安全分册05 web过滤命令

命令手册安全分册WEB 1disyfirewallhttpactivex- 1disyfirewallhttpjava- 2disyfirewallhttpurl-filter 4disyfirewallhttpurl-filter 6 8 9 9 firewallhttpurl-filterhost firewallhttpurl-filterhost firewallhttpurl-filterhost firewallhttpurl-filterhostip- firewallhttpurl-filterhost firewallhttpurl-filterhost firewallhttpurl-filterhosturl- firewallhttpurl-filter resetfirewall i第1WEB度为1～135个字符，不区分大小写，不包括结束符；文件名的长度为1～91个字符，不区分大小写，不包括结束符。disyfirewallhttpactivex-

disyfirewallhttpactivex-blocking[all| |verbose1： 后缀关键字，必须以“.”开头，为1～9个字符的字符串（包括“.”在内）。如果不指定任何关键字，则显示ActiveX阻断的简要信息。<Sysname> yfirewallhttpactivex-ActiveXblockingis<Sysname>disyfirewallhttpactivex-blockingitemTheHTTPrequestpacketluding".ocx"hadbeenmatchedfor5<Sysname>disyfirewallhttpactivex-blockingall 表1-1disyfirewallhttpactivex-blockingall命令显示信息描述<Sysname>disyfirewallhttpactivex-blockingverboseActiveXblockingisenabled.NoACLgrouphasbeenconfigured.Thereare5packet(s)beingfiltered.Thereare0packet(s)beingpassed.表1-2disyfirewallhttpactivex-blockingverbose命令显示信息描述ActiveXblockingisNoACLgrouphasbeenThereare5packet(s)beingThereare0packet(s)being

disyfirewallhttpjava-blocking[all| |verbose 后缀关键字，必须以“.”开头，为1～9个字符的字符串（包括“.”在内）。如果不指定任何关键字，则显示JavaApplet阻断的简要信息。<Sysname>disyfirewallhttpjava-blockingJavablockingisenabled.<Sysname>disyfirewallhttpjava-blockingitemTheHTTPrequestpacketluding".class"hadbeenmatchedfor10times.#显示所有JavaApplet阻断后缀关键字的信息。<Sysname>disyfirewallhttpjava-blocking12030<Sysname>disyfirewallhttpjava-blockingverboseJavablockingisenabled.NoACLgrouphasbeenconfigured.Thereare10packet(s)beingfiltered.Thereare0packet(s)beingpassed.表1-4disyfirewallhttpjava-blockingverbose命令显示信息描述JavablockingisNoACLgrouphasbeenThereare10packet(s)beingThereare0packet(s)beingdisyfirewallhttpurl-filter

disyfirewallhttpurl-filterhost[all| |verbose <Sysname>disyfirewallhttpurl-filterhostURL-filterhostisenabled.Default#<Sysname>disyfirewallhttpurl-filterhostitem#<Sysname>disyfirewallhttpurl-filterhostall 表1-5disyfirewallhttpurl-filterhostall命令显示信息描述<Sysname>disyfirewallhttpurl-filterhostverboseURL-filterhostisenabled.Defaultmethod:ThesupportforIPaddress:deny.NoACLgrouphasbeenURL-filterhosthasloadedfileThereare10packet(s)beingfiltered.Thereare0packet(s)beingpassed.表1-6disyfirewallhttpurl-filterhostverbose命令显示信息描述ThesupportforIPNoACLgrouphasbeenThereare10packet(s)beingThereare0packet(s)beingdisyfirewallhttpurl-filter

disyfirewallhttpurl-filterparameter[all| |verbose “$”、“&”和“*”）以及其它ASCII字符（31<ASCII值<127）构成。如果不指定任何关键字，则显示URL参数过滤的简要信息。<Sysname>disyfirewallhttpurl-filterparameterURL-filterparameterisenabled.<Sysname>disyfirewallhttpurl-filterparameteritemTheHTTPrequestpacketluding"^select$"hadbeenmatchedfor10times.#显示所有URL过滤参数的信息。<Sysname>disyfirewallhttpurl-filterparamellSNMatch-Times10203040506070‘8090表1-7disyfirewallhttpurl-filterparamell命令显示信息描述<Sysname>disyfirewallhttpurl-filterparameterverboseURL-filterparameterisenabled.URL-filterparameterhasloadedfileThereare10packet(s)beingfiltered.Thereare0packet(s)beingpassed.表1-8disyfirewallhttpurl-filterparameterverbose命令显示信息描述URL-filterparameterhasloadedfileThereare10packet(s)beingThereare0packet(s)being

firewallhttpactivex-blockingaclacl-undofirewallhttpactivex-blocking字的WEB请求将按照ACL规则规定的方式进行处理。暂时不生效，直到该ACL规则配置后才能生效。[Sysname]firewallhttpactivex-blockingacl

firewallhttpactivex-blockingundofirewallhttpactivex-blocking无firewallhttpactivex-blockingenableActiveX阻断功能，并将缺省阻断关键字“.ocx”添加到ActiveX阻断关键字列表中。undofirewallhttpactivex-blockingenable命令用来关闭ActiveX阻断功能。[Sysname]firewallhttpactivex-blocking

firewallhttpactivex-blockingundofirewallhttpactivex-blockingfirewallhttpactivex-blockingsuffix命令用来添加ActiveX阻断后缀关键字。undofirewallhttpactivex-blockingsuffix命令用来将指定的ActiveX阻断后缀关键字从ActiveX阻断关键字列表中删除。[Sysname]firewallhttpactivex-blockingsuffix

firewallhttpjava-blockingaclacl-undofirewallhttpjava-blocking键字的WEB请求将按照ACL规则规定的方式进行处理。功能暂时不生效，直到该ACL规则配置后才能生效。[Sysname]firewallhttpjava-blockingacl

firewallhttpjava-blockingenableundofirewallhttpjava-blockingenable无httpjava-blockingenable命令用来关闭JavaApplet阻断功能。[Sysname]firewallhttpjava-blockingfirewallhttpjava-blocking

firewallhttpjava-blockingsuffixundofirewallhttpjava-blockingsuffix：表示需要阻断的后缀关键字，必须以“.1～9个字符的字符firewallhttpjava-blockingsuffixJavaApplet阻断后缀关键字。undofirewallhttpjava-blockingsuffixJavaApplet阻断后缀关键字从JavaApplet阻断关键字列表中删除。[Sysname]firewallhttpjava-blockingsuffixfirewallhttpurl-filterhost

firewallhttpurl-filterhostaclacl-undofirewallhttpurl-filterhostfirewallhttpurl-filterhostaclACL规则。undofirewallhttpurl-filterhostacl命令用来删除设置的网页地址过滤ACL规则。不生效，直到该ACL规则配置后才能生效。<Sysname>system-view[Sysname]aclnumber2000[Sysname-acl-basic-2000]rule0permitsource[Sysname-acl-basic-2000]quit[Sysname]firewallhttpurl-filterhostaclfirewallhttpurl-filterhost

firewallhttpurl-filterhostdefault{deny|permitfirewallhttpurl-filterhostdefault命令用来配置网页地址过滤的缺省过滤行为，#[Sysname]firewallhttpurl-filterhostdefaultfirewallhttpurl-filterhost

firewallhttpurl-filterhostundofirewallhttpurl-filterhost无firewallhttpurl-filterhostenableURL网页地址过滤功能。undofirewallhttpurl-filterhostenable命令用来关闭URL网页地址过滤功能。[Sysname]firewallhttpurl-filterhostfirewallhttpurl-filterhostip-

firewallhttpurl-filterhostip-address{deny|permit缺省情况下，URL网页地址过滤不支持IP地址，即以IP地址直接访问的WEB请求通过。[Sysname]firewallhttpurl-filterhostip-addressfirewallhttpurl-filterhost

firewallhttpurl-filterhostloadfile-undofirewallhttpurl-filterhost启动时将网页地址过滤条目从指定文件中重新装载到设备上。undofirewallhttpurl-filterhostload命令用来指示设备重新启动时不再进行过滤条目的装载。#[Sysname]firewallhttpurl-filterhostloadfirewallhttpurl-filterhost

firewallhttpurl-filterhostsavefile-firewallhttpurl-filterhostsave命令用来将网页地址过滤条目保存到指定的文件#[Sysname]firewallhttpurl-filterhostsavefirewallhttpurl-filterhosturl-

firewallhttpurl-filterhosturl-address{deny|permit}url-undofirewallhttpurl-filterhosturl-address[url-address表1-9^$&*表示以“webfilter”开头的（如 .cn）或类似于 含独立词语“webfilter”的，比如 ，但是类似于.com的将不会被过滤 firewallhttpurl-filterhosturl-address命令用来添加网页地址过滤条目，并设置过滤行为。undofirewallhttpurl-filterhosturl-address命令用来删除网页地址为deny，可以直接将其修改为permit。[Sysname]firewallhttpurl-filterhosturl-addresspermit^firewallhttpurl-filter

firewallhttpurl-filterparameter{default undofirewallhttpurl-filterparameter[default default 如"selectall"。一个空格可以匹配参数名中连续的多个空格。通配符具体含义如表表1-10^$&*URL过滤参数列表中。undofirewallhttpurl-filterparameter命令用来删除URL过滤参数。firewallhttpurl-filter[Sysname]firewallhttpurl-filter firewallhttpurl-filterparameter

firewallhttpurl-filterparameterenableundofirewallhttpurl-filterparameterenable无firewallhttpurl-filterhosten