Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 357)

100

101

21-31

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing HTTP Inspection

Note When you enable HTTP inspection with an HTTP map, strict HTTP inspection with the action reset and

log is enabled by default. You can change the actions performed in response to inspection failure, but

you cannot disable strict inspection as long as the HTTP map remains enabled.

Enabling and Configuring Advanced HTTP Inspection

Use the procedures in this section to change the default HTTP configuration, in any of the following

ways:

• Enable enhanced HTTP inspection (application firewall)

• Change the default configuration for enhanced HTTP inspection

• Change the default port number

To enable or configure enhanced HTTP inspection, perform the following steps:

Step 1 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map http_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 2 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match port tcp eq 80

hostname(config-cmap)# exit

hostname(config)#

To assign a range of continuous ports, enter the range keyword, as in the following example:

hostname(config-cmap)# match port tcp range 1080-1090

To assign more than one non-contiguous port for HTTP inspection, enter the access-list command and

define an access control entry to match each port. Then enter the match command to associate the access

lists with the HTTP traffic class.

Step 3 Create an HTTP map by entering the following command:

hostname(config)# http-map

http_map_name

Replace http_map_name with the name of the HTTP map, for example:

hostname(config)# http-map inbound_http

The system enters HTTP map configuration mode and the CLI prompt changes as in the following

example:

hostname(config-http-map)#

Step 4 Change the default configuration as required by entering any of the supported HTTP map configuration

commands, summarized in Table 21-5.

1 2 ... 352 353 354 355 356 357 358 359 360 361 362 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 357

Komentarze do niniejszej Instrukcji