Cisco ASA 5506-X Configuration Manual page 165

Chapter 7 Inspection of Basic Internet Protocols
Example
The following example shows how to define an HTTP inspection policy map that will allow and log any
HTTP connection that attempts to access "www\.xyz.com/.*\.asp" or "www\.xyz[0-9][0-9]\.com" with
methods "GET" or "PUT." All other URL/Method combinations will be silently allowed.
hostname(config)# regex url1 "www\.xyz.com/.*\.asp"
hostname(config)# regex url2 "www\.xyz[0-9][0-9]\.com"
hostname(config)# regex get "GET"
hostname(config)# regex put "PUT"
hostname(config)# class-map type regex match-any url_to_log
hostname(config-cmap)# match regex url1
hostname(config-cmap)# match regex url2
hostname(config-cmap)# exit
hostname(config)# class-map type regex match-any methods_to_log
hostname(config-cmap)# match regex get
hostname(config-cmap)# match regex put
hostname(config-cmap)# exit
hostname(config)# class-map type inspect http http_url_policy
hostname(config-cmap)# match request uri regex class url_to_log
hostname(config-cmap)# match request method regex class methods_to_log
hostname(config-cmap)# exit
hostname(config)# policy-map type inspect http http_policy
hostname(config-pmap)# class http_url_policy
hostname(config-pmap-c)# log
Configure the HTTP Inspection Service Policy
HTTP inspection is not enabled in the default inspection policy, so you must enable it if you need this
inspection. However, the default inspect class does include the default HTTP ports, so you can simply
edit the default global inspection policy to add HTTP inspection. You can alternatively create a new
service policy as desired, for example, an interface-specific policy.
Procedure
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
Step 1
class-map name
match parameter
Example:
hostname(config)# class-map http_class_map
hostname(config-cmap)# match access-list http
protocol-violation action {drop-connection [log] | reset [log] | log}—Sets the maximum
•
number of characters in the body of an HTTP message that should be searched in a body match.
The default is 200 bytes. A large number will have a significant impact on
performance.xxxChecks for HTTP protocol violations. You must also choose the action to take
for violations (drop connection, reset, or log) and whether to enable or disable logging.
spoof-server string—Substitutes a string for the server header field, WebVPN streams are not
•
subject to the spoof-server command.
Cisco ASA Series Firewall CLI Configuration Guide
HTTP Inspection
7-19