Network Basics · Topic 2 of 2
Common Network Devices
Learn how hubs, switches, routers and firewalls forward traffic, plus IPS, anti-DDoS, WAF and other security devices, for the HCIA-Security H12-711 exam.
- 5 min
- Hub at layer 1, switch at layer 2 by MAC, router at layer 3 by IP, firewall from layer 3 up to the application.
- A switch learns source MACs, forwards known unicast, and floods unknown unicast and broadcast within the VLAN.
- A router chooses the longest prefix first, then the lowest preference: direct 0, OSPF 10, static 60.
What it is
A network is built from devices that work at different layers. Switches connect hosts inside a LAN using MAC addresses. Routers connect networks using IP addresses. Firewalls sit between networks of different trust and decide which traffic may pass.
Other security devices add specialized protection, such as intrusion prevention, DDoS scrubbing or web application protection. In a Huawei network these are typically S or CloudEngine switches, AR routers, and USG or HiSecEngine firewalls.
How it works
Devices by layer
| Device | Works at | Forwards by | Effect on domains |
|---|---|---|---|
| Hub | Layer 1 | Repeats bits out of every port | One collision domain, one broadcast domain |
| Switch | Layer 2 | Destination MAC and the MAC address table | Each port its own collision domain; one broadcast domain per VLAN |
| Router | Layer 3 | Destination IP and the routing table | Each interface its own broadcast domain |
| Firewall | Layer 3 to 7 | Routing or switching plus security policy and session table | Separates security zones |
How a switch forwards frames
A switch learns where hosts are from the source MAC of each frame and stores it with the incoming port in its MAC address table. Dynamic entries age out if not refreshed; the default aging time on Huawei switches is 300 seconds.
| Frame type | Switch action |
|---|---|
| Known unicast | Forward out of the port in the MAC table |
| Unknown unicast | Flood out of all ports in the VLAN except the incoming one |
| Broadcast | Flood out of all ports in the VLAN except the incoming one |
| Destination on the incoming port | Discard |
Because a switch trusts what it learns, MAC flooding can fill the table and make it flood everything, and ARP spoofing can redirect traffic. Port security and similar features limit this.
How a router forwards packets
A router looks up the destination IP address in its routing table and picks the longest matching prefix. If several sources offer the same prefix, the lower preference wins.
| Route source | Default preference on Huawei devices |
|---|---|
| Direct | 0 |
| OSPF | 10 |
| Static | 60 |
| RIP | 100 |
| OSPF ASE (external) | 150 |
| BGP | 255 |
The router rewrites the frame header for the next link and decrements the IP TTL; it does not change the IP addresses unless NAT is configured. A router stops broadcasts, so it separates broadcast domains.
What a firewall adds
A router asks "where does this packet go?". A firewall also asks "is this packet allowed?". It groups interfaces into security zones, checks traffic between zones against security policies, and tracks every permitted flow in a session table, so return traffic is allowed automatically.
A Huawei firewall can work in routing mode (its interfaces have IP addresses, like a router), transparent mode (it forwards at layer 2, like a switch, without changing the IP plan) or hybrid mode (both at once on different interfaces).
Other security devices
| Device | Main job |
|---|---|
| IDS | Detects attacks and alerts; usually connected off path, so it does not block |
| IPS | Inline; detects attacks with signatures and blocks them |
| Anti-DDoS | Detects and scrubs volumetric and flood attacks |
| WAF | Protects web applications from attacks such as SQL injection and cross-site scripting |
| Sandbox | Runs suspicious files in an isolated environment to find unknown malware |
| VPN gateway | Builds encrypted tunnels for branches and remote users |
| Log audit and bastion host | Records logs and controls and audits administrator access |
Modern next-generation firewalls (NGFW) combine several of these functions, such as IPS, antivirus and URL filtering, in one device.
A worked example
PC1 (192.168.1.10) sends to a web server on the internet. The access switch learns PC1's MAC on port 3 and forwards the frame to the gateway's MAC. The router finds no specific route and uses the default route 0.0.0.0/0 toward the firewall.
The firewall sees traffic from the trust zone to the untrust zone, matches a permit policy, creates a session and forwards it. The server's reply matches that session and returns without a new policy check.
How the exam asks about this
- "Which device separates broadcast domains?" → A router (and a layer 3 firewall interface).
- "A switch receives a frame whose destination MAC is not in its table. What does it do?" → It floods the frame in the VLAN, except on the incoming port.
- "Which device detects attacks but usually does not block them?" → An IDS.
What to remember for the exam
- Hub at layer 1, switch at layer 2 by MAC, router at layer 3 by IP, firewall from layer 3 up to the application.
- A switch learns source MACs, forwards known unicast, and floods unknown unicast and broadcast within the VLAN.
- A router chooses the longest prefix first, then the lowest preference: direct 0, OSPF 10, static 60.
- A firewall adds security zones, security policies and a session table to forwarding.
- IDS detects and alerts off path; IPS sits inline and blocks.
Preference is compared only between routes to the same prefix. A longer prefix always wins, even if its preference value is higher.
Common mistakes
Saying a switch learns destination MACs. It learns the source MAC of each received frame. The destination is only looked up.
Treating a firewall as just a router with ACLs. A stateful firewall keeps sessions, so replies are permitted by the session table rather than by a second rule.
Swapping IDS and IPS. The "P" means prevention: an IPS is inline and drops attack traffic. An IDS only reports.
Check yourself
Why does a switch flood a frame with an unknown destination MAC?
It has no entry telling it which port leads to that host, so it sends the frame to every port in the VLAN except the incoming one.
A router has a static route and an OSPF route for the same prefix with default settings. Which is used?
The OSPF route, because its preference of 10 is lower than the static route's 60.
In which firewall mode does the firewall forward at layer 2 without changing the IP plan?
Transparent mode. Routing mode works at layer 3, and hybrid mode uses both on different interfaces.
Topic 2 of 2 in Network Basics
Test yourself on Network Basics
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.