Cisco ASA 5508-X, Руководство по настройке

Страница: 292 / 428

13-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 13 Inspection of Basic Internet Protocols
HTTP Inspection
•
match [ not ] response header { length gt bytes | count gt number | non-ascii }—Matches the
overall length of the HTTP response message header, or the overall number of fields (count) in
the header, or headers that have non-ASCII characters.
• match [ not ] response status-line regex { regex_name | class class_name }—Matches text found
in the HTTP response message status line against the specified regular expression or regular
expression class.
d.
Enter exit to leave class map configuration mode.
Step 2 Create an HTTP inspection policy map:
hostname(config)# policy-map type inspect http policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 3 (Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)# description string
Step 4
To apply actions to matching traffic, perform the following steps.
a. Specify the traffic on which you want to perform actions using one of the following methods:
•
If you created an HTTP class map, specify it by entering the following command:
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
• Specify traffic directly in the policy map using one of the match commands described for HTTP
class maps. If you use a match not command, then any traffic that does not match the criterion
in the match not command has the action applied.
b.
Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {
drop-connection
[
log
]|
reset
[
log
] |
log
}
The drop-connection keyword drops the packet and closes the connection.
The reset keyword drops the packet, closes the connection, and sends a TCP reset to the server or
client.
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.
You can specify multiple class or match commands in the policy map. For information about the order
of class and match commands, see How Multiple Traffic Classes are Handled, page 12-4 .
Step 5 To configure parameters that affect the inspection engine, perform the following steps:
a.
To enter parameters configuration mode, enter the following command:
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
b. Set one or more parameters. You can set the following options; use the no form of the command to
disable the option:
•
body-match-maximum number —Sets the maximum number of characters in the body of an
HTTP message that should be searched in a body match. The default is 200 bytes. A large
number will have a significant impact on performance.