H3C MSR Series Command Reference

758
Usage guidelines
You can specify both an advanced ACL and a URI ACL for IP access filtering.
The SSL VPN gateway uses the following procedure to determine whether to forward an IP access
request:
1. Matches the request against rules in the URI ACL:
 If the request matches a permit rule, the gateway forwards the request.
 If the request matches a deny rule, the gateway drops the request.
 If the request does not match any rules in the URI ACL or if no URI ACL is available, the
gateway proceeds to step 2.
2. Matches the request against rules in the advanced ACL:
 If the request matches a permit rule, the gateway forwards the request.
 If the request matches a deny rule, the gateway drops the request.
 If the request does not match any rules in the advanced ACL or if no advanced ACL is
available, the gateway drops the request.
If a rule in the URI ACL specified for IP access filtering contains HTTP or HTTPS settings, the rule
does not take effect.
If you execute this command multiple times, the most recent configuration takes effect.
Examples
# Configure policy group abcpg to use URI ACL abcuriacl for IP access filtering.
<Sysname> system-view
[Sysname] sslvpn context abc
[Sysname-sslvpn-context-abc] policy-group abcpg
[Sysname-sslvpn-context-abc-policy-group-abcpg] filter ip-tunnel uri-acl abcuriacl
Related commands
filter ip-tunnel acl
filter tcp-access acl
Use filter tcp-access acl to specify an advanced ACL for TCP access filtering.
Use undo filter tcp-access acl to remove the advanced ACL configuration for TCP access filtering.
Syntax
filter tcp-access [ ipv6 ] acl advanced-acl-number
undo filter tcp-access [ ipv6 ] acl
Default
A user can access only the TCP resources in the TCP port forwarding list authorized to the user.
Views
SSL VPN policy group view
Predefined user roles
network-admin
Parameters
ipv6: Specifies an IPv6 ACL. Do not configure this keyword if you want to specify an IPv4 ACL.
acl advanced-acl-number: Specifies an advanced ACL by its number in the range of 3000 to 3999. If
a rule in the specified ACL contains VPN settings, the rule does not take effect.

H3C MSR Series Specifications

General

Category	Network Router
IPv6 Support	Yes
Dimensions	Varies by model
Weight	Varies by model
Product Type	Modular Router
Ports	Varies by model
WAN Interfaces	Varies by model
Firewall	Yes
QoS	Yes
Wireless Support	Varies by model
USB Ports	Varies by model
Console Port	Yes
Power Supply	Varies by model
Redundancy	Varies by model
Operating Temperature	0°C to 45°C
Storage Temperature	-40°C to 70°C
Humidity	5% to 95% non-condensing
Series	MSR
Certifications	CE, FCC, RoHS