Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 386 / 742

20-10
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 20 Using Modular Policy Framework
Configuring Special Actions for Application Inspections (Inspection Policy Map)
hostname(config)# regex url_example example\.com
hostname(config)# regex url_example2 example2\.com
hostname(config)# class-map type regex match-any URLs
hostname(config-cmap)# match regex url_example
hostname(config-cmap)# match regex url_example2
hostname(config-cmap)# class-map type inspect http match-all http-traffic
hostname(config-cmap)# match req-resp content-type mismatch
hostname(config-cmap)# match request body length gt 1000
hostname(config-cmap)# match not request uri regex class URLs
hostname(config-cmap)# policy-map type inspect http http-map1
hostname(config-pmap)# class http-traffic
hostname(config-pmap-c)# drop-connection log
hostname(config-pmap-c)# match req-resp content-type mismatch
hostname(config-pmap-c)# reset log
hostname(config-pmap-c)# parameters
hostname(config-pmap-p)# protocol-violation action log
hostname(config-pmap-p)# policy-map test
hostname(config-pmap)# class test
(a Layer 3/4 class map not shown)
hostname(config-pmap-c)# inspect http http-map1
hostname(config-pmap-c)# service-policy test interface outside
Identifying Traffic in an Inspection Class Map
This type of class map allows you to match criteria that is specific to an application. For example, for
HTTP traffic, you can match a particular URL.
Note Not all applications support inspection class maps. See the CLI help for a list of supported applications.
A class map groups multiple traffic matches (in a match-all class map), or lets you match any of a list of
matches (in a match-any class map). The difference between creating a class map and defining the traffic
match directly in the inspection policy map is that the class map lets you group multiple match
commands, and you can reuse class maps. For the traffic that you identify in this class map, you can
specify actions such as dropping, resetting, and/or logging the connection in the inspection policy map.
If you want to perform different actions on different types of traffic, you should identify the traffic
directly in the policy map.
The maximum number of class maps ( Layer 3/4, inspection, and regular expression) is 255 in single
mode or per context in multiple mode. This limit includes default class maps. See the
“Default Class
Maps” section on page 20-4 .
To define an inspection class map, perform the following steps:
Step 1 (Optional) If you want to match based on a regular expression, see the “Creating a Regular Expression”
section on page 20-11 and the “Creating a Regular Expression Class Map” section on page 20-14 .
Step 2
Create a class map by entering the following command:
hostname(config)#
class-map type inspect
application [
match-all
] class_map_name
hostname(config-cmap)#