Example for Preventing Instant Messaging Software
Networking Requirements
As shown in Figure 11-4, a school lab connects to the Internet through the Router as the gateway. Students are not allowed to use instant messaging software such as QQ and MSN in the lab.
Configuration Roadmap
The configuration roadmap is as follows:
Enable deep security defense and load a signature file.
Configure a traffic classifier and define a matching rule based on the Instant_Messaging protocol group. The Instant_Messaging protocol group defines commonly usedInstant_Messaging software.
Configure a traffic behavior to denyInstant_Messaging packets.
Configure a traffic policy and bind the traffic classifier and traffic behavior to the traffic policy.
Apply the traffic policy to the inbound direction of the WAN interface and enable the SA statistics function on the interface for the SAC configurations to take effect.
Procedure
- Enable deep security defense and load a signature file.
<Huawei> system-view [Huawei] sysname Router [Router] engine enable
- Configure a traffic classifier and define a matching rule
based on the Instant_Messaging protocol group.
[Router] traffic classifier im [Router-classifier-im] if-match category Instant_Messaging [Router-classifier-im] quit
- Configure a traffic behavior to filter Instant_Messaging
packets.
[Router] traffic behavior im [Router-behavior-im] deny [Router-behavior-im] quit
- Configure a traffic policy and bind the traffic classifier
and traffic behavior to the traffic policy.
[Router] traffic policy im [Router-trafficpolicy-im] classifier im behavior im [Router-trafficpolicy-im] quit
- Apply the traffic policy to the inbound direction of WAN-side
Layer 3 interface GE2/0/0 and enable the SA statistics function on the interface for the SAC
configurations to take effect.
[Router] interface gigabitethernet 2/0/0 [Router-GigabitEthernet2/0/0] traffic-policy im inbound [Router-GigabitEthernet2/0/0] sa application-statistic enable [Router-GigabitEthernet2/0/0] quit
- Run the display current-configuration command to check the configuration.
Configuration Files
Configuration file of the Router
# sysname Router # engine enable # traffic classifier im operator or if-match category Instant_Messaging # traffic behavior im deny # traffic policy im classifier im behavior im # interface GigabitEthernet2/0/0 traffic-policy im inbound sa application-statistic enable # return
