Filter Web-Access Acl - H3C MSR Series Command Reference Manual

Predefined user roles
network-admin
Parameters
uri-acl-name: Specifies a URI ACL by its name, a case-insensitive string of 1 to 31 characters. The
specified URI ACL must already exist.
Usage guidelines
You can specify both an advanced ACL and a URI ACL for TCP access filtering.
For mobile client users, the SSL VPN gateway uses the following procedure to determine whether to
forward a TCP access request:
1. Matches the request against the authorized port forwarding list.
If the request matches a port forwarding entry in the list, the gateway forwards the request.

If the request does not match any port forwarding entries in the list, the gateway proceeds to

step 2.
2. Matches the request against the rules in the URI ACL:
If the request matches a permit rule, the gateway forwards the request.

If the request matches a deny rule, the gateway drops the request.

If the request does not match any rules in the URI ACL or if no URI ACL is available, the

gateway proceeds to step 3.
3. Matches the request against the rules in the advanced ACL:
If the request matches a permit rule, the gateway forwards the request.

If the request matches a deny rule, the gateway drops the request.

If the request does not match any rules in the advanced ACL or if no advanced ACL is

available, the gateway drops the request.
For PC users, the ACLs configured for TCP access filtering do not take effect. They can access only
the TCP resources authorized to them through the TCP port forwarding list.
If you execute this command multiple times, the most recent configuration takes effect.
Examples
# Configure policy group abcpg to use URI ACL abcuriacl2 for TCP access filtering.
<Sysname> system-view
[Sysname] sslvpn context abc
[Sysname-sslvpn-context-abc] policy-group abcpg
[Sysname-sslvpn-context-abc-policy-group-abcpg] filter tcp-access uri-acl abcuriacl2
Related commands
filter tcp-access acl

filter web-access acl

Use filter web-access acl to specify an advanced ACL for Web access filtering.
Use undo filter web-access acl to remove the advanced ACL configuration for Web access
filtering.
Syntax
filter web-access [ ipv6 ] acl advanced-acl-number
undo filter web-access [ ipv6 ] acl
760