Identifying Traffic In An Inspection Class Map - Cisco 7604 Configuration Manual

Configuring Special Actions for Application Inspections (Inspection Policy Map)
hostname(config)# regex url_example example\.com
hostname(config)# regex url_example2 example2\.com
hostname(config)# class-map type regex match-any URLs
hostname(config-cmap)# match regex url_example
hostname(config-cmap)# match regex url_example2
hostname(config-cmap)# class-map type inspect http match-all http-traffic
hostname(config-cmap)# match req-resp content-type mismatch
hostname(config-cmap)# match request body length gt 1000
hostname(config-cmap)# match not request uri regex class URLs
hostname(config-cmap)# policy-map type inspect http http-map1
hostname(config-pmap)# class http-traffic
hostname(config-pmap-c)# drop-connection log
hostname(config-pmap-c)# match req-resp content-type mismatch
hostname(config-pmap-c)# reset log
hostname(config-pmap-c)# parameters
hostname(config-pmap-p)# protocol-violation action log
hostname(config-pmap-p)# policy-map test
hostname(config-pmap)# class test
hostname(config-pmap-c)# inspect http http-map1
hostname(config-pmap-c)# service-policy test interface outside

Identifying Traffic in an Inspection Class Map

This type of class map allows you to match criteria that is specific to an application. For example, for
HTTP traffic, you can match a particular URL.
Not all applications support inspection class maps. See the CLI help for a list of supported applications.
Note
A class map groups multiple traffic matches (in a match-all class map), or lets you match any of a list of
matches (in a match-any class map). The difference between creating a class map and defining the traffic
match directly in the inspection policy map is that the class map lets you group multiple match
commands, and you can reuse class maps. For the traffic that you identify in this class map, you can
specify actions such as dropping, resetting, and/or logging the connection in the inspection policy map.
If you want to perform different actions on different types of traffic, you should identify the traffic
directly in the policy map.
The maximum number of class maps ( Layer 3/4, inspection, and regular expression) is 255 in single
mode or per context in multiple mode. This limit includes default class maps. See the
Maps" section on page
To define an inspection class map, perform the following steps:
(Optional) If you want to match based on a regular expression, see the
Step 1
section on page 20-11
Create a class map by entering the following command:
Step 2
hostname(config)# class-map type inspect application [match-all] class_map_name
hostname(config-cmap)#
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
20-10
(a Layer 3/4 class map not shown)
20-4.
and the "Creating a Regular Expression Class Map" section on page
Chapter 20 Using Modular Policy Framework
"Default Class
"Creating a Regular Expression"
20-14.
OL-20748-01