- 产品与解决方案
- 行业解决方案
- 服务
- 支持
- 合作伙伴
- 新华三人才研学中心
- 关于我们
01-URL过滤故障案例
本章节下载 (109.46 KB)
1.1.1 故障描述
局域网内PC通过防火墙访问Internet，防火墙上开启URL过滤业务。保护用户访问网页安全。
安全策略中开启URL过滤检测。
<Device> system-view
[Device] url-filter policy url
[Device-url-filter-policy-url] default-action permit logging
[Device-url-filter-policy-url] category Pre-Botnet action reset logging
[Device-url-filter-policy-url] category Pre-ChildAbuse action reset logging
[Device-url-filter-policy-url] category Pre-CriminalActivity action reset logging
[Device-url-filter-policy-url] category Pre-Discrimination action reset logging
[Device-url-filter-policy-url] category Pre-Divining action reset logging
[Device-url-filter-policy-url]category Pre-Drugs action reset logging
[Device-url-filter-policy-url] category Pre-Gamble action reset logging
[Device-url-filter-policy-url] category Pre-Hacking action reset logging
[Device-url-filter-policy-url] category Pre-IllegalSoftware action reset logging
[Device-url-filter-policy-url] category Pre-Lottery action reset logging
[Device-url-filter-policy-url] category Pre-MaliciousURL action reset logging
[Device-url-filter-policy-url] category Pre-Phishing action reset logging
[Device-url-filter-policy-url] category Pre-Pornography action reset logging
[Device-url-filter-policy-url] category Pre-Religion action reset logging
[Device-url-filter-policy-url] category Pre-SchoolCheating action reset logging
[Device-url-filter-policy-url] category Pre-Spam action reset logging
[Device-url-filter-policy-url] category Pre-Suicide action reset logging
[Device-url-filter-policy-url] category Pre-Violence action reset logging
[Device-url-filter-policy-url] quit
[Device] app-profile 0_IPv4
[Device-app-profile-0_IPv4] url-filter apply policy url
[Device-app-profile-0_IPv4] quit
[Device] security-policy ip
[Device-security-policy-ip ] rule 0 name url
[Device-security-policy-ip-1-url] action pass
[Device-security-policy-ip-1-url] counting enable
[Device-security-policy-ip-1-url] profile 0_IPv4
使用者从局域网向Internet访问有害网页，例如色情网站等，用户成功访问，且设备无日志。
1.1.2 故障处理步骤
(1) 查看URL特征库版本信息，是否为最新版本，如果版本较老，请从官网上获取最新版本进行升级。
(2) 查看设备引擎状态，是否Bypass，如果进行了手工Bypass或CPU、memory自动Bypass，可以通过undo inspect bypss命令重新激活引擎。
(3) 查看访问页面是否为HTTPS加密网页，如果是加密网页可以开启SSL卸载功能。
(4) 查看URL过滤规则是否下发引擎，如果没有下发URL过滤规则，需要在系统视图下执行inspect activate或通过Web激活引擎，重新下发规则。
<Device> system-view
[Device] probe
[Device-probe] display system internal inspect dim-rule
Slot 1:
MdcID MoudleName Total MD5 rules
0 Anti-Virus 0
MdcID RuleID ModuleName L4ProName uiAppIdL5
0 356581376 UFLT TCP HTTP
0 268435456 UFLT TCP HTTP
0 356646912 UFLT TCP HTTP
0 268435457 UFLT TCP HTTP
0 431030273 UFLT TCP HTTP
0 384958465 UFLT TCP HTTP
0 2147483649 FFILTER TCP
0 447873026 UFLT TCP HTTP
0 268435458 UFLT TCP HTTP
(5) 查看会话是否建立，确保会话的源目IP在指定的安全域内，并且在该域间启用深度检查功能，引用URL过滤策略。
<Device> system-view
[Device] probe
[Device-probe] display session table ipv4 source-ip 7.0.1.2 verbose
Slot 2:
Initiator:
Source IP/port: 7.0.1.2/50779
Destination IP/port: 7.0.0.2/80
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet2/0/2
Source security zone: Trust
Responder:
Source IP/port: 7.0.0.2/80
Destination IP/port: 7.0.1.2/50779
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: TCP(6)
Inbound interface: GigabitEthernet2/0/3
Source security zone: Untrust
State: TCP_ESTABLISHED
Application: HTTP
Rule ID: 0
Rule name: ips
Start time: 2019-11-15 11:31:01 TTL: 1197s
Initiator->Responder: 7 packets 1073 bytes
Responder->Initiator: 7 packets 2413 bytes
Total sessions found: 1
(6) 如果是自定义URL分类，检查用户使用的URL是否与分类的URL完全匹配。
(7) 前面都检查没有问题后设备还是不能拦截，有可能此时网页URL特征库不支持，此时需要协助抓取对应的交互报文反馈报文给研发进行分析。
1.1.3 故障诊断命令
|
命令 |
说明 |
|
url-filter apply policy policy-name |
缺省情况下，DPI应用profile中未引用URL过滤策略 |
|
inspect activate |
缺省情况下，DPI各业务模块自定义的规则或手动离线升级的特征库不生效 |
|
display inspect status |
显示应用层检测引擎的运行状态 |
不同款型规格的资料略有差异, 详细信息请向具体销售和400咨询。H3C保留在没有任何通知或提示的情况下对资料内容进行修改的权利!
支持
售前咨询
售后咨询
人工在线咨询
