< Home

Web: Using the Blacklist/Whitelist to Control Website Access

This section provides an example for configuring blacklist/whitelist-based URL filtering to permit or deny the access to specific websites.

Networking Requirements

As shown in Figure 1, the FW is deployed at the network border as the enterprise's gateway to implement URL filtering on HTTP requests sent by users to access the Internet.

The enterprise has R&D and marketing employees. The specific networking requirements are as follows:

  • The R&D employees are whitelisted and can access only work-related URLs (www.example.com/working) and hosts (www.example.com) from 09:00 to 17:00 every day.
  • The marketing employees are blacklisted and can access all URLs excluding specific URLs (www.example.net/*) from 09:00 to 17:00 every day.
Figure 1 Using the blacklist/whitelist to control website access

Configuration Roadmap

  1. Set interface IP addresses and assign the interfaces to security zones.
  2. For R&D employees, create a URL filtering profile named profile_url_research, add whitelisted URLs (www.example.com/working) and hosts (www.example.org), and set the action to block for all predefined categories and the default action to block (if the remote query service is unavailable, the FW will take the default action to control the access to the non-whitelisted URLs).
  3. For marketing employees, create a URL filtering profile named profile_url_marketing, add blacklisted URLs (www.example.net/*), and set the action to allow for all predefined categories and the default action to allow (if the remote query service is unavailable, the FW will take the default action to control the access to the non-blacklisted URLs).
  4. Configure two security policies and reference schedules, user groups and URL filtering profiles.

Procedure

  1. Set interface IP addresses and assign the interfaces to security zones.

    1. Choose Network > Interface.

    2. Click for GE0/0/3 and set the parameters as follows:

      Zone

      trust

      IPv4

      IP Address

      10.3.0.1/24
    3. Click OK.

    4. Repeat the previous steps to set the parameters for GE0/0/1.

      Zone

      untrust

      IPv4

      IP Address

      1.1.1.1/24

  2. Configure URL filtering profiles.

    1. Choose Object > Security Profiles > URL Filtering.

    2. In URL Filtering Profile, click Add and set parameters as follows:

      Name

      profile_url_research

      Description

      URL filter profile of web access control for research.

      Default Action

      Block

      Whitelist URL

      www.example.com/working

      Whitelist Host

      www.example.org

      URL Filtering Level

      Select Custom and set the action to Block for all predefined categories.

      NOTE:

      To simplify configuration, select Block at the right side of Name in the first row to set the action to Block for all predefined categories.
    3. Click OK.

    4. In URL Filtering Profile, click Add and set parameters as follows:

      Name

      profile_url_marketing

      Description

      URL filter profile of web access control for marketing.

      Default Action

      Allow

      Blacklist URL

      www.example.net/*

      URL Filtering Level

      Select Custom and set the action to Allow for all predefined categories.

      NOTE:

      To simplify configuration, select Allow at the right side of Name in the first row to set the action to Allow for all predefined categories.
    5. Click OK.

  3. Configure schedules.

    1. Choose Object > Schedule.
    2. Click Add to create schedule time_range.

      Name

      time_range

      Type

      Periodical schedule

      Start Time

      09:00:00

      End Time

      17:00:00

      Weekly Validity Time

      Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday
    3. Click OK.

  4. Reference URL filtering profiles in security policies.

    In this example, user groups research (R&D employees) and marketing (marketing employees) to be referenced have been created.

    1. Choose Policy > Security Policy > Security Policy.

    2. Click Add Security Policy and set parameters as follows:

      Name

      policy_sec_research

      Description

      Security policy of web access protect for research.

      Source Zone

      trust

      Destination Zone

      untrust

      Source Address/Region

      10.3.0.0/24

      Destination Address/Region

      any

      User

      /default/research

      Schedule

      time_range

      Action

      permit

      Content Security

      URL Filtering

      profile_url_research
    3. Click OK.

    4. Click Add Security Policy and set parameters as follows:

      Name

      policy_sec_marketing

      Description

      Security policy of web access protect for marketing.

      Source Zone

      trust

      Destination Zone

      untrust

      Source Address/Region

      10.3.0.0/24

      Destination Address/Region

      any

      User

      /default/marketing

      Schedule

      time_range

      Action

      permit

      Content Security

      URL Filtering

      profile_url_marketing
    5. Click OK.

  5. Click Save on the upper right of the web page. In the dialog box that is displayed, click OK.
  6. Click Commit on the upper right of the web page. In the dialog box that is displayed, click OK.

Verification

  • R&D employees can access only www.example.com/working-related URLs and www.example.org-related hosts and are blocked when attempting to access other websites from 09:00 to 17:00 every day, and a message is displayed accordingly. Accessible URLs:
    • www.example.com/working/index.htm
    • www.example.com/working/todo
    • www.example.org
    • www.example.org/network
    For example:

    Choose Monitor > Log > URL Log to view URL logs. According to log information, you can see that the access requests from R&D department employees to other websites matched the URL filtering policy whose filtering type is Pre-defined and action is Block. For example:

  • Marketing employees can access only all websites, excluding www.example.net/* from 09:00 to 17:00, and a message is displayed accordingly. Inaccessible URLs:
    • www.example.net
    • www.example.net/index.html
    • www.example.net/game
    For example:

    Choose Monitor > Log > URL Log to view URL logs. According to log information, you can see that the access requests from marketing department employees to websites related to www.example.net/* matched the URL filtering policy whose filtering type is Blacklist and action is Block. For example:

Configuration Scripts

#                                                                               
 time-range time_range                                                          
  period-range 09:00:00 to 17:00:00 daily                                       
#                                                                               
interface GigabitEthernet0/0/1   
 undo shutdown
 ip address 1.1.1.1 255.255.255.0
#                                                                               
interface GigabitEthernet0/0/3   
 undo shutdown
 ip address 10.3.0.1 255.255.255.0
#                                                                               
firewall zone trust                                                             
 set priority 85                                                                
 add interface GigabitEthernet0/0/3
#                                                                               
firewall zone untrust                                                           
 set priority 5                                                                 
 add interface GigabitEthernet0/0/1
#
profile type url-filter name profile_url_research                               
 description URL filter profile of web access control for research.             
 add whitelist url www.example.com/working                                      
 add whitelist host www.example.org                                             
 category pre-defined subcategory-id 101 action block                           
 category pre-defined subcategory-id 102 action block                           
 category pre-defined subcategory-id 162 action block                           
 category pre-defined subcategory-id 163 action block                           
 category pre-defined subcategory-id 164 action block                           
 category pre-defined subcategory-id 165 action block                           
 category pre-defined subcategory-id 103 action block                           
 category pre-defined subcategory-id 166 action block                           
 category pre-defined subcategory-id 167 action block                           
 category pre-defined subcategory-id 168 action block                           
 category pre-defined subcategory-id 104 action block                           
 category pre-defined subcategory-id 169 action block                           
 category pre-defined subcategory-id 170 action block                           
 category pre-defined subcategory-id 105 action block                           
 category pre-defined subcategory-id 171 action block                           
 category pre-defined subcategory-id 172 action block                           
 category pre-defined subcategory-id 173 action block                           
 category pre-defined subcategory-id 174 action block                           
 category pre-defined subcategory-id 106 action block                           
 category pre-defined subcategory-id 108 action block                           
 category pre-defined subcategory-id 177 action block                           
 category pre-defined subcategory-id 251 action block                           
 category pre-defined subcategory-id 109 action block                           
 category pre-defined subcategory-id 110 action block                           
 category pre-defined subcategory-id 111 action block                           
 category pre-defined subcategory-id 112 action block                           
 category pre-defined subcategory-id 114 action block                           
 category pre-defined subcategory-id 115 action block                           
 category pre-defined subcategory-id 117 action block                           
 category pre-defined subcategory-id 178 action block                           
 category pre-defined subcategory-id 179 action block                           
 category pre-defined subcategory-id 180 action block                           
 category pre-defined subcategory-id 181 action block                           
 category pre-defined subcategory-id 118 action block                           
 category pre-defined subcategory-id 119 action block                           
 category pre-defined subcategory-id 122 action block                           
 category pre-defined subcategory-id 182 action block                           
 category pre-defined subcategory-id 183 action block                           
 category pre-defined subcategory-id 184 action block                           
 category pre-defined subcategory-id 247 action block                           
 category pre-defined subcategory-id 248 action block                           
 category pre-defined subcategory-id 249 action block                           
 category pre-defined subcategory-id 250 action block                           
 category pre-defined subcategory-id 123 action block                           
 category pre-defined subcategory-id 124 action block                           
 category pre-defined subcategory-id 186 action block                           
 category pre-defined subcategory-id 187 action block                           
 category pre-defined subcategory-id 188 action block                           
 category pre-defined subcategory-id 189 action block                           
 category pre-defined subcategory-id 125 action block                           
 category pre-defined subcategory-id 126 action block                           
 category pre-defined subcategory-id 190 action block                           
 category pre-defined subcategory-id 127 action block                           
 category pre-defined subcategory-id 128 action block                           
 category pre-defined subcategory-id 129 action block                           
 category pre-defined subcategory-id 191 action block                           
 category pre-defined subcategory-id 192 action block                           
 category pre-defined subcategory-id 193 action block                           
 category pre-defined subcategory-id 194 action block                           
 category pre-defined subcategory-id 195 action block                           
 category pre-defined subcategory-id 196 action block                           
 category pre-defined subcategory-id 130 action block                           
 category pre-defined subcategory-id 131 action block                           
 category pre-defined subcategory-id 132 action block                           
 category pre-defined subcategory-id 197 action block                           
 category pre-defined subcategory-id 198 action block                           
 category pre-defined subcategory-id 199 action block                           
 category pre-defined subcategory-id 200 action block                           
 category pre-defined subcategory-id 227 action block                           
 category pre-defined subcategory-id 228 action block                           
 category pre-defined subcategory-id 133 action block                           
 category pre-defined subcategory-id 201 action block                           
 category pre-defined subcategory-id 202 action block                           
 category pre-defined subcategory-id 204 action block                           
 category pre-defined subcategory-id 205 action block                           
 category pre-defined subcategory-id 134 action block                           
 category pre-defined subcategory-id 135 action block                           
 category pre-defined subcategory-id 136 action block                           
 category pre-defined subcategory-id 137 action block                           
 category pre-defined subcategory-id 138 action block                           
 category pre-defined subcategory-id 139 action block                           
 category pre-defined subcategory-id 140 action block                           
 category pre-defined subcategory-id 141 action block                           
 category pre-defined subcategory-id 206 action block                           
 category pre-defined subcategory-id 207 action block                           
 category pre-defined subcategory-id 208 action block                           
 category pre-defined subcategory-id 209 action block                           
 category pre-defined subcategory-id 210 action block                           
 category pre-defined subcategory-id 229 action block                           
 category pre-defined subcategory-id 142 action block                           
 category pre-defined subcategory-id 143 action block                           
 category pre-defined subcategory-id 144 action block                           
 category pre-defined subcategory-id 145 action block                           
 category pre-defined subcategory-id 146 action block                           
 category pre-defined subcategory-id 147 action block                           
 category pre-defined subcategory-id 211 action block                           
 category pre-defined subcategory-id 212 action block                           
 category pre-defined subcategory-id 213 action block                           
 category pre-defined subcategory-id 240 action block                           
 category pre-defined subcategory-id 253 action block                           
 category pre-defined subcategory-id 149 action block                           
 category pre-defined subcategory-id 150 action block                           
 category pre-defined subcategory-id 214 action block                           
 category pre-defined subcategory-id 215 action block                           
 category pre-defined subcategory-id 216 action block                           
 category pre-defined subcategory-id 217 action block                           
 category pre-defined subcategory-id 151 action block                           
 category pre-defined subcategory-id 218 action block                           
 category pre-defined subcategory-id 219 action block                           
 category pre-defined subcategory-id 220 action block                           
 category pre-defined subcategory-id 221 action block                           
 category pre-defined subcategory-id 222 action block                           
 category pre-defined subcategory-id 223 action block                           
 category pre-defined subcategory-id 230 action block                           
 category pre-defined subcategory-id 252 action block                           
 category pre-defined subcategory-id 152 action block                           
 category pre-defined subcategory-id 153 action block                           
 category pre-defined subcategory-id 238 action block                           
 category pre-defined subcategory-id 154 action block                           
 category pre-defined subcategory-id 155 action block                           
 category pre-defined subcategory-id 224 action block                           
 category pre-defined subcategory-id 225 action block                           
 category pre-defined subcategory-id 156 action block                           
 category pre-defined subcategory-id 157 action block                           
 category pre-defined subcategory-id 158 action block                           
 category pre-defined subcategory-id 231 action block                           
 category pre-defined subcategory-id 232 action block                           
 category pre-defined subcategory-id 159 action block                           
 category pre-defined subcategory-id 254 action block                           
 category pre-defined subcategory-id 160 action block                           
 category pre-defined subcategory-id 161 action block                           
 category pre-defined subcategory-id 176 action block                           
 category pre-defined subcategory-id 226 action block                           
 category pre-defined subcategory-id 234 action block                           
 category pre-defined subcategory-id 235 action block                           
 category pre-defined subcategory-id 236 action block                           
 category pre-defined subcategory-id 237 action block                           
 category pre-defined subcategory-id 239 action block                           
 category pre-defined subcategory-id 241 action block                           
 category pre-defined subcategory-id 233 action block                           
 default action block
profile type url-filter name profile_url_marketing                              
 description URL filter profile of web access control for marketing.            
 add blacklist url www.example.net/*                                            
#                                                                               
security-policy                                                                 
 rule name policy_sec_research                                                  
  description Security policy of web access protect for research.               
  source-zone trust                                                             
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  user user-group /default/research                                             
  time-range time_range                                                         
  profile url-filter profile_url_research                                       
  action permit                                                                 
 rule name policy_sec_marketing                                                 
  description Security policy of web access protect for marketing.              
  source-zone trust                                                             
  destination-zone untrust                                                      
  source-address 10.3.0.0 mask 255.255.255.0
  user user-group /default/marketing                                            
  time-range time_range                                                         
  profile url-filter profile_url_marketing                                      
  action permit
Parent Topic: Content Security
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >