Monitoring Huawei Devices

Overview

Add Huawei Router and Firewall devices to TOS using the Open Policy Model (OPM). OPM expands device coverage in TOS to additional vendors. Tufin provides device connectors that collect the device's configuration and policy data and import it into SecureTrack.

The Huawei device connectors support onboarding Huawei routers and firewalls. SecureTrack connects to these devices over SSH and pulls topology and rule data based on the sync schedule set in Tufin-Integrations.

For supported features, see Features by Vendor in SecureTrack and Features by Vendor in SecureChange.

Prerequisites

SSH access to all devices

Customer Portal access to download the OPM package
Admin credentials for SecureTrack and SecureChange to be defined through Tufin Integrations before configuring device sync
TOS server:
- sudo permissions to run the installer
- File upload permissions to /opt/misc
On systems with non-Tufin OS, python3 and bzip2 packages installed

Required commands and permissions

Make sure the SSH user account used for monitoring can run the following commands. These commands support SecureTrack features like configuration revision, topology collection, application visibility, and VPN awareness.

Command Type	Huawei Commands
Basic Setup and System Info	`system-view` `screen-length 0` `display version` `display current-configuration all`
Interface Details	`display ip interface brief` `display ipv6 interface` `display ip vpn-instance` `display ip vpn-instance verbose` `display ip vpn-instance {vrf_name} interface`
Routing Tables	`display ip routing-table verbose` `display ipv6 routing-table` `display ip routing-table vpn-instance {vrf_name} verbose` `display ipv6 routing-table vpn-instance {vrf_name} verbose`
Redundancy and High Availability	`display vrrp brief` `display vrrp`
Dynamic Routing and MPLS	`display bgp vpnv4 all routing-table label` `display bgp vpnv4 all routing-table` `display bgp vpnv4 all peer` `display bgp vpnv4 all routing-table peer {peer} advertised-routes` `display mpls lsp`
Overlay Networks	`display vxlan tunnel` `display vxlan vni`
Firewall Services (Firewall only)	`display predefined-service` `display application pre-defined` `display application user-defined` `display application name {name}` `display application-group all`
IPsec and Virtual Systems (Firewall only)	`display ipsec sa` `switch vsys {vsys}` `display domain-set all` `display domain-set verbose {name}`

Some commands require context switching, such as entering VRF or virtual system mode. The SSH user must have permission to access these contexts.

Install the OPM package

Install the OPM package from the shell on the TOS server. The steps are identical for both new installations and upgrades.

If you have existing OPM packages, the OPM installer automatically detects and upgrades older versions.

Go to the Download center.
Select Huawei Firewall & Router.
Click Download to Computer.
Upload the downloaded file to /opt/misc (recommended) on the TOS server:
```
sh <package-name>
```
where:

<package-name> is the name of the package you downloaded in the format install-<vendor>-1.0.0.aur.run
Wait for the installation to complete. The installer installs PS Proxy and Tufin Integrations if they don't exist. If an older version is installed, the script upgrades it.

SecureTrack or SecureChange credentials are not required for and during installation.

After the installation, before you sync devices, make sure you define the credentials through Tufin Integrations.

Add a device

Add a Huawei firewall or router device to TOS.

To allow SecureTrack to retrieve configuration data and run all required commands, the SSH user must have admin (read) access to the device.

For Firewall devices, the user must also be able to switch between virtual systems.

In SecureTrack, go to Monitoring > Devices > Device Viewer.
Click Add Device, and then select Add OPM Device.
In the ADD OPM DEVICE define the device details:
- Vendor: The vendor with the device to add.
- OPM agent: The registered agent for the vendor. The agent is displayed only if it was installed successfully.
- Type: The supported device type, such as Router or Firewall.
- Display name: The name to display for this device in SecureTrack
- IP: The IP address of the device.
Click Next.The Configure Device properties form is displayed.
Configure the device properties:
- arguments: Leave blank unless instructed otherwise.
- enable_pass...: The password to switch to system-view mode, if required by the device.
- password*: The SSH password for the device.
- username*: The SSH username for the device.
To confirm settings and add the device, click Save.

Sync device with SecureTrack

Use Tufin Integrations to configure how SecureTrack syncs with your OPM-managed device. Tufin Integrations is the web interface for managing OPM devices. It is automatically installed when installing the OPM package if it does not exist.

Configuring SecureTrack to sync with your OPM-managed device includes:
Defining user credential for SecureTrack and SecureChange
Importing devices and assigning them to a cluster
Scheduling sync and reviewing run details

When configuration is complete, SecureTrack runs a script that connects to the device, retrieves configuration data (such as interfaces, routes, and rules), and imports the data. This process enables scheduled or manual data collection.

Step 1: Go to Tufin Integrations

Do one of the following:
- Go to https://<tos-vip>/apps/integrations.
- In SecureTrack , from the list of Tufin Extensions , select Tufin Integrations.

Step 2: Set user credentials for Tufin API

For API configuration, define the username and password to connect to SecureTrack and SecureChange. If the credentials are not defined, Tufin Integrations cannot retrieve the devices.

From the sidebar, select Settings > Tufin API Configuration.

OR

Go to https://<tos-vip>/apps/integrations/configuration/tufin-api.
Define the username and password credentials for SecureTrack and SecureChange.
Click Save.

Credentials are automatically validated.
Verify that Credentials Valid appears next to SecureTrack and SecureChange, indicating that the credentials are correct.
If Credentials Invalid appears, correct the credentials, save, and validate again.

Step 3: Select OPM vendor and import devices

Run discovery to import the devices for vendors.

Return to the Dashboard.
Below OPM Device Connectors, select the OPM client or vendor with the devices to monitor.
Click IMPORT DEVICES and then click RUN DISCOVERY.

The available devices are displayed.
Select the parent management device, or select a specific device.
Right-click and select Enable Devices.
Click Save.

The enabled devices are added to the vendor list.

Step 4: Activate device monitoring and configure monitoring options

Activate monitoring for devices, and assign them to the current cluster or to a different cluster. In multi-domain deployments, you can migrate devices to different SecureTrack domains.

You can assign devices to different TOS clusters for monitoring. For example, you can monitor one OPM device from the main cluster and another from a remote collector. Remote collectors are available only if they are configured in TOS.

Migrating the device to a new domain, automatically removes the device from reports, queries, audits and alerts configured in the previous domain.

Retains device permissions for administrators of the target domain, but removes device permissions from users.

For automated or manual sync to run, you must enable monitoring for the device.

Select one or more devices.
Right-click the device or devices and select Start to start monitoring them.
Optional. To move the selected devices to a new domain, right-click and select Move Device to New Domain.
Optional. To monitor the selected devices from a different cluster, right-click and select one of the following:
- Migrate to main: Monitor the device from the primary cluster.
- Migrate to <remote_collector>: Monitor the device from a remote collector, for example, RC4. Available only if a remote collector is configured in TOS. The actual name of the remote collector differs by environment.

Step 5: Set automated sync schedule and view run details

Schedule automated syncs or trigger a manual sync on demand when monitoring is enabled for the device. View per-device status, start/end time, and message after each agent run.

In the Configuration section, set the automated sync schedule:
1. Set Interval as hourly, daily, weekly, or monthly.
2. Choose the Time or Day of execution.
3. To enable the script, select Enabled.
4. Click Save.
To start collecting revisions immediately, click RUN.

If not triggered manually, the sync is triggered as scheduled.
Every script execution retrieves the configuration from all devices assigned to the vendor’s OPM agent.
Verify the results in the Run Details popup:

In the Device Connector Runs (last 10) table, in the Run Details column, click the blue information icon .

The popup shows the status, start and end time, and a message for each device in the run.

Below is an example of the device connector page for Huawei, with the device list, Configuration panel, and Device Connector Runs.

How do I get here?

SecureTrack > Monitoring > Devices > Device Viewer