376
ActiveX blocking
ActiveX blocking can protect networks from being attacked by malicious ActiveX plugins.
After the ActiveX blocking function is enabled, requests for ActiveX plugins to all webpages are filtered.
If the ActiveX plugins in some webpages are expected, configure ACL rules to permit requests to the
ActiveX plugins of these webpages.
Processing procedure
•
If the ActiveX blocking function is enabled but no ACL is configured for it, the router replaces suffix
".ocx" with ".block" in all web requests and then forwards the requests.
•
If the ActiveX blocking function is enabled and an ACL is configured for it, the router determines
whether to replaces suffix ".ocx" with ".block" in web requests according to the ACL rules. If the
destination server in a web request is a server permitted by the ACL, no replacement occurs, and
the request is forwarded. Otherwise, the suffix is replaced with ".block," and then the request is
forwarded.
•
In addition to the default suffix ".ocx," add ActiveX blocking suffixes (that is, the filename suffixes to
be replaced in web requests) through command lines.
Configuring web filtering
IP address-supported URL filtering can take effect only after the URL address filtering is enabled. URL
parameter filtering, Java blocking, and ActiveX blocking can be enabled independently.
Configuring URL address filtering
To do...
Command...
Remarks
1.
Enter system view.
system-view
—
2.
Enable the URL address
filtering function.
firewall http url-filter host enable
Required.
Disabled by default.
3.
Specify the default filtering
action.
firewall http url-filter host default
{
deny
|
permit
}
Optional.
deny
by default.
4.
Add a URL address filtering
entry.
firewall http url-filter host url-
address
{
deny
|
permit
}
url-
address
Required.
5.
Display information about
URL address filtering.
display firewall http url-filter host
[
all
|
item
keywords
|
verbose
] [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Optional.
