13-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 13 Inspection of Basic Internet Protocols
HTTP Inspection
•
match
[
not
]
response header
{
length
gt
bytes
|
count
gt
number
|
non-ascii
}—Matches the
overall length of the HTTP response message header, or the overall number of fields (count) in
the header, or headers that have non-ASCII characters.
•
match
[
not
]
response status-line regex
{
regex_name
|
class
class_name
}—Matches text found
in the HTTP response message status line against the specified regular expression or regular
expression class.
d.
Enter
exit
to leave class map configuration mode.
Step 2
Create an HTTP inspection policy map:
hostname(config)#
policy-map type inspect http
policy_map_name
hostname(config-pmap)#
Where the
policy_map_name
is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 3
(Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)#
description
string
Step 4
To apply actions to matching traffic, perform the following steps.
a.
Specify the traffic on which you want to perform actions using one of the following methods:
•
If you created an HTTP class map, specify it by entering the following command:
hostname(config-pmap)#
class
class_map_name
hostname(config-pmap-c)#
•
Specify traffic directly in the policy map using one of the
match
commands described for HTTP
class maps. If you use a
match not
command, then any traffic that does not match the criterion
in the
match not
command has the action applied.
b.
Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {
drop-connection
[
log
]|
reset
[
log
] |
log
}
The
drop-connection
keyword drops the packet and closes the connection.
The
reset
keyword drops the packet, closes the connection, and sends a TCP reset to the server or
client.
The
log
keyword, which you can use alone or with one of the other keywords, sends a system log
message.
You can specify multiple
class
or
match
commands in the policy map. For information about the order
of
class
and
match
commands, see
How Multiple Traffic Classes are Handled, page 12-4
Step 5
To configure parameters that affect the inspection engine, perform the following steps:
a.
To enter parameters configuration mode, enter the following command:
hostname(config-pmap)#
parameters
hostname(config-pmap-p)#
b.
Set one or more parameters. You can set the following options; use the
no
form of the command to
disable the option:
•
body-match-maximum
number
—Sets the maximum number of characters in the body of an
HTTP message that should be searched in a body match. The default is 200 bytes. A large
number will have a significant impact on performance.
Summary of Contents for ASA 5508-X
Page 11: ...P A R T 1 Access Control ...
Page 12: ......
Page 157: ...P A R T 2 Network Address Translation ...
Page 158: ......
Page 233: ...P A R T 3 Service Policies and Application Inspection ...
Page 234: ......
Page 379: ...P A R T 4 Connection Management and Threat Detection ...
Page 380: ......