Device Integration: Huawei Switch

Table of Contents

• Overview
• Prerequisites
• Configuration Roadmap
• Configuration Steps
  • Step 1: Configure Switch Interfaces
  • Step 2: Configure sFlow Agent and Collector
  • Step 3: Configure Flow Sampling
  • Step 4: Configure Counter Sampling
• Verification (MSSP Only)
  • On Huawei Switch
  • On ADR CCE
  • On ADR UI

Overview

This guide provides step-by-step instructions to configure Huawei switches with sFlow to forward flow data to ADR SIEM (aiSIEM/aiXDR). The sFlow data is collected by the CCE (Collection and Control Engine) and forwarded to the APE (Analytics and Policy Engine) for real-time visibility, anomaly detection, and threat monitoring.

Prerequisites

• SSH access to Huawei switch in system-view mode.
• Privileged credentials for configuration.
• IP address of ADR CCE server.
• UDP port 6343 open between switch and CCE.
• Correct date/time and VLANs/IP segments configured on switch.

Configuration Roadmap

1. Configure IP addresses for switch interfaces.

2. Configure the sFlow agent and collector (CCE IP).

3. Configure flow sampling on interfaces.

4. Configure counter sampling on interfaces.

Configuration Steps

Step 1: Configure Switch Interfaces

Example with VLANs 10, 20, and 30:

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 10 20 30

[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type access
[SwitchA-GigabitEthernet0/0/1] port default vlan 10
[SwitchA-GigabitEthernet0/0/1] quit

[SwitchA] interface vlanif 10
[SwitchA-Vlanif10] ip address 10.1.10.1 255.255.255.0
[SwitchA-Vlanif10] quit

[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] port link-type hybrid
[SwitchA-GigabitEthernet0/0/2] port hybrid pvid vlan 20
[SwitchA-GigabitEthernet0/0/2] port hybrid untagged vlan 20
[SwitchA-GigabitEthernet0/0/2] quit

[SwitchA] interface vlanif 20
[SwitchA-Vlanif20] ip address 10.1.20.1 255.255.255.0
[SwitchA-Vlanif20] quit

[SwitchA] interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/3] port link-type hybrid
[SwitchA-GigabitEthernet0/0/3] port hybrid pvid vlan 30
[SwitchA-GigabitEthernet0/0/3] port hybrid untagged vlan 30
[SwitchA-GigabitEthernet0/0/3] quit

[SwitchA] interface vlanif 30
[SwitchA-Vlanif30] ip address 10.1.30.1 255.255.255.0
[SwitchA-Vlanif30] quit

Step 2: Configure sFlow Agent and Collector

Set the agent IP (use switch management IP):

[SwitchA] sflow agent ip 10.1.10.1

Configure collector (CCE server IP and description): 

Configure collector (CCE server IP and description):

Step 3: Configure Flow Sampling

On interface GE0/0/2:

[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] sflow flow-sampling rate 4000
[SwitchA-GigabitEthernet0/0/2] sflow flow-sampling collector 2

Step 4: Configure Counter Sampling

Set counter sampling on the same interface:

[SwitchA-GigabitEthernet0/0/2] sflow counter-sampling interval 120
[SwitchA-GigabitEthernet0/0/2] sflow counter-sampling collector 2
[SwitchA-GigabitEthernet0/0/2] quit

Save and exit: 

[SwitchA] quit

Verification (MSSP Only)

On Huawei Switch

Run:

<SwitchA> display sflow

This shows:

• Agent IP

• Collector IP/Port (default 6343)

• Flow-sample rate and direction

• Counter-sample interval

On ADR CCE

Check flows are received:

sudo tcpdump -i any port 6343 and host <Switch_IP> -AAA

On ADR UI

1. Log in to ADR SIEM UI.

2. Navigate: System → Logs and Flows Collection Status.

3. Verify that the Huawei switch IP appears under Source Device IP.

Reference: https://support.huawei.com/enterprise/en/doc/EDOC1000178174/d73ef0a7/example-for-configuring-sflow