Cisco 7604 Configuration Guide - Page 386

Configuring Special Actions for Application Inspections (Inspection Policy Map) Chapter 20 Using Modular Policy Framework hostname(config)# regex url_example example\.com hostname(config)# regex url_example2 example2\.com hostname(config)# class-map type regex match-any URLs hostname(config-cmap)# match regex url_example hostname(config-cmap)# match regex url_example2 hostname(config-cmap)# class-map type inspect http match-all http-traffic hostname(config-cmap)# match req-resp content-type mismatch hostname(config-cmap)# match request body length gt 1000 hostname(config-cmap)# match not request uri regex class URLs hostname(config-cmap)# policy-map type inspect http http-map1 hostname(config-pmap)# class http-traffic hostname(config-pmap-c)# drop-connection log hostname(config-pmap-c)# match req-resp content-type mismatch hostname(config-pmap-c)# reset log hostname(config-pmap-c)# parameters hostname(config-pmap-p)# protocol-violation action log hostname(config-pmap-p)# policy-map test hostname(config-pmap)# class test (a Layer 3/4 class map not shown) hostname(config-pmap-c)# inspect http http-map1 hostname(config-pmap-c)# service-policy test interface outside Identifying Traffic in an Inspection Class Map This type of class map allows you to match criteria that is specific to an application. For example, for HTTP traffic, you can match a particular URL. Note Not all applications support inspection class maps. See the CLI help for a list of supported applications. A class map groups multiple traffic matches (in a match-all class map), or lets you match any of a list of matches (in a match-any class map). The difference between creating a class map and defining the traffic match directly in the inspection policy map is that the class map lets you group multiple match commands, and you can reuse class maps. For the traffic that you identify in this class map, you can specify actions such as dropping, resetting, and/or logging the connection in the inspection policy map. If you want to perform different actions on different types of traffic, you should identify the traffic directly in the policy map. The maximum number of class maps ( Layer 3/4, inspection, and regular expression) is 255 in single mode or per context in multiple mode. This limit includes default class maps. See the "Default Class Maps" section on page 20-4. To define an inspection class map, perform the following steps: Step 1 Step 2 (Optional) If you want to match based on a regular expression, see the "Creating a Regular Expression" section on page 20-11 and the "Creating a Regular Expression Class Map" section on page 20-14. Create a class map by entering the following command: hostname(config)# class-map type inspect application [match-all] class_map_name hostname(config-cmap)# 20-10 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01