Este artículo cubre control de acceso, conifguración de firewall (incluyendo políticas entre zonas), autenticación y autorización, y técnicas de cifrado.

1. Listas de Control de Acceso (ACL)

Las ACL permiten filtrar el tráfico de red, decidiendo qué paquetes se permiten o deniegan.

# Crear una ACL básica o extendida (según el número)
[Huawei] acl number 3000
[Huawei-acl-basic-3000] rule deny ip source 10.0.0.0 0.0.255.255
[Huawei-acl-basic-3000] rule permit ip source 192.168.2.0 0.0.0.255
[Huawei-acl-basic-3000] quit

# Aplicar la ACL a una interfaz
[Huawei] interface GigabitEthernet0/0/2
[Huawei-GigabitEthernet0/0/2] traffic-filter outbound acl 3000
[Huawei-GigabitEthernet0/0/2] quit

2. Configuración de firewall

Los equipos Huawie sopotran firewall con estado, permitiendo definir políticas para permitir o denegar tráfico específico.

# Definir zonas de seguridad
[Huawei] firewall zone internal
[Huawei-zone-internal] add interface GigabitEthernet0/0/1
[Huawei-zone-internal] quit

[Huawei] firewall zone external
[Huawei-zone-external] add interface GigabitEthernet0/0/2
[Huawei-zone-external] quit

# Configurar política de seguridad
[Huawei] security-policy
[Huawei-policy-security] rule name allow_in_to_out
[Huawei-policy-security-rule-allow_in_to_out] source-zone internal
[Huawei-policy-security-rule-allow_in_to_out] destination-zone external
[Huawei-policy-security-rule-allow_in_to_out] source-address 192.168.10.0 24
[Huawei-policy-security-rule-allow_in_to_out] action permit
[Huawei-policy-security-rule-allow_in_to_out] quit

3. Autenticación y autorización

Se pueden configurar métodos locales, RADIUS, etc.

# Crear usuario local
[Huawei] aaa
[Huawei-aaa] local-user operator password irreversible-cipher $c$5$ClaveSegura2024
[Huawei-aaa] local-user operator privilege level 10
[Huawei-aaa] local-user operator service-type telnet ssh
[Huawei-aaa] quit

# Habilitar autenticación AAA para VTY
[Huawei] user-interface vty 0 4
[Huawei-ui-vty0-4] authentication-mode aaa
[Huawei-ui-vty0-4] protocol inbound ssh
[Huawei-ui-vty0-4] quit

4. VPN IPSec

IPSec establece túneles cifrados entre redes remotas.

# Crear propuesta IKE
[Huawei] ike proposal 2
[Huawei-ike-proposal-2] encryption-algorithm aes-128
[Huawei-ike-proposal-2] authentication-algorithm sha1
[Huawei-ike-proposal-2] dh group5
[Huawei-ike-proposal-2] quit

# Configurar peer IKE
[Huawei] ike peer site_b
[Huawei-ike-peer-site_b] exchange-mode aggressive
[Huawei-ike-peer-site_b] pre-shared-key cipher %^%#Abc123Xyz%^%#
[Huawei-ike-peer-site_b] ike-proposal 2
[Huawei-ike-peer-site_b] remote-address ipv4 2.2.2.2
[Huawei-ike-peer-site_b] quit

# Definir política IPSec
[Huawei] ipsec policy tunel_sitio_b 20
[Huawei-ipsec-policy-tunel_sitio_b-20] security acl 3100
[Huawei-ipsec-policy-tunel_sitio_b-20] ike-peer site_b
[Huawei-ipsec-policy-tunel_sitio_b-20] proposal 2
[Huawei-ipsec-policy-tunel_sitio_b-20] quit

# Aplicar política a la interfaz de salida
[Huawei] interface GigabitEthernet0/0/1
[Huawei-GigabitEthernet0/0/1] ipsec policy tunel_sitio_b
[Huawei-GigabitEthernet0/0/1] quit