Identifying Traffic In An Inspection Class Map - Cisco PIX 500 Series Configuration Manual

Configuring Special Actions for Application Inspections

Identifying Traffic in an Inspection Class Map

This type of class map allows you to match criteria that is specific to an application. For example, for
DNS traffic, you can match the domain name in a DNS query.
Not all applications support inspection class maps. See the CLI help for a list of supported applications.
Note
A class map groups multiple traffic matches (in a match-all class map), or lets you match any of a list of
matches (in a match-any class map). The difference between creating a class map and defining the traffic
match directly in the inspection policy map is that the class map lets you group multiple match
commands, and you can reuse class maps. For the traffic that you identify in this class map, you can
specify actions such as dropping, resetting, and/or logging the connection in the inspection policy map.
If you want to perform different actions on different types of traffic, you should identify the traffic
directly in the policy map.
To define an inspection class map, perform the following steps:
Create a class map by entering the following command:
Step 1
hostname(config)# class-map type inspect application [match-all | match-any]
class_map_name
hostname(config-cmap)#
Where the application is the application you want to inspect. For supported applications, see the CLI
help for a list of supported applications or see
Inspection."
The class_map_name argument is the name of the class map up to 40 characters in length.
The match-all keyword is the default, and specifies that traffic must match all criteria to match the class
map.
The match-any keyword specifies that the traffic matches the class map if it matches at least one of the
criteria.
The CLI enters class-map configuration mode, where you can enter one or more match commands.
(Optional) To add a description to the class map, enter the following command:
Step 2
hostname(config-cmap)# description string
Define the traffic to include in the class by entering one or more match commands available for your
Step 3
application.
To specify traffic that should not match the class map, use the match not command. For example, if the
match not command specifies the string "example.com," then any traffic that includes "example.com"
does not match the class map.
To see the match commands available for each application, see
Layer Protocol Inspection."
The following example creates an HTTP class map that must match all criteria:
hostname(config-cmap)# class-map type inspect http match-all http-traffic
hostname(config-cmap)# match req-resp content-type mismatch
hostname(config-cmap)# match request body length gt 1000
hostname(config-cmap)# match not request uri regex class URLs
Cisco Security Appliance Command Line Configuration Guide
21-10
Chapter 21
Chapter 25, "Configuring Application Layer Protocol
Chapter 25, "Configuring Application
Using Modular Policy Framework
OL-12172-03