01 Apr
2015
https--->webUI--->Huawei Secospace USG6300
Posted in Security
As a graphical user interface is useless in case of routers and switches, it looks useful when con guring a rewall. Of course it is my point of view. I do not
go into what is better for you. I like using CLI but, sometimes, it is worth to simplify your daily routine. The rst step is to con gure HTTPS access to
webUI of USG6300. This is what we will focus today.
Well known topology from the last post:
Configure IP address of firewall's interface and add it to trust zone:
[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]ip address 172.16.1.1 24
[USG6300]firewall zone trust
[USG6300-zone-trust]add interface GigabitEthernet 0/0/7
Enable HTTPS server on that interface:
[USG6300]interface GigabitEthernet 0/0/7
[USG6300-GigabitEthernet0/0/7]service-manage https permit
Create two administrator's accounts:
#
manager-user web_lab
password cipher %@%@`ruiCXfgEFCJGnNu0!<@&bYP@.eMJIk7-H&m&h&[xo11Oh_Z%@%@
service-type web
level 15
ftp-directory hda1:
ssh authentication-type password
ssh service-type stelnet
#
manager-user web_lab_2
password cipher %@%@S0e84!g|rRX38&1S*-l;h*!ub`{@$-`o0=71fW<8Ch{9g0'"%@%@
service-type web
level 15
ftp-directory hda1:
ssh authentication-type password
ssh service-type stelnet
#
Why two accounts? Because we will assign different roles for these 2 administrators to show you such possibility. We will use the default system-admin
role for one administrator and a new created web-admin role for the second one.
converted by Web2PDFConvert.com
#
role system-admin
description system-admin
dashboard read-write
monitor read-write
policy read-write
object read-write
network read-write
system read-write
#
role web_lab
dashboard none
monitor
read-only session statistic statistic-acl
none packet-capture diagnose
policy none
object none
network none
system none
#
Then we can bind our administrators to properly defined roles:
[USG6300-aaa]bind manager-user web_lab role system-admin
[USG6300-aaa]bind manager-user web_lab_2 role web_lab
Enable HTTPS server with default certificate and set the service port:
[USG6300]web-manager enable
Enable http server successfully !
[USG6300]web-manager security enable port 8443
Enable http security-server successfully ! web-manager
Let's verify what will happen if we use both accounts to get to GUI of the firewall .
Open a browser and enter https://172.16.1.1:8443.
converted by Web2PDFConvert.com
As you can notice, the access varies depending on the assigned role for administrators.
Tags: Huawei firewall, Secospace USG6300, HTTPS, GUI of USG6300
converted by Web2PDFConvert.com
COMMENTS
Sort by Oldest First
Sort by Latest First
No comments found
LEAVE YOUR COMMENTS
Login to post a comment
Username
Password
Remember me
Register
Login
Forgot password
Post comment as a guest
Name (Required):
Email:
Website:
Your comments are subjected to administrator's moderation.
Agree to terms and condition.
Submit Comment
Powered by Komento
Categories
Basic Con guration
Cheat Sheets
converted by Web2PDFConvert.com
Command Line
Ethernet
FAQ
General
How To
IP Routing
IP Services
Multicast
QoS
Reliability
Security
System Management
VPN
WAN
Latest Posts
NAT server on Huawei USG5500
outbound NAT on Huawei USG5500
https--->webUI--->Huawei Secospace USG6300
VTY access to Secospace USG6300
CPU usage alarm threshold
Built with HTML5 and CSS3
- Copyright 2014 Labnario
Powered by Warp Theme Framework
converted by Web2PDFConvert.com
