Cisco 4700M Configuration Manual page 166

Configuring a Layer 7 HTTP Deep Inspection Policy
Defining HTTP Content Match Criteria
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-42
To add a description that the class map is to perform HTTP deep packet
inspection, enter:
host1/Admin(config-cmap-http-insp)# description HTTP protocol deep
inspection of incoming traffic
To remove the description from the class map, enter:
host1/Admin(config-cmap-http-insp)# no description
You can use the match content command to configure the class map to define
HTTP application inspection decisions based on content expressions contained
within the HTTP entity-body.
You must access the class map configuration mode to specify the match content
command.
The syntax of this command is as follows:
[line_number] match content expression [offset number]
The keywords, arguments, and options are as follows:
line_number—(Optional) Argument that assists you in editing or deleting
•
individual match commands. Enter an integer from 2 to 1024 as the line
number. You can enter no line_number to delete long match commands
instead of entering the entire line. The line numbers do not dictate a priority
or sequence for the match statements.
expression—Content expression contained within the HTTP entity-body. The
•
range is from 1 to 255 alphanumeric characters. See
supported characters that you can use in regular expressions.
When matching data strings, note that the period (.) and question
Note
mark (?) characters do not have a literal meaning in regular
expressions. Use brackets ([]) to match these symbols (for example,
enter www[.]xyz[.]com instead of www.xyz.com). You can also use a
backslash (\) to escape a dot (.) or a question mark (?).
Chapter 3 Configuring Application Protocol Inspection
Table 3-5 for a list of the
OL-16202-01