7-18
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 7 Inspection of Basic Internet Protocols
HTTP Inspection
•
match
[
not
]
response header
{
length
gt
bytes
|
count
gt
number
|
non-ascii
}—Matches the
overall length of the HTTP response message header, or the overall number of fields (count) in
the header, or headers that have non-ASCII characters.
•
match
[
not
]
response status-line regex
{
regex_name
|
class
class_name
}—Matches text found
in the HTTP response message status line against the specified regular expression or regular
expression class.
d.
Enter
exit
to leave class map configuration mode.
Step 2
Create an HTTP inspection policy map:
hostname(config)#
policy-map type inspect http
policy_map_name
hostname(config-pmap)#
Where the
policy_map_name
is the name of the policy map. The CLI enters policy-map configuration
mode.
Step 3
(Optional) To add a description to the policy map, enter the following command:
hostname(config-pmap)#
description
string
Step 4
To apply actions to matching traffic, perform the following steps.
a.
Specify the traffic on which you want to perform actions using one of the following methods:
•
If you created an HTTP class map, specify it by entering the following command:
hostname(config-pmap)#
class
class_map_name
hostname(config-pmap-c)#
•
Specify traffic directly in the policy map using one of the
match
commands described for HTTP
class maps. If you use a
match not
command, then any traffic that does not match the criterion
in the
match not
command has the action applied.
b.
Specify the action you want to perform on the matching traffic by entering the following command:
hostname(config-pmap-c)# {
drop-connection
[
log
]|
reset
[
log
] |
log
}
The
drop-connection
keyword drops the packet and closes the connection.
The
reset
keyword drops the packet, closes the connection, and sends a TCP reset to the server or
client.
The
log
keyword, which you can use alone or with one of the other keywords, sends a system log
message.
You can specify multiple
class
or
match
commands in the policy map. For information about the order
of
class
and
match
commands, see
Defining Actions in an Inspection Policy Map, page 2-4
.
Step 5
To configure parameters that affect the inspection engine, perform the following steps:
a.
To enter parameters configuration mode, enter the following command:
hostname(config-pmap)#
parameters
hostname(config-pmap-p)#
b.
Set one or more parameters. You can set the following options; use the
no
form of the command to
disable the option:
•
body-match-maximum
number
—Sets the maximum number of characters in the body of an
HTTP message that should be searched in a body match. The default is 200 bytes. A large
number will have a significant impact on performance.
Содержание ASA 5512-X
Страница 5: ...P A R T 1 Service Policies and Access Control ...
Страница 6: ......
Страница 50: ...3 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 3 Access Rules History for Access Rules ...
Страница 51: ...P A R T 2 Network Address Translation ...
Страница 52: ......
Страница 126: ...5 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 5 NAT Examples and Reference DNS and NAT ...
Страница 127: ...P A R T 3 Application Inspection ...
Страница 128: ......
Страница 255: ...P A R T 4 Connection Settings and Quality of Service ...
Страница 256: ......
Страница 288: ...12 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 12 Quality of Service History for QoS ...
Страница 303: ...P A R T 5 Advanced Network Protection ...
Страница 304: ......
Страница 339: ...P A R T 6 ASA Modules ...
Страница 340: ......
Страница 398: ...17 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 17 ASA CX Module History for the ASA CX Module ...