本举例是在M9000-AI-E8的R9071版本上进行配置和验证的。
如下图所示，Device分别通过Trust安全域和Untrust安全域与局域网和Internet相连。现有以下组网需求：
阻止URI或者Body字段含有“uri”或“abc.*abc”关键字的HTTP报文通过。
阻止下载文件内容中含有“example.com”关键字的FTP报文通过。
对以上被阻止的报文生成日志信息。
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.1.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
配置静态路由
本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。
# 请根据组网图中规划的信息，配置静态路由，本举例假设到达外网Web Server的下一跳IP地址为2.2.2.2，实际使用中请以具体组网情况为准，具体配置步骤如下。
[Device] ip route-static 5.5.5.0 24 2.2.2.2
配置接口加入安全域
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/1
[Device-security-zone-Trust] quit
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] quit
配置数据过滤功能
配置关键字组
# 创建关键字组kg1，配置关键字文本uri和正则表示式abc.*abc；
[Device] data-filter keyword-group kg1
[Device-data-filter-kgroup-kg1] pattern 1 text uri
[Device-data-filter-kgroup-kg1] pattern 2 regex abc.*abc
[Device-data-filter-kgroup-kg1] quit
# 按照同样的步骤，创建关键字组kg2，配置匹配关键字文本example.com。
[Device] data-filter keyword-group kg2
[Device-data-filter-kgroup-kg2] pattern 1 text example.com
[Device-data-filter-kgroup-kg2] quit
配置数据过滤策略
# 创建数据过滤规则r1，在规则r1中应用关键字组kg1，配置应用类型为HTTP，报文方向为会话的双向，动作为丢弃并输出日志。
[Device] data-filter policy p1
[Device-data-filter-policy-p1] rule r1
[Device-data-filter-policy-p1-rule-r1] keyword-group kg1
[Device-data-filter-policy-p1-rule-r1] application type http
[Device-data-filter-policy-p1-rule-r1] direction both
[Device-data-filter-policy-p1-rule-r1] action drop logging
[Device-data-filter-policy-p1-rule-r1] quit
# 按照同样的步骤，创建数据过滤规则r2，在规则r2中应用关键字组kg2，配置应用类型为FTP，报文方向为会话的下载方向，动作为丢弃并输出日志。
[Device-data-filter-policy-p1] rule r2
[Device-data-filter-policy-p1-rule-r2] keyword-group kg2
[Device-data-filter-policy-p1-rule-r2] application type ftp
[Device-data-filter-policy-p1-rule-r2] direction download
[Device-data-filter-policy-p1-rule-r2] action drop logging
[Device-data-filter-policy-p1-rule-r2] quit
配置DPI应用profile并激活数据过滤策略和规则配置
# 创建名称为sec的DPI应用profile，在DPI应用sec中应用数据过滤策略p1。
[Device] app-profile sec
[Device-app-profile-sec] data-filter apply policy p1
[Device-app-profile-sec] quit
# 激活数据过滤策略和规则配置。
[Device] inspect activate
配置安全策略
# 配置名称为trust-untrust的安全策略规则，使内网用户可以访问外网，并对交互报文进行数据过滤检测。具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name trust-untrust
[Device-security-policy-ip-10-trust-untrust] source-zone trust
[Device-security-policy-ip-10-trust-untrust] source-ip-subnet 192.168.1.0 24
[Device-security-policy-ip-10-trust-untrust] destination-zone untrust
[Device-security-policy-ip-10-trust-untrust] action pass
[Device-security-policy-ip-10-trust-untrust] profile sec
[Device-security-policy-ip-10-trust-untrust] quit
# 激活安全策略配置。
[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
完成上述配置后，符合上述条件的HTTP报文和FTP报文将被阻断，并输出日志信息。
#
interface GigabitEthernet1/0/1
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/2
ip address 2.2.2.1 255.255.255.0
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
#
ip route-static 5.5.5.0 24 2.2.2.2
#
data-filter keyword-group kg1
pattern 1 text uri
pattern 2 regex abc.*abc
#
data-filter keyword-group kg2
pattern 1 text example.com
#
data-filter policy p1
rule r1
keyword-group kg1
application type http
direction both
action drop logging
rule r2
keyword-group kg2
application type ftp
direction download
action drop logging
#
app-profile sec
data-filter apply policy p1
#
inspect activate
#
security-policy ip
accelerate enhanced enable
rule 0 name trust-untrust
action pass
profile sec
source-zone trust
destination-zone untrust
source-ip-subnet 192.168.1.0 255.255.255.0