Console, Telnet, SSH or the web interface over HTTPS |
| Internet access users | Users on the internal network reaching the internet or other resources through the firewall | Traffic passing the firewall, identified by authentication |
| Access users | Remote users reaching the internal network from outside | VPN access, such as SSL VPN, L2TP or IPsec |
Administrators
An administrator account sets the login methods, the authentication mode and the privilege or role. On a new USG firewall of most models, the default administrator is admin with the password Admin@123, and the firewall forces a password change at first login.
On those models the management interface GigabitEthernet0/0/0 has the default address 192.168.0.1, and the web interface is reached at https://192.168.0.1:8443. Telnet sends everything in clear text, so SSH and HTTPS are preferred.
The user organization
Users are organized in a tree. Each authentication domain, starting with the default domain, has a root group, and user groups below it can follow the company's departments.
| Way to create users | When it is used |
|---|---|
| Create them locally on the firewall | Small numbers of users |
| Import them from a CSV file | Bulk creation from a list |
| Import them from an AD or LDAP server | When accounts already exist in a directory |
A security policy can then match a user or a whole group, so a policy for the sales group covers every member.
Authentication methods for internet access users
| Method | How the user is identified | User experience |
|---|---|---|
| Authentication exemption | The firewall maps a bound IP or MAC address to a user | No login needed |
| Portal authentication | The firewall redirects the first HTTP request to an authentication page | User enters a name and password in a browser |
| Single sign-on (SSO) | The firewall learns the user from another system, such as AD, RADIUS or Agile Controller | User logs in once, for example to the Windows domain |
| No authentication | The traffic is not tied to a user | Policies match only addresses |
With Portal authentication, the user opens any web page, the firewall redirects the browser to its portal page, and the credentials are checked locally or on a server. With SSO, the user is not asked again, because the firewall learns the IP and user name mapping when the user logs in to the domain.
Authentication policies
An authentication policy decides which traffic must be authenticated and how. Like a security policy, its rules match source zone, destination zone, and source and destination addresses, and are checked from top to bottom.
| Authentication policy action | Effect |
|---|---|
| Portal authentication | Users matching the rule must authenticate through the portal |
| Authentication exemption | Users are identified without logging in, for example from bound IP or MAC addresses |
| No authentication | Traffic is not authenticated |
The default rule at the bottom does not authenticate. Authentication policies do not permit traffic; the security policy still decides whether authenticated traffic may pass.
A worked example
The sales group at 192.168.10.0/24 may use web browsing only during working hours, and guests must be identified. The engineer imports the staff accounts from AD and enables AD SSO, so staff are recognized when they log in to Windows.
An authentication policy requires Portal authentication for the guest subnet, and the security policy permits web traffic for the sales group and the guest group. Logs now show user names, not just addresses.
How the exam asks about this
- "Which firewall user type connects to the intranet through SSL VPN?" -> Access users.
- "Which authentication method lets users authenticate once to an AD domain and then access the internet without a second login?" -> SSO.
- "Which method redirects the user's first HTTP request to a login page?" -> Portal authentication.
What to remember for the exam
- The firewall has three user types: administrators, internet access users and access users.
- Administrators log in through console, Telnet, SSH or HTTPS web; the default account is
adminand must change its password at first login. - Internet access users are identified by Portal authentication, SSO, authentication exemption, or not at all.
- An authentication policy decides who must authenticate; its default rule performs no authentication.
- After authentication, security policies can match users and user groups instead of only IP addresses.
An authentication policy and a security policy do different jobs. Passing authentication does not permit traffic, and a security policy that matches a user only works after the firewall knows which user owns the IP address.
Common mistakes
Calling remote VPN users internet access users. Users who come in from outside through SSL VPN, L2TP or IPsec are access users.
Thinking SSO needs no server. The firewall still learns the user from an authentication system such as AD or RADIUS; the user just does not log in twice.
Using Telnet for administration on an untrusted network. Telnet sends passwords in clear text; SSH and HTTPS encrypt the session.
Check yourself
What makes an access user different from an internet access user?
An access user connects from outside to the internal network through a VPN, while an internet access user is on the internal network going out.
What does the default rule of an authentication policy do?
It performs no authentication, so traffic that matches no other rule is not tied to a user.
Why does Portal authentication start with an HTTP request?
The firewall redirects the user's first web request to its authentication page, where the user enters a name and password.
Topic 2 of 2 in Firewall User Management Technologies
Test yourself on Firewall User Management Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.