Cisco 4700M Configuration Manual page 171

Chapter 3 Configuring Application Protocol Inspection
•
For example, to match a secondary cookie called "matchme" with a regular
expression value of .*abc123, enter:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match cookie secondary name
matchme value .*abc123
For example, to match all cookie names starting with the letters "ab", enter:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match cookie secondary prefix ab
value .*
For example, to match a given regex in all secondary cookie values, enter:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match cookie secondary value
.*machine-key
To remove a secondary cookie match statement from a class map, enter the no
form of the command as follows:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# no match cookie secondary value
.*machine-key
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
OL-16202-01
When you configure a secondary cookie value match across all secondary
cookie names in a match-all class map, you cannot configure any other
secondary cookie match in the same class map because a secondary cookie
match on a value alone is equivalent to a wildcard match on a name. In the
following example, the second match statement is not allowed:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match cookie secondary value
bob
host1/Admin(config-cmap-http-insp-m)# exit
host1/Admin(config-cmap-http-insp)# match cookie secondary name
identity value jane
Configuring a Layer 7 HTTP Deep Inspection Policy
3-47