H3C S5500-SI Series, Operation Manual

Page: 961 / 1217

7-6
Controlling Web Users by Source IP Addresses
The S5500-SI series Ethernet switches support Web-based remote management, which allows Web
users to access the switches using the HTTP protocol. By referencing access control lists (ACLs), you
can control the access of Web users to the switches.
Prerequisites
The control policies to be implemented on Web users are decided, including the source IP addresses to
be controlled and the control action, that is, whether to allow or deny the access.
Controlling Web Users by Source IP Addresses
This feature is achieved through the configuration of basic ACLs, the numbers of which are in the range
2000 to 2999. For the definition of ACLs, see ACL Configuration in the Security Volume .
Follow these steps to configure controlling Web users by source IP addresses:
To do… Use the command… Remarks
Enter system view system-view —
Create a basic ACL or enter
basic ACL view acl [ ipv6 ] number acl-number
[ match-order { config | auto } ]
Required
The config keyword is
specified by default.
Define rules for the ACL
rule [ rule-id ] { permit | deny } [ source
{ sour-addr sour-wildcard | any } |
time-range time-name | fragment |
logging ]*
Required
Quit to system view quit —
Reference the ACL to control
Web users
ip http acl acl-number Required
Forcing Online Web Users Offline
The network administrators can run a command to force online Web users offline.
Perform the following operation to force online Web users offline:
To do… Use the command… Remarks
Force online Web users offline
free web-users { all | user-id user-id |
user-name user-name }
Required
Use this command in
user view
Configuration Example
Network requirements
Configure a basic ACL to allow only Web users using IP address 10.110.100.52 to access the switch.