Cisco 4700M Configuration Manual page 172

Configuring a Layer 7 HTTP Deep Inspection Policy
Defining an HTTP Header for Inspection
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-48
You can use the match header command to configure the class map to define
application inspection decisions based on the name and value in an HTTP header.
The ACE performs regular expression matching against the received packet data
from a particular connection based on the HTTP header expression.
You must access the class map configuration mode to specify the match header
command.
The syntax of this command is as follows:
[line_number] match header {header_name | header_field} header-value
expression
The keywords, arguments, and options are as follows:
line_number—(Optional) Argument that assists you in editing or deleting
•
individual match commands. Enter an integer from 2 to 1024 as the line
number. You can enter no line_number to delete long match commands
instead of entering the entire line. The line numbers do not dictate a priority
or sequence for the match statements.
header_name—Name of the HTTP header to match (for example,
•
www.example1.com.) Enter an unquoted text string with no spaces and a
maximum of 64 alphanumeric characters. Alternatively, you can enter a text
string with spaces if you enclose the entire string in quotation marks ("). For
a list of predefined header fields, see
Note The header_name argument cannot include the colon in the name of the
HTTP header; the ACE rejects the colon as an invalid token.
header_field—Standard HTTP/1.1 header field. Valid selections include
•
request-header fields, general-header fields, and entity-header field.
Table 3-6 lists the supported HTTP/1.1 header fields.
Chapter 3 Configuring Application Protocol Inspection
Table 3-6.
OL-16202-01