Huawei firewall configuration examples

Single egress with static routes

In a single-egress scenario that uses a single public IP address, you can bind the single egress of the Huawei firewall to two tunnel interfaces and configure a different IPsec policy for each interface. This allows the firewall to connect to the active and standby tunnels on Alibaba Cloud. The route injection feature of the IPsec policy automatically generates routes that point to the tunnels and switches traffic based on the IPsec tunnel negotiation status.

Step 1: Configure the network interfaces

Configure IP addresses and security domains for the public and private interfaces of the Huawei firewall, and configure routes.

#Public interface
interface GigabitEthernet1/0/0
 ip addr 10.32.0.174 24
 service-manage ping permit
 quit

#Private interface
interface GigabitEthernet1/0/2
 ip addr 10.34.0.9 24
 service-manage ping permit
 quit

#Add the public and private interfaces to security domains
firewall zone untrust
 add interface GigabitEthernet 1/0/0
 quit
firewall zone trust
 add interface GigabitEthernet 1/0/2
 quit

#Configure 32-bit routes that point to the public IP addresses of the peer VPN gateway
ip route-static 3.3.XX.XX 32 10.32.0.174
ip route-static 4.4.XX.XX 32 10.32.0.174
#Configure a route that points from the on-premises CIDR block to the private network
ip route-static 10.0.0.0 8 10.34.0.253

Step 2: Configure the tunnels

Create two tunnel interfaces to connect to the active and standby tunnels on the cloud.

#Configure tunnel interfaces and apply the IPsec security framework to the tunnel interfaces
interface tunnel 1
 tunnel-protocol ipsec
 ip address unnumbered interface GigabitEthernet1/0/0
 service-manage ping permit
 quit
interface tunnel 2
 tunnel-protocol ipsec
 ip address unnumbered interface GigabitEthernet1/0/0
 service-manage ping permit
 quit

#Add the tunnel interfaces to a security domain
firewall zone untrust
 add interface Tunnel 1
 add interface Tunnel 2
 quit

Step 3: Configure IPsec proposals and policies

Configure IPsec and IKE. Make sure that the configurations are consistent with the configurations on the Alibaba Cloud side.

#Configure an IPsec proposal
ipsec proposal to-ali-prop
 encapsulation-mode tunnel
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
 quit

#Configure an IKE proposal
ike proposal 1
 dh group14
 authentication-method pre-share
 encryption-algorithm aes-256
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
 sa duration 86400
 quit

#Configure IKE peers. The two peers correspond to the two tunnels on Alibaba Cloud. The remote-address is the public IP address on Alibaba Cloud.
ike peer to-ali-peer1
 version 2
 ike-proposal 1
 remote-address 3.3.XX.XX
 pre-shared-key ChangeMe****
 remote-id-type none
 local-id 1.1.XX.XX
 dpd type periodic
 quit
ike peer to-ali-peer2
 version 2
 ike-proposal 1
 remote-address 4.4.XX.XX
 pre-shared-key ChangeMe****
 remote-id-type none
 local-id 1.1.XX.XX
 dpd type periodic
 quit

#Configure the traffic selector. In this example, an address set is used.
ip address-set to-ali-subnets type group
 address 0 192.168.0.0 mask 16
 quit
ip address-set local-subnets type group
 address 0 10.34.0.0 mask 16
 quit
acl number 3000
 rule 5 permit ip source address-set local-subnets destination address-set to-ali-subnets
 quit

#Configure an IPsec policy, reference the created ACL, IKE peer, and IPsec proposal, and set the priority for routes that are automatically generated by the route injection feature. In this example, you only need to set the priority of Tunnel1 higher than that of Tunnel2. The specific values depend on your network plan.
ipsec policy to-ali-policy1 1 isakmp
 security acl 3000
 pfs dh-group14
 ike-peer to-ali-peer1
 proposal to-ali-prop
 tunnel local applied-interface
 sa duration traffic-based 0
 sa duration time-based 86400
 route inject dynamic preference 100
 quit
ipsec policy to-ali-policy2 1 isakmp
 security acl 3000
 pfs dh-group14
 ike-peer to-ali-peer2
 proposal to-ali-prop
 tunnel local applied-interface
 sa duration traffic-based 0
 sa duration time-based 86400
 route inject dynamic preference 120
 quit

#Configure the tunnel interfaces and apply the IPsec policies to the tunnel interfaces
interface tunnel 1
 ip address unnumbered interface GigabitEthernet1/0/0
 tunnel-protocol ipsec
 service-manage ping permit
 ipsec policy to-ali-policy1
 quit
interface tunnel 2
 ip address unnumbered interface GigabitEthernet1/0/0
 tunnel-protocol ipsec
 service-manage ping permit
 ipsec policy to-ali-policy2
 quit

Step 4: Configure security policies

Configure security policies to allow IKE protocol traffic and IPsec data traffic.

#Configure an inter-domain security policy between the Local and Untrust domains to allow IKE negotiation messages
security-policy
rule name policy1
source-zone local
source-address 10.32.0.174 32
destination-zone untrust
destination-address 3.3.XX.XX 32
destination-address 4.4.XX.XX 32
action permit
quit
rule name policy2
source-zone untrust
source-address 3.3.XX.XX 32
source-address 4.4.XX.XX 32
destination-zone local
destination-address 10.32.0.174 32
action permit
quit
quit

#Configure an inter-domain security policy between the Trust and Untrust domains to allow data datagrams
security-policy
rule name policy3
source-zone trust
source-address 10.0.0.0 8
destination-zone untrust
destination-address 192.168.0.0 16
action permit
quit
rule name policy4
source-zone untrust
source-address 192.168.0.0 16
destination-zone trust
destination-address 10.0.0.0 8
action permit
quit
quit

Step 5: Verify the results

After you configure a route from the on-premises server to the Huawei firewall, you can test the network connectivity between the on-premises data center and the Alibaba Cloud VPC and verify the active/standby switchover.

1. Test the connectivity between the data center and the VPC. To do this, log on to an ECS instance in the VPC and run the ping <private IP address of a server in the data center> command. If you receive a reply message from the server in the data center, the connection is established.

2. Test the high availability of the IPsec-VPN connection.

   1. Log on to an ECS instance in the VPC. Run the ping <private IP address of a server in the data center> -c 10000 command to continuously send ping requests to the data center.

   2. Disconnect the active tunnel of the IPsec-VPN connection. You can do this by modifying the pre-shared key of the active tunnel. The tunnel disconnects because the pre-shared keys at the two ends of the tunnel no longer match.

   3. After the active tunnel is disconnected, check the communication status of the ECS instance in the VPC. If traffic is briefly interrupted and then resumes, this indicates that traffic is automatically switched to the standby tunnel.

      

Single egress with BGP routes

In this example, the following configurations are added to the configurations in the "Single egress with static routes" scenario.

Step 1: Configure BGP

After you complete Step 1 to Step 4 in the "Single egress with static routes" scenario, perform the following configurations.

#Disable route injection 
ipsec policy to-ali-policy1 1 isakmp
 undo route inject
 sa trigger-mode auto
quit

ipsec policy to-ali-policy2 1 isakmp
 undo route inject
 sa trigger-mode auto
quit

#Set the source and destination of the traffic selector to any
acl number 3000
 undo rule 5
 rule 10 permit ip 
 quit

#Change the IP addresses of the tunnel interfaces to 169.254.X.X addresses. The IP addresses must be in the same CIDR block as the BGP IP addresses on Alibaba Cloud.
interface Tunnel1
 ip address 169.254.10.2 30
 quit
interface Tunnel2
 ip address 169.254.20.2 30
 quit

#Change the tunnel local address of the IPsec policy to the public interface address
ipsec policy to-ali-policy1 1 isakmp
 tunnel local 10.32.0.174
 quit
ipsec policy to-ali-policy2 1 isakmp
 tunnel local 10.32.0.174
 quit

#Configure the local and peer BGP settings
bgp 45001                                 
 router-id 169.254.10.2
 peer 169.254.10.1 as-number 45104
 peer 169.254.20.1 as-number 45104
 ipv4-family unicast
  undo synchronization
  network 10.34.0.0 255.255.255.0
  peer 169.254.10.1 enable
  peer 169.254.20.1 enable

#Add a security policy
security-policy
 rule name policy1
  source-address 169.254.0.0 16
 quit
 rule name policy2
  destination-address 169.254.0.0 16
 quit
quit

Step 2: Verify the results

You can test the network connectivity between the on-premises data center and the Alibaba Cloud VPC and verify the active/standby switchover.

1. Test the connectivity between the data center and the VPC. To do this, log on to an ECS instance in the VPC and run the ping <private IP address of a server in the data center> command. If you receive a reply message from the server in the data center, the connection is established.

2. Test the high availability of the IPsec-VPN connection.

   1. Log on to an ECS instance in the VPC. Run the ping <private IP address of a server in the data center> -c 10000 command to continuously send ping requests to the data center.

   2. Disconnect the active tunnel of the IPsec-VPN connection. You can do this by modifying the pre-shared key of the active tunnel. The tunnel disconnects because the pre-shared keys at the two ends of the tunnel no longer match.

   3. After the active tunnel is disconnected, check the communication status of the ECS instance in the VPC. If traffic is briefly interrupted and then resumes, this indicates that traffic is automatically switched to the standby tunnel.

      

Dual egress with static routes

In a dual-egress scenario that uses two public IP addresses, you can bind the two egresses of the Huawei firewall to two tunnel interfaces and configure a different IPsec policy for each interface. This allows the firewall to connect to the active and standby tunnels on Alibaba Cloud. The route injection feature of the IPsec policy automatically generates routes that point to the tunnels and switches traffic based on the IPsec tunnel negotiation status.

Step 1: Configure the network interfaces

Configure IP addresses and security domains for the public and private interfaces, and configure routes.

#Public interface 1
interface GigabitEthernet1/0/0
 ip addr 10.32.0.174 24
 service-manage ping permit
 quit

#Public interface 2
interface GigabitEthernet1/0/1
 ip addr 10.33.0.237 24
 service-manage ping permit
 quit

#Private interface
interface GigabitEthernet1/0/2
 ip addr 10.34.0.9 24
 service-manage ping permit
 quit

#Add the public and private interfaces to security domains
firewall zone untrust
 add interface GigabitEthernet 1/0/0
 add interface GigabitEthernet 1/0/1
 quit
firewall zone trust
 add interface GigabitEthernet 1/0/2
 quit

#Configure 32-bit routes that point to the public IP addresses of the peer VPN gateway
ip route-static 3.3.XX.XX 32 10.32.0.174
ip route-static 4.4.XX.XX 32 10.33.0.237
#Configure a route that points from the on-premises CIDR block to the private network
ip route-static 10.0.0.0 8 10.34.0.253

Step 2: Configure the tunnels

Create two tunnel interfaces to connect to the active and standby tunnels on the cloud.

#Configure tunnel interfaces and apply the IPsec security framework to the tunnel interfaces
interface tunnel 1
 tunnel-protocol ipsec
 ip address unnumbered interface GigabitEthernet1/0/0
 service-manage ping permit
 quit
interface tunnel 2
 tunnel-protocol ipsec
 ip address unnumbered interface GigabitEthernet1/0/1
 service-manage ping permit
 quit

#Add the tunnel interfaces to a security domain
firewall zone untrust
 add interface Tunnel 1
 add interface Tunnel 2
 quit

Step 3: Configure IPsec proposals and policies

Configure IPsec and IKE. Make sure that the configurations are consistent with the configurations on the Alibaba Cloud side.

#Configure an IPsec proposal
ipsec proposal to-ali-prop
 encapsulation-mode tunnel
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
 quit

#Configure an IKE proposal
ike proposal 1
 dh group14
 authentication-method pre-share
 encryption-algorithm aes-256
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
 sa duration 86400
 quit

#Configure IKE peers. The two peers correspond to the two tunnels on Alibaba Cloud. The remote-address is the public IP address on Alibaba Cloud.
ike peer to-ali-peer1
 version 2
 ike-proposal 1
 remote-address 3.3.XX.XX
 pre-shared-key ChangeMe****
 remote-id-type none
 local-id 1.1.XX.XX
 dpd type periodic
 quit
ike peer to-ali-peer2
 version 2
 ike-proposal 1
 remote-address 4.4.XX.XX
 pre-shared-key ChangeMe****
 remote-id-type none
 local-id 2.2.XX.XX
 dpd type periodic
 quit

#Configure the traffic selector. In this example, an address set is used.
ip address-set to-ali-subnets type group
 address 0 192.168.0.0 mask 16
 quit
ip address-set local-subnets type group
 address 0 10.34.0.0 mask 16
 quit
acl number 3000
 rule 5 permit ip source address-set local-subnets destination address-set to-ali-subnets
 quit

#Configure an IPsec policy, reference the created ACL, IKE peer, and IPsec proposal, and set the priority for routes that are automatically generated by the route injection feature. In this example, you only need to set the priority of Tunnel1 higher than that of Tunnel2. The specific values depend on your network plan.
ipsec policy to-ali-policy1 1 isakmp
 security acl 3000
 pfs dh-group14
 ike-peer to-ali-peer1
 proposal to-ali-prop
 tunnel local applied-interface
 sa duration traffic-based 0
 sa duration time-based 86400
 route inject dynamic preference 100
 quit
ipsec policy to-ali-policy2 1 isakmp
 security acl 3000
 pfs dh-group14
 ike-peer to-ali-peer2
 proposal to-ali-prop
 tunnel local applied-interface
 sa duration traffic-based 0
 sa duration time-based 86400
 route inject dynamic preference 120
 quit

#Configure the tunnel interfaces and apply the IPsec policies to the tunnel interfaces
interface tunnel 1
 ip address unnumbered interface GigabitEthernet1/0/0
 tunnel-protocol ipsec
 service-manage ping permit
 ipsec policy to-ali-policy1
 quit
interface tunnel 2
 ip address unnumbered interface GigabitEthernet1/0/1
 tunnel-protocol ipsec
 service-manage ping permit
 ipsec policy to-ali-policy2
 quit

Step 4: Configure security policies

Configure security policies to allow IKE protocol traffic and IPsec data traffic.

#Configure an inter-domain security policy between the Local and Untrust domains to allow IKE negotiation messages
security-policy
rule name policy1
source-zone local
source-address 10.32.0.174 32
source-address 10.33.0.237 32
destination-zone untrust
destination-address 3.3.XX.XX 32
destination-address 4.4.XX.XX 32
action permit
quit
rule name policy2
source-zone untrust
source-address 3.3.XX.XX 32
source-address 4.4.XX.XX 32
destination-zone local
destination-address 10.32.0.174 32
destination-address 10.33.0.237 32
action permit
quit
quit

#Configure an inter-domain security policy between the Trust and Untrust domains to allow data datagrams
security-policy
rule name policy3
source-zone trust
source-address 10.0.0.0 8
destination-zone untrust
destination-address 192.168.0.0 16
action permit
quit
rule name policy4
source-zone untrust
source-address 192.168.0.0 16
destination-zone trust
destination-address 10.0.0.0 8
action permit
quit
quit

Step 5: Verify the results

After you configure a route from the on-premises client to the Huawei firewall, you can test the network connectivity between the on-premises data center and the Alibaba Cloud VPC and verify the active/standby switchover.

1. Test the connectivity between the data center and the VPC. To do this, log on to an ECS instance in the VPC and run the ping <private IP address of a server in the data center> command. If you receive a reply message from the server in the data center, the connection is established.

2. Test the high availability of the IPsec-VPN connection.

   1. Log on to an ECS instance in the VPC. Run the ping <private IP address of a server in the data center> -c 10000 command to continuously send ping requests to the data center.

   2. Disconnect the active tunnel of the IPsec-VPN connection. You can do this by modifying the pre-shared key of the active tunnel. The tunnel disconnects because the pre-shared keys at the two ends of the tunnel no longer match.

   3. After the active tunnel is disconnected, check the communication status of the ECS instance in the VPC. If traffic is briefly interrupted and then resumes, this indicates that traffic is automatically switched to the standby tunnel.

      

Dual egress with BGP routes

In this example, the following configurations are added to the configurations in the "Dual egress with static routes" scenario.

Step 1: Configure BGP

After you complete Step 1 to Step 4 in the "Dual egress with static routes" scenario, perform the following configurations.

#Disable route injection 
ipsec policy to-ali-policy1 1 isakmp
 undo route inject
 sa trigger-mode auto
quit

ipsec policy to-ali-policy2 1 isakmp
 undo route inject
 sa trigger-mode auto
quit

#Set the source and destination of the traffic selector to any
acl number 3000
 undo rule 5
 rule 10 permit ip 
 quit

#Change the IP addresses of the tunnel interfaces to 169.254.X.X addresses. The IP addresses must be in the same CIDR block as the BGP IP addresses on Alibaba Cloud.
interface Tunnel1
 ip address 169.254.10.2 30
 quit
interface Tunnel2
 ip address 169.254.20.2 30
 quit

#Change the tunnel local address of the IPsec policy to the public interface address
ipsec policy to-ali-policy1 1 isakmp
 tunnel local 10.32.0.174
 quit
ipsec policy to-ali-policy2 1 isakmp
 tunnel local 10.33.0.237
 quit

#Configure the local and peer BGP settings
bgp 45001                                 
 router-id 169.254.10.2
 peer 169.254.10.1 as-number 45104
 peer 169.254.20.1 as-number 45104
 ipv4-family unicast
  undo synchronization
  network 10.34.0.0 255.255.255.0
  peer 169.254.10.1 enable
  peer 169.254.20.1 enable

#Add a security policy
security-policy
 rule name policy1
  source-address 169.254.0.0 16
 quit
 rule name policy2
  destination-address 169.254.0.0 16
 quit
quit

Step 2: Verify the results

You can test the network connectivity between the on-premises data center and the Alibaba Cloud VPC and verify the active/standby switchover.

1. Test the connectivity between the data center and the VPC. To do this, log on to an ECS instance in the VPC and run the ping <private IP address of a server in the data center> command. If you receive a reply message from the server in the data center, the connection is established.

2. Test the high availability of the IPsec-VPN connection.

   1. Log on to an ECS instance in the VPC. Run the ping <private IP address of a server in the data center> -c 10000 command to continuously send ping requests to the data center.

   2. Disconnect the active tunnel of the IPsec-VPN connection. You can do this by modifying the pre-shared key of the active tunnel. The tunnel disconnects because the pre-shared keys at the two ends of the tunnel no longer match.

   3. After the active tunnel is disconnected, check the communication status of the ECS instance in the VPC. If traffic is briefly interrupted and then resumes, this indicates that traffic is automatically switched to the standby tunnel.