Applying Inspection To Http Traffic With Nat - Cisco FirePOWER ASA 5500 series Configuration Manual

Modular Policy Framework Examples

Applying Inspection to HTTP Traffic with NAT

In this example, the Host on the inside network has two addresses: one is the real IP address 192.168.1.1,
and the other is a mapped IP address used on the outside network, 209.165.200.225. Because the policy
is applied to the inside interface, where the real address is used, then you must use the real IP address in
the access list in the class map. If you applied it to the outside interface, you would use the mapped
address.
Figure 21-4
Mapped IP: 209.165.200.225
See the following commands for this example:
hostname(config)# static (inside,outside) 209.165.200.225 192.168.1.1
hostname(config)# access-list http_client extended permit tcp host 192.168.1.1 any eq 80
hostname(config)# class-map http_client
hostname(config-cmap)# match access-list http_client
hostname(config)# policy-map http_client
hostname(config-pmap)# class http_client
hostname(config-pmap-c)# inspect http
hostname(config)# service-policy http_client interface inside
Cisco Security Appliance Command Line Configuration Guide
21-20
HTTP Inspection with NAT
insp.
Host
Real IP: 192.168.1.1
Security
appliance
port 80
inside
Chapter 21 Using Modular Policy Framework
outside
Server
209.165.201.1
OL-10088-01