Applying Inspection To Http Traffic With Nat - Cisco PIX 500 Series Configuration Manual

Chapter 21 Using Modular Policy Framework
Modular Policy Framework Examples

Applying Inspection to HTTP Traffic with NAT

In this example, the Host on the inside network has two addresses: one is the real IP address 192.168.1.1,
and the other is a mapped IP address used on the outside network, 209.165.200.225. Because the policy
is applied to the inside interface, where the real address is used, then you must use the real IP address in
the access list in the class map. If you applied it to the outside interface, you would use the mapped
address.
Figure 21-4 HTTP Inspection with NAT
Security
appliance
port 80
insp.
inside outside
Host
Server
Real IP: 192.168.1.1
209.165.201.1
Mapped IP: 209.165.200.225
See the following commands for this example:
hostname(config)# static (inside,outside) 209.165.200.225 192.168.1.1
hostname(config)# access-list http_client extended permit tcp host 192.168.1.1 any eq 80
hostname(config)# class-map http_client
hostname(config-cmap)# match access-list http_client
hostname(config)# policy-map http_client
hostname(config-pmap)# class http_client
hostname(config-pmap-c)# inspect http
hostname(config)# service-policy http_client interface inside
Cisco Security Appliance Command Line Configuration Guide
21-22
OL-12172-03