Purpose
This guide explains how to configure the Huawei Firewall Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, block an IP address on a Huawei firewall. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
Known issue: the unblock action does not currently work. Source-code review found that the manifest declares the release/unblock method under the name unblock-ip (hyphenated), but Logsign's implementation registers the corresponding function under the key unblock_ip (underscored). Because these two names do not match, invoking the unblock method as declared in the manifest does not resolve to working code. Until this is fixed by Logsign engineering, treat blocking as effectively one-way through this integration: plan to remove blocks manually on the Huawei firewall itself (or via a scheduled/expiring block, if your firewall supports one) rather than relying on Logsign's unblock action.
Prerequisites
- A Huawei firewall (USG/other Huawei firewall platform) with its management API reachable from the Logsign server.
- An administrator account with permission to modify security policy / blacklist objects.
- Use least privilege. Create a dedicated account for this integration scoped to security-policy management, rather than a full system administrator account, if your Huawei firewall platform supports role-restricted accounts.
Step 1: Prepare the Huawei Firewall for API Access
- Log in to the Huawei firewall management interface with an administrator account.
- Create (or designate) a dedicated user account for Logsign to use, with permission to manage the security policy/blacklist object this integration will use.
- Note the firewall's management hostname/IP, the port used for API access, and the username/password for the account.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Huawei Firewall, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Huawei Firewall device in Logsign. |
| Host | Yes | Hostname or IP address of the firewall. |
| Port | Yes | Management API port. |
| User Name | Yes | The firewall account username from Step 1. |
| Password | Yes | Password for that account. Stored encrypted at rest. |
| Insecure Skip Verify | No | Disables TLS certificate validation on Logsign's outbound calls to the firewall when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- block_ip (Containment) — adds a security-policy/blacklist block for the given IP.
- unblock-ip (Recovery) — currently non-functional; see the Known Issue above. The method is declared but does not resolve to working code due to a naming mismatch between the manifest and the implementation.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong User Name/Password. | Re-enter the User Name and Password fields and confirm the account can log in to the firewall directly. |
| 403 Forbidden | The account does not have permission to modify security policy/blacklist objects. | Confirm the account's role on the firewall includes security-policy management. |
| Unblock action fails or does nothing | This is the known unblock-ip/unblock_ip naming mismatch described above, not a credential or permission problem. | Do not spend time troubleshooting credentials for this specific symptom; remove the block manually on the firewall instead, and raise the naming mismatch with Logsign engineering. |
Notes and Limits
- The unblock-ip/unblock_ip naming mismatch is a defect in the current code, not something that can be corrected from the documentation side; this article will be updated once Logsign engineering ships a fix.
- The exact firewall console navigation path for creating a scoped API account was not independently verified against a live Huawei firewall during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.