759Usage guidelinesYou can specify both an advanced ACL and a URI ACL for TCP access filtering.For mobile client users, the SSL VPN gateway uses the following procedure to determine whether toforward a TCP access request:1. Matches the request against the authorized port forwarding list. If the request matches a port forwarding entry in the list, the gateway forwards the request. If the request does not match any port forwarding entries in the list, the gateway proceeds tostep 2.2. Matches the request against the rules in the URI ACL: If the request matches a permit rule, the gateway forwards the request. If the request matches a deny rule, the gateway drops the request. If the request does not match any rules in the URI ACL or if no URI ACL is available, thegateway proceeds to step 3.3. Matches the request against the rules in the advanced ACL: If the request matches a permit rule, the gateway forwards the request. If the request matches a deny rule, the gateway drops the request. If the request does not match any rules in the advanced ACL or if no advanced ACL isavailable, the gateway drops the request.For PC users, the ACLs configured for TCP access filtering do not take effect. They can access onlythe TCP resources authorized to them through the TCP port forwarding list.You can specify an IPv4 ACL, IPv6 ACL, or both by using this command, but you cannot specifymultiple IPv4 ACLs or IPv6 ACLs. If you specify IPv4 or IPv6 ACLs multiple times, the most recentIPv4 or IPv6 ACL configuration takes effect.Examples# Configure policy group pg1 to use IPv4 ACL 3000 and IPv6 ACL 3500 for TCP access filtering. system-view[Sysname]sslvpn context ctx1[Sysname-sslvpn-context-ctx1] policy-group pg1[Sysname-sslvpn-context-ctx1-policy-group pg1] filter tcp-access acl 3000[Sysname-sslvpn-context-ctx1-policy-group pg1] filter tcp-access ipv6 acl 3500Related commandsfilter tcp-access uri-aclfilter tcp-access uri-aclUse filter tcp-access uri-acl to specify a URI ACL for TCP access filtering.Use undo filter tcp-access uri-acl to remove the URI ACL configuration for TCP access filtering.Syntaxfilter tcp-access uri-acl uri-acl-nameundo filter tcp-access uri-aclDefaultA user can access only the TCP resources in the TCP port forwarding list authorized to the user.ViewsSSL VPN policy group view
