Huawei Firewall Default Security Zone Restrictions

Default Zone Immutability in Huawei Firewalls

Huawei USG series firewalls enforce a strict security model where the default security zones are fundamental to the device's architecture. These default zones include Local, Trust, Untrust, DMZ, and others depending on the specific model and firmware version. The design philosophy behind these zones is to provide out-of-the-box security boundaries that cannot be removed or fundamentally altered by the administrator.

Priority Assignment Rules

Each security zone has an associated priority value ranging from 1 to 100. Higher priority values indicate higher trust levels. For example, the Local zone typically has the highest priority (100), followed by Trust, then DMZ, and finally Untrust (1). While administrators can manually configure priorities for user-defined custom zones, the default security zones have fixed, non-changeable priority values. This immutability ensures that critical system interfaces and standard network segments maintain consistent security postures regardless of configuration changes.

Deletion Constraints

Furthermore, the default security zones cannot be deleted. This restriction prevents accidental loss of essential security boundaries which could compromise the firewall's ability to process traffic correctly. Only user-created zones can be deleted after they are no longer needed.

The statement claims that while default zones cannot be deleted, their priorities can be manually changed. Since both deletion and priority modification are prohibited for default zones, the statement is factually incorrect.