小乔 发表于 2024-11-1 15:01:34

通过URL分类控制用户访问的网站

组网需求如图5-6所示,DeviceA作为企业网关部署在网络边界,对用户访问外部网络的URL访问请求进行URL过滤。公司有研发部门员工和市场部门员工两类,具体需求如下:
[*]研发部门员工只可以在每天的09:00~17:00访问教育/科学类、搜索/门户类网站。其他网站均不能访问。
[*]市场部门员工只可以在每天的09:00~17:00访问教育/科学类、搜索/门户类、社会焦点类网站。其他网站均不能访问。
图5-6 通过URL分类控制用户访问的网站https://download.huawei.com/mdl/image/download?uuid=1198558ebf624398a795b9f0fd0840d3本例中interface1、interface2分别代表10GE0/0/1、10GE0/0/2。


https://download.huawei.com/mdl/image/download?uuid=18a4009c491440ffb1757b3a252b5baa


配置思路
[*]配置接口IP地址和安全区域,完成网络基本参数配置。
[*]配置远程查询服务器,用来获取URL与预定义分类的对应关系。本例中教育/科学类、搜索/门户类、社会焦点类网站可以通过预定义分类来进行URL过滤控制。为了可以正常使用远程查询功能,需要进行如下配置:
[*]激活URL远程查询License并且确保该License在有效服务期内。
[*]配置DNS服务器,确保DeviceA可以正确解析isecurity.huawei.com。
[*]配置远程查询服务器的相关参数,包括查询方式、国家名称和超时时间。
[*]配置安全策略允许DeviceA访问调度中心isecurity.huawei.com。

[*]针对研发部门员工和市场部门员工,新建两个URL过滤配置文件profile_url_research和profile_url_marketing,设置URL预定义分类的控制动作。
[*]配置时间段。
[*]配置两个安全策略,引用时间段和URL过滤配置文件等信息,实现对来自不同部门的员工的URL访问控制。


操作步骤操作步骤
配置接口IP地址和安全区域,完成网络基本参数配置。
<HUAWEI> system-view
sysname DeviceA
interface 10ge 0/0/1
ip address 1.1.1.1 24
quit
interface 10ge 0/0/2
ip address 10.1.1.1 255.255.255.0
ip address 10.1.2.1 255.255.255.0 sub
quit
firewall zone untrust
add interface 10ge 0/0/1
quit
firewall zone trust
add interface 10ge 0/0/2
quit
配置远程查询服务器,用来获取URL与预定义分类的对应关系。
激活License并且确保该License在有效服务期内。
配置DNS服务器。
dns resolve
dns server 10.2.0.70
配置远程查询服务器的相关参数,包括国家名称、超时时间和超时动作。
country CN
url-filter query timeout time 3 action allow
配置安全策略,允许DeviceA访问调度中心。
security-policy
rule name policy_sec_huawei_com
source-zone local
destination-zone untrust
action permit
quit
quit
配置URL过滤配置文件。


通过display url-filter category pre-defined命令,可以查询到如下预定义分类和ID的对应关系。


17:教育/科学类(Education/Science)
15:搜索/门户类(Search Engines/Portals)
5:社会焦点类(Social Focus)
为研发部门配置URL过滤配置文件。
profile type url-filter name profile_url_research
category pre-defined action block
category pre-defined category-id 15 action allow
category pre-defined category-id 17 action allow
quit
为市场部门配置URL过滤配置文件。
profile type url-filter name profile_url_marketing
category pre-defined action block
category pre-defined category-id 5 action allow
category pre-defined category-id 15 action allow
category pre-defined category-id 17 action allow
quit
配置时间段。
time-range time_range 09:00 to 17:00 daily
在安全策略中应用URL过滤配置文件。
为研发部门配置安全策略。
security-policy
rule name policy_sec_research
description Security policy of web access protect for research.
source-zone trust
destination-zone untrust
source-address 10.1.2.0 mask 255.255.255.0
time-range time_range
action permit
profile url-filter profile_url_research
quit
为市场部门配置安全策略。
rule name policy_sec_marketing
description Security policy of web access protect for marketing.
source-zone trust
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
time-range time_range
action permit
profile url-filter profile_url_marketing
quit
quit
提交内容安全配置文件。
engine configuration commit
Info: The operation may last for several minutes, please wait.
Info: URL submitted configurations successfully.
Info: Finish committing engine compiling.
检查配置结果
研发部门任何员工在09:00~17:00之间,可以访问教育/科学类、搜索/门户类网站,但是访问社会焦点类等其他网站时,都被阻断不能访问。


研发部门员工访问社会焦点类等其他网站时,管理员可以看到Type(过滤类型)为“Pre-defined”,Action(动作)为“Block”的URL日志信息(URL/4/FILTER)。


市场部门任何员工在09:00~17:00之间,可以访问教育/科学类、搜索/门户类、社会焦点类网站,但是访问其他网站时,都被阻断不能访问。


市场部门员工访问其他网站时,管理员可以看到Type(过滤类型)为“Pre-defined”,Action(动作)为“Block”的URL日志信息(URL/4/FILTER)。


配置脚本
#
sysname DeviceA
#
dns resolve
dns server 10.2.0.70
#
country CN
#
time-range time_range 09:00 to 17:00 daily
#
interface 10GE0/0/1
ip address 1.1.1.1 255.255.255.0
#
interface 10GE0/0/2
ip address 10.1.1.1 255.255.255.0
ip address 10.1.2.1 255.255.255.0 sub
#
firewall zone trust
set priority 85
add interface 10GE0/0/2
#
firewall zone untrust
set priority 5
add interface 10GE0/0/1
#
profile type url-filter name profile_url_research
category pre-defined subcategory-id 101 action block
category pre-defined subcategory-id 102 action block
category pre-defined subcategory-id 162 action block
category pre-defined subcategory-id 163 action block
category pre-defined subcategory-id 164 action block
category pre-defined subcategory-id 165 action block
category pre-defined subcategory-id 103 action block
category pre-defined subcategory-id 166 action block
category pre-defined subcategory-id 167 action block
category pre-defined subcategory-id 168 action block
category pre-defined subcategory-id 104 action block
category pre-defined subcategory-id 169 action block
category pre-defined subcategory-id 170 action block
category pre-defined subcategory-id 105 action block
category pre-defined subcategory-id 171 action block
category pre-defined subcategory-id 172 action block
category pre-defined subcategory-id 173 action block
category pre-defined subcategory-id 174 action block
category pre-defined subcategory-id 106 action block
category pre-defined subcategory-id 108 action block
category pre-defined subcategory-id 177 action block
category pre-defined subcategory-id 251 action block
category pre-defined subcategory-id 109 action block
category pre-defined subcategory-id 110 action block
category pre-defined subcategory-id 111 action block
category pre-defined subcategory-id 112 action block
category pre-defined subcategory-id 114 action block
category pre-defined subcategory-id 115 action block
category pre-defined subcategory-id 117 action block
category pre-defined subcategory-id 178 action block
category pre-defined subcategory-id 179 action block
category pre-defined subcategory-id 180 action block
category pre-defined subcategory-id 181 action block
category pre-defined subcategory-id 248 action block
category pre-defined subcategory-id 118 action block
category pre-defined subcategory-id 119 action block
category pre-defined subcategory-id 122 action block
category pre-defined subcategory-id 182 action block
category pre-defined subcategory-id 183 action block
category pre-defined subcategory-id 184 action block
category pre-defined subcategory-id 123 action block
category pre-defined subcategory-id 124 action block
category pre-defined subcategory-id 186 action block
category pre-defined subcategory-id 187 action block
category pre-defined subcategory-id 188 action block
category pre-defined subcategory-id 189 action block
category pre-defined subcategory-id 125 action block
category pre-defined subcategory-id 127 action block
category pre-defined subcategory-id 128 action block
category pre-defined subcategory-id 130 action block
category pre-defined subcategory-id 131 action block
category pre-defined subcategory-id 132 action block
category pre-defined subcategory-id 197 action block
category pre-defined subcategory-id 198 action block
category pre-defined subcategory-id 199 action block
category pre-defined subcategory-id 200 action block
category pre-defined subcategory-id 227 action block
category pre-defined subcategory-id 228 action block
category pre-defined subcategory-id 133 action block
category pre-defined subcategory-id 201 action block
category pre-defined subcategory-id 202 action block
category pre-defined subcategory-id 204 action block
category pre-defined subcategory-id 205 action block
category pre-defined subcategory-id 134 action block
category pre-defined subcategory-id 135 action block
category pre-defined subcategory-id 136 action block
category pre-defined subcategory-id 137 action block
category pre-defined subcategory-id 138 action block
category pre-defined subcategory-id 139 action block
category pre-defined subcategory-id 140 action block
category pre-defined subcategory-id 141 action block
category pre-defined subcategory-id 206 action block
category pre-defined subcategory-id 207 action block
category pre-defined subcategory-id 208 action block
category pre-defined subcategory-id 209 action block
category pre-defined subcategory-id 210 action block
category pre-defined subcategory-id 229 action block
category pre-defined subcategory-id 142 action block
category pre-defined subcategory-id 143 action block
category pre-defined subcategory-id 144 action block
category pre-defined subcategory-id 145 action block
category pre-defined subcategory-id 146 action block
category pre-defined subcategory-id 147 action block
category pre-defined subcategory-id 211 action block
category pre-defined subcategory-id 212 action block
category pre-defined subcategory-id 213 action block
category pre-defined subcategory-id 240 action block
category pre-defined subcategory-id 253 action block
category pre-defined subcategory-id 149 action block
category pre-defined subcategory-id 150 action block
category pre-defined subcategory-id 214 action block
category pre-defined subcategory-id 215 action block
category pre-defined subcategory-id 216 action block
category pre-defined subcategory-id 217 action block
category pre-defined subcategory-id 151 action block
category pre-defined subcategory-id 218 action block
category pre-defined subcategory-id 219 action block
category pre-defined subcategory-id 220 action block
category pre-defined subcategory-id 221 action block
category pre-defined subcategory-id 222 action block
category pre-defined subcategory-id 223 action block
category pre-defined subcategory-id 230 action block
category pre-defined subcategory-id 252 action block
category pre-defined subcategory-id 152 action block
category pre-defined subcategory-id 153 action block
category pre-defined subcategory-id 238 action block
category pre-defined subcategory-id 154 action block
category pre-defined subcategory-id 155 action block
category pre-defined subcategory-id 224 action block
category pre-defined subcategory-id 225 action block
category pre-defined subcategory-id 156 action block
category pre-defined subcategory-id 157 action block
category pre-defined subcategory-id 158 action block
category pre-defined subcategory-id 231 action block
category pre-defined subcategory-id 232 action block
category pre-defined subcategory-id 159 action block
category pre-defined subcategory-id 254 action block
category pre-defined subcategory-id 160 action block
category pre-defined subcategory-id 161 action block
category pre-defined subcategory-id 176 action block
category pre-defined subcategory-id 226 action block
category pre-defined subcategory-id 234 action block
category pre-defined subcategory-id 235 action block
category pre-defined subcategory-id 236 action block
category pre-defined subcategory-id 237 action block
category pre-defined subcategory-id 239 action block
category pre-defined subcategory-id 241 action block
category pre-defined subcategory-id 233 action block
profile type url-filter name profile_url_marketing                                          
category pre-defined subcategory-id 101 action block
category pre-defined subcategory-id 102 action block
category pre-defined subcategory-id 162 action block
category pre-defined subcategory-id 163 action block
category pre-defined subcategory-id 164 action block
category pre-defined subcategory-id 165 action block
category pre-defined subcategory-id 103 action block
category pre-defined subcategory-id 166 action block
category pre-defined subcategory-id 167 action block
category pre-defined subcategory-id 168 action block
category pre-defined subcategory-id 104 action block
category pre-defined subcategory-id 169 action block
category pre-defined subcategory-id 170 action block
category pre-defined subcategory-id 106 action block
category pre-defined subcategory-id 108 action block
category pre-defined subcategory-id 177 action block
category pre-defined subcategory-id 251 action block
category pre-defined subcategory-id 109 action block
category pre-defined subcategory-id 110 action block
category pre-defined subcategory-id 111 action block
category pre-defined subcategory-id 112 action block
category pre-defined subcategory-id 114 action block
category pre-defined subcategory-id 115 action block
category pre-defined subcategory-id 117 action block
category pre-defined subcategory-id 178 action block
category pre-defined subcategory-id 179 action block
category pre-defined subcategory-id 180 action block
category pre-defined subcategory-id 181 action block
category pre-defined subcategory-id 248 action block
category pre-defined subcategory-id 118 action block
category pre-defined subcategory-id 119 action block
category pre-defined subcategory-id 122 action block
category pre-defined subcategory-id 182 action block
category pre-defined subcategory-id 183 action block
category pre-defined subcategory-id 184 action block
category pre-defined subcategory-id 123 action block
category pre-defined subcategory-id 124 action block
category pre-defined subcategory-id 186 action block
category pre-defined subcategory-id 187 action block
category pre-defined subcategory-id 188 action block
category pre-defined subcategory-id 189 action block
category pre-defined subcategory-id 125 action block
category pre-defined subcategory-id 127 action block
category pre-defined subcategory-id 128 action block
category pre-defined subcategory-id 130 action block
category pre-defined subcategory-id 131 action block
category pre-defined subcategory-id 132 action block
category pre-defined subcategory-id 197 action block
category pre-defined subcategory-id 198 action block
category pre-defined subcategory-id 199 action block
category pre-defined subcategory-id 200 action block
category pre-defined subcategory-id 227 action block
category pre-defined subcategory-id 228 action block
category pre-defined subcategory-id 133 action block
category pre-defined subcategory-id 201 action block
category pre-defined subcategory-id 202 action block
category pre-defined subcategory-id 204 action block
category pre-defined subcategory-id 205 action block
category pre-defined subcategory-id 134 action block
category pre-defined subcategory-id 135 action block
category pre-defined subcategory-id 136 action block
category pre-defined subcategory-id 137 action block
category pre-defined subcategory-id 138 action block
category pre-defined subcategory-id 139 action block
category pre-defined subcategory-id 140 action block
category pre-defined subcategory-id 141 action block
category pre-defined subcategory-id 206 action block
category pre-defined subcategory-id 207 action block
category pre-defined subcategory-id 208 action block
category pre-defined subcategory-id 209 action block
category pre-defined subcategory-id 210 action block
category pre-defined subcategory-id 229 action block
category pre-defined subcategory-id 142 action block
category pre-defined subcategory-id 143 action block
category pre-defined subcategory-id 144 action block
category pre-defined subcategory-id 145 action block
category pre-defined subcategory-id 146 action block
category pre-defined subcategory-id 147 action block
category pre-defined subcategory-id 211 action block
category pre-defined subcategory-id 212 action block
category pre-defined subcategory-id 213 action block
category pre-defined subcategory-id 240 action block
category pre-defined subcategory-id 253 action block
category pre-defined subcategory-id 149 action block
category pre-defined subcategory-id 150 action block
category pre-defined subcategory-id 214 action block
category pre-defined subcategory-id 215 action block
category pre-defined subcategory-id 216 action block
category pre-defined subcategory-id 217 action block
category pre-defined subcategory-id 151 action block
category pre-defined subcategory-id 218 action block
category pre-defined subcategory-id 219 action block
category pre-defined subcategory-id 220 action block
category pre-defined subcategory-id 221 action block
category pre-defined subcategory-id 222 action block
category pre-defined subcategory-id 223 action block
category pre-defined subcategory-id 230 action block
category pre-defined subcategory-id 252 action block
category pre-defined subcategory-id 152 action block
category pre-defined subcategory-id 153 action block
category pre-defined subcategory-id 238 action block
category pre-defined subcategory-id 154 action block
category pre-defined subcategory-id 155 action block
category pre-defined subcategory-id 224 action block
category pre-defined subcategory-id 225 action block
category pre-defined subcategory-id 156 action block
category pre-defined subcategory-id 157 action block
category pre-defined subcategory-id 158 action block
category pre-defined subcategory-id 231 action block
category pre-defined subcategory-id 232 action block
category pre-defined subcategory-id 159 action block
category pre-defined subcategory-id 254 action block
category pre-defined subcategory-id 160 action block
category pre-defined subcategory-id 161 action block
category pre-defined subcategory-id 176 action block
category pre-defined subcategory-id 226 action block
category pre-defined subcategory-id 234 action block
category pre-defined subcategory-id 235 action block
category pre-defined subcategory-id 236 action block
category pre-defined subcategory-id 237 action block
category pre-defined subcategory-id 239 action block
category pre-defined subcategory-id 241 action block
category pre-defined subcategory-id 233 action block
#
security-policy
rule name policy_sec_huawei_com
source-zone local
destination-zone untrust
action permit
rule name policy_sec_research
description Security policy of web access protect for research.
source-zone trust
destination-zone untrust
source-address 10.1.2.0 mask 255.255.255.0
time-range time_range
profile url-filter profile_url_research
action permit
rule name policy_sec_marketing
description Security policy of web access protect for marketing.
source-zone trust
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
time-range time_range
profile url-filter profile_url_marketing
action permit
#
return




mawr1985 发表于 2024-11-1 15:03:48

{:6_267:}
页: [1]
查看完整版本: 通过URL分类控制用户访问的网站