在H3C防火墙上，要针对某个网段进行URL访问白名单，具体应该怎么操作了？在ds上问了很多次，都没法操作成功

防火墙的型号是SecPath F1000-AI-35，软件版本是version 7.1.064, Release 8860P12。

1. 创建 URL 分类和策略

url-filter category whitelist

 rule 1 host text "***.***"

 rule 2 host text "***.***"

 rule 3 host text "h3c.com"

url-filter policy whitelist_policy

 category whitelist action permit

 default-action block

 log enable

2. 创建 URL 过滤配置文件

url-filter profile whitelist_profile

 policy whitelist_policy

3. 在接口上应用 URL 过滤

interface GigabitEthernet1/0/14  # 内网接口

 url-filter apply profile whitelist_profile

4. 创建安全策略控制访问

security-policy ip

 # 放行白名单网段的互联网访问

 rule 10 name allow_whitelist_out

  action pass

  source-ip-group whitelist_group  # 10.41.24.0/23

  destination-zone untrust

  logging enable

  counting enable

 

 # 阻止白名单网段的其他互联网访问

 rule 11 name block_whitelist_out

  action deny

  source-ip-group whitelist_group

  destination-zone untrust

  logging enable

  counting enable

<xtlzx_OUT_f1000>dis cu

#

 version 7.1.064, Release 8860P12

#

 sysname xtlzx_OUT_f1000

#

 clock protocol none

#

context Admin id 1

#

 telnet server enable

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 dns server 8.8.8.8

 dns server 114.114.114.114

#

 lldp global enable

#

 password-recovery enable

#

vlan 1

#

object-group ip address school_wuxian

 security-zone Trust

 0 network subnet 10.32.0.0 255.255.0.0

#

object-group ip address teacher_wuxian

 security-zone Trust

 0 network subnet 10.31.0.0 255.255.0.0

#

object-group ip address youxian

 security-zone Trust

 0 network subnet 10.41.0.0 255.255.0.0

 10 network subnet 172.16.100.0 255.255.255.0

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

#

interface GigabitEthernet1/0/1

 port link-mode route

#

interface GigabitEthernet1/0/2

 port link-mode route

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

#

interface GigabitEthernet1/0/5

 port link-mode route

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

#

interface GigabitEthernet1/0/9

 port link-mode route

#

interface GigabitEthernet1/0/10

 port link-mode route

#

interface GigabitEthernet1/0/11

 port link-mode route

#

interface GigabitEthernet1/0/12

 port link-mode route

#

interface GigabitEthernet1/0/13

 port link-mode route

#

interface GigabitEthernet1/0/14

 port link-mode route

 description downto routeMSR5660

 ip address 10.10.1.1 255.255.255.252

 nat hairpin enable

 manage https inbound

 manage https outbound

#

interface GigabitEthernet1/0/15

 port link-mode route

 description upto lt_dianguanzhan2/2

 ip address 124.165.196.45 255.255.255.0

 packet-filter 3010 inbound

 nat outbound 2000

#

interface GigabitEthernet1/0/16

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/17

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/18

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/19

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/20

 port link-mode route

#

interface GigabitEthernet1/0/21

 port link-mode route

#

interface GigabitEthernet1/0/22

 port link-mode route

#

interface GigabitEthernet1/0/23

 port link-mode route

#

interface GigabitEthernet1/0/24

 port link-mode route

#

interface GigabitEthernet1/0/25

 port link-mode route

#

interface M-GigabitEthernet1/0/0

 ip address 192.168.0.1 255.255.255.0

#

interface Ten-GigabitEthernet1/0/26

 port link-mode route

#

interface Ten-GigabitEthernet1/0/27

 port link-mode route

#

interface SSLVPN-AC0

 ip address 10.61.0.254 255.255.255.0

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/14

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/15

 import interface SSLVPN-AC0

#

security-zone name Management

 import interface M-GigabitEthernet1/0/0

#

 scheduler logfile size 16

#

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 124.165.196.1

 ip route-static 10.10.1.4 30 10.10.1.2

 ip route-static 10.20.0.0 16 10.10.1.2

 ip route-static 10.31.0.0 16 10.10.1.2

 ip route-static 10.32.0.0 16 10.10.1.2

 ip route-static 10.33.0.0 16 10.10.1.2

 ip route-static 10.41.0.0 16 10.10.1.2

 ip route-static 10.51.0.0 16 10.10.1.2

 ip route-static 172.16.100.0 24 10.10.1.2

#

 info-center source CFGLOG loghost level informational

#

 ssh server enable

#

acl basic 2000

 rule 0 deny source 10.51.0.0 0.0.255.255

 rule 5 permit

#

acl advanced 3000

 rule 0 permit ip

#

acl advanced 3010

 rule 0 deny tcp source-port eq 135 destination-port eq 135

 rule 5 deny tcp source-port eq 137 destination-port eq 137

 rule 10 deny tcp source-port eq 138 destination-port eq 138

 rule 15 deny tcp source-port eq 139 destination-port eq 139

 rule 20 deny tcp source-port eq 445 destination-port eq 445

 rule 1000 permit ip

#

 undo password-control composition enable

 password-control length 8

 password-control composition type-number 3 type-length 1

 undo password-control complexity user-name check

#

domain system

#

domain xtl

 authentication sslvpn local

 authorization sslvpn local

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

user-group usergroup1

 authorization-attribute sslvpn-policy-group pgroup

#

local-user admin class manage

 password hash $h$6$x1sfhGJcTTGDfsQY$YSknQ9Zu9tWQPW/Bj6W4pDK8LRhA5sRRgfGrrdrV12S/TRQBQjROybYZ2XKS42yno3Fdb++H0pCSLJxi7yx+rA==

 service-type ssh telnet terminal http https

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

local-user baby class network

 password cipher $c$3$JYlMpg6ncb5ebdj0HN46GtEhwetFKfY=

 service-type sslvpn

 group usergroup1

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

pki domain sslvpn

 public-key rsa general name sslvpn

 undo crl check enable

#

 ftp server enable

#

 session statistics enable

#

 ike logging negotiation enable

#

 ip https port 64400

 ip http enable

 ip https enable

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

sslvpn ip address-pool ippool 10.61.0.1 10.61.0.100

#

sslvpn gateway gw

 ip address 124.165.233.210 port 65500

 service enable

#

sslvpn context ctx1

 gateway gw

 ip-tunnel interface SSLVPN-AC0

 ip-tunnel address-pool ippool mask 255.255.255.0

 ip-route-list iplist

  include 10.20.0.15 255.255.255.255

  include 10.20.3.254 255.255.255.255

 policy-group pgroup

  filter ip-tunnel acl 3000

  ip-tunnel access-route ip-route-list iplist

 default-policy-group pgroup

 service enable

#

uapp-control

 policy name 应用审计 audit

  rule 1 any behavior any bhcontent any keyword include any action permit audit-logging

#

security-policy ip

 rule 1 name trust-Local

  action pass

  counting enable

  source-zone trust

  destination-zone Local

  service pingv6

  service ping

  service telnet

  service ssh

  service https

 rule 4 name block-10.51-out

  logging enable

  counting enable

  source-zone trust

  destination-zone untrust

  source-ip-subnet 10.51.0.0 255.255.0.0

 rule 10 name 1111

  action pass

  logging enable

  counting enable

  source-zone Trust

  destination-zone Trust

 rule 9 name Local-untrust-2

  action pass

  counting enable

  source-zone Local

  destination-zone untrust

 rule 8 name Local-trust-2

  action pass

  counting enable

  source-zone Local

  destination-zone trust

 rule 7 name trust-untrust-2

  action pass

  counting enable

  source-zone trust

  destination-zone untrust

 rule 2 name block-untrust-to-10.51

  logging enable

  counting enable

  source-zone untrust

  destination-zone trust

  destination-ip-subnet 10.51.0.0 255.255.0.0

 rule 3 name untrust-trust

  logging enable

  counting enable

  source-zone untrust

  destination-zone trust

#

dac log-collect service dpi traffic enable

dac traffic-statistic application enable

#

 cloud-management server domain opstunnel-seccloud.h3c.com

#

return

<xtlzx_OUT_f1000>