Applying Inspection And Connection Limits To Http Traffic To Specific Servers - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 21 Using Modular Policy Framework
hostname(config)# policy-map http_traffic_policy
hostname(config-pmap)# class http_traffic
hostname(config-pmap-c)# inspect http
hostname(config)# service-policy http_traffic_policy global

Applying Inspection and Connection Limits to HTTP Traffic to Specific Servers

In this example (see
that enters the security appliance through the outside interface is classified for HTTP inspection and
maximum connection limits. Connections initiated from server A to Host A does not match the access
list in the class map, so it is not affected.
Any HTTP connection destined for Server B that enters the security appliance through the inside
interface is classified for HTTP inspection. Connections initiated from server B to Host B does not match
the access list in the class map, so it is not affected.
Figure 21-3
Mapped Address: 209.165.201.2: port
See the following commands for this example:
hostname(config)# static (inside,outside) 209.165.201.1 192.168.1.2
hostname(config)# nat (inside) 1 192.168.1.0 255.255.255.0
hostname(config)# global (outside) 1 209.165.201.2
hostname(config)# access-list serverA extended permit tcp any host 209.165.201.1 eq 80
hostname(config)# access-list ServerB extended permit tcp any host 209.165.200.227 eq 80
hostname(config)# class-map http_serverA
hostname(config-cmap)# match access-list serverA
hostname(config)# class-map http_serverB
hostname(config-cmap)# match access-list serverB
hostname(config)# policy-map policy_serverA
hostname(config-pmap)# class http_serverA
hostname(config-pmap-c)# inspect http
hostname(config-pmap-c)# set connection conn-max 100
hostname(config)# policy-map policy_serverB
hostname(config-pmap)# class http_serverB
hostname(config-pmap-c)# inspect http
hostname(config)# service-policy policy_serverB interface inside
hostname(config)# service-policy policy_serverA interface outside
OL-10088-01
Figure 21-3), any HTTP connection destined for Server A (TCP traffic on port 80)
HTTP Inspection and Connection Limits to Specific Servers
Server A
Real Address: 192.168.1.2
Mapped Address: 209.165.201.1
Host B
Real Address: 192.168.1.1
Security
appliance
port 80
insp.
inside
Cisco Security Appliance Command Line Configuration Guide
Modular Policy Framework Examples
insp.
port 80
set conns
Host A
209.165.200.226
outside
Server B
209.165.200.227
21-19