Table Of Contents
Configuring Application Protocol Inspection
Application Protocol Inspection Overview
Performing Application Protocol Inspection
Application Inspection Protocol Overview
Application Protocol Inspection Configuration Quick Start Procedures
Configuring a Layer 7 HTTP Deep Inspection Policy
Creating a Layer 7 HTTP Deep Inspection Class Map
Creating an HTTP Deep Inspection Class Map
Adding a Layer 7 HTTP Deep Packet Inspection Class Map Description
Defining HTTP Content Match Criteria
Defining the Length of HTTP Content for Inspection
Defining an HTTP Header for Inspection
Defining the HTTP Maximum Header Length for Inspection
Defining a Header MIME Type Messages for Inspection
Defining an HTTP Traffic Restricted Category
Defining HTTP Request Methods and Extension Methods
Defining an HTTP Transfer Encoding Type
Defining an HTTP URL for Inspection
Defining an HTTP Maximum URL Length for Inspection
Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map
Creating a Layer 7 HTTP Deep Packet Inspection Policy Map
Adding a Layer 7 HTTP Deep Packet Inspection Policy Map Description
Including Inline Match Statements in a Layer 7 HTTP Deep Packet Inspection Policy Map
Specifying a Layer 7 HTTP Inspection Traffic Class with the Traffic Policy
Specifying the Layer 7 HTTP Deep Packet Policy Actions
Configuring a Layer 7 FTP Command Inspection Policy
Creating an FTP Inspection Class Map
Adding a Layer 7 FTP Inspection Class Map Description
Defining FTP Match Request Methods
Configuring a Layer 7 FTP Command Inspection Policy Map
Creating a Layer 7 FTP Command Inspection Policy Map
Adding a Layer 7 FTP Inspection Policy Map Description
Including Inline Match Statements in a Layer 7 Command Inspection Policy Map
Specifying a Layer 7 FTP Command Inspection Traffic Class with the Traffic Policy
Specifying the Layer 7 FTP Command Inspection Policy Actions
Configuring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy
Configuring a Layer 3 and Layer 4 Class Map
Adding a Layer 3 and Layer 4 Class Map Description
Defining Access-List Match Criteria
Defining TCP/UDP Port Number or Port Range Match Criteria
Configuring a Layer 3 and Layer 4 Policy Map
Creating a Layer 3 and Layer 4 Policy Map
Adding a Layer 3 and Layer 4 Policy Map Description
Specifying a Layer 3 and Layer 4 Traffic Class with the Traffic Policy
Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions
Configuring an HTTP Parameter Map for Use in a Layer 3 and Layer 4 Policy Map
Disabling Case Sensitivity Matching
Setting the Maximum Number of Bytes to Parse in HTTP Headers
Setting the Maximum Number of Bytes to Parse in HTTP Content
Associating an HTTP Parameter Map with a Layer 3 and Layer 4 Policy Map
Viewing Application Protocol Inspection Statistics and Service Policy Information
Displaying HTTP Protocol Inspection Statistics
Displaying Service Policy Configuration Information
Configuring Application Protocol Inspection
This chapter describes how to configure application protocol inspection for the Cisco Application Control Engine (ACE) module. Application protocol inspection provides functionality for several protocols that carry Layer 3 and Layer 4 information in the application payload, require some form of deep packet inspection of the HTTP protocol, or require FTP request command filtering.
This chapter includes the following major sections:
•
Application Protocol Inspection Overview
•
•
•
•
•
•
Application Protocol Inspection Overview
Certain applications require special handling of the data portion of a packet as the packets pass through the ACE. Application protocol inspection helps to verify the protocol behavior and identify unwanted or malicious traffic passing through the ACE. Based on the specifications of the traffic policy, the ACE accepts or rejects the packets to ensure the secure use of applications and services.
This section includes the following topics on application protocol inspection:
•
•
Performing Application Protocol Inspection
You can configure the ACE to perform application protocol inspection, sometimes referred to as application protocol "fixup," for applications that:
•
•
You may require that the ACE perform application inspection of HTTP, FTP, DNS, ICMP, and RTSP protocols as a first step before passing the packets to the destination server. For HTTP, the ACE performs deep packet inspection to statefully monitor the HTTP protocol and permits or denies traffic based on user-defined traffic policies. HTTP deep packet inspection focuses mainly on HTTP attributes such as HTTP header, URL, and the payload. For FTP, the ACE performs FTP command inspection for FTP sessions, allowing you to restrict specific commands by the ACE.
Application inspection helps you identify the location of embedded IP addressing information in the TCP or UDP flow. This inspection allows the ACE to translate embedded IP addresses and to update any checksum or other fields that are affected by the translation.
The need to translate IP addresses embedded in the payload of protocols is especially important for NAT (explicitly configured by the user) and server load-balancing (an implicit NAT).
Application inspection also monitors TCP or UDP sessions to determine the port numbers for secondary channels. Some protocols open secondary TCP or UDP ports to improve performance. The initial session on a well-known port is used to negotiate dynamically assigned port numbers. The application protocol inspection function monitors these sessions, identifies the dynamic port assignments, and permits data exchange on these ports for the duration of the session.
Table 3-1 describes the application inspection protocols supported by the ACE, the default TCP or UDP protocol and port, and whether the protocol is compatible with Network Address Translation (NAT) and Port Address Translation (PAT).
Table 3-1 Application Inspection Support
DNS
UDP
Src—Any
Dest—53
NAT
No
RFC 1123
Inspects DNS packets destined to port 53. You can specify the maximum length of the DNS packet to be inspected. See the "DNS Inspection" section for background information.
FTP
TCP
Src—Any
Dest—21
Both
No
RFC 959
Inspects FTP packets, translates address and port embedded in the payload, and opens up secondary channel for data. See the "FTP Inspection" section for background information.
FTP strict
TCP
Src—Any
Dest—21
Both
No
RFC 959
The inspect ftp strict command allows the ACE to track each FTP command and response sequence, and also prevents an FTP client from determining valid usernames that are supported on an FTP server. See the "FTP Inspection" section for background information.
HTTP
TCP
Src—Any
Dest—80
Both
No
RFC 2616
Inspects HTTP packets. See the "HTTP Deep Packet Inspection" section for background information.
ICMP
ICMP
Src—N/A
Dest—N/A
Both
No
—
See the "ICMP Inspection" section for background information.
ICMP error
ICMP
Src—N/A
Dest—N/A
NAT
No
—
The error keyword supports NAT of ICMP error messages. When you enable ICMP error inspection, the ACE creates translation sessions for intermediate hops that send ICMP error messages, based on the NAT configuration. The ACE overwrites the packet with the translated IP addresses. See the "ICMP Inspection" section for background information.
RTSP
TCP
Src—Any
Dest—554
NAT
No
RFC 2326, RFC 2327, RFC 1889
Inspects RTSP packets and translates the payload according to NAT rules. The ACE opens up the secondary channels for audio and video. Not all the RTSP methods (packet types) specified in the RFC are supported. See the "RTSP Inspection" section for background information.
1 The ACE is in compliance with these standards, but it does not enforce compliance on packets being inspected. For example, FTP commands are supposed to be in a particular order, but the ACE does not enforce the order.
You configure rules for application protocol inspection through the use of class maps, policy maps, and service policies. The following items summarize the role of each function in configuring application protocol inspection:
•
•
•
•
•
The flow chart shown in Figure 3-1 provides a basic overview of the process required to configure class maps and policy maps to perform application protocol inspection. The flow chart also illustrates how the ACE associates the various components of the class map and policy map configuration with each other.
Figure 3-1 Application Protocol Inspection Configuration Flow Diagram
Application Inspection Protocol Overview
This section provides an overview on the following application inspection protocols supported by the ACE:
HTTP Deep Packet Inspection
The ACE performs a stateful deep packet inspection of the HTTP protocol. Deep packet inspection is a special case of application inspection where the ACE examines the application payload of a packet or a traffic stream and makes decisions based on the content of the data. During HTTP deep inspection, the main focus of the application inspection process is on HTTP attributes such as HTTP header, URL, and to a limited extent, the payload. User-defined regular expressions can also be used to detect "signatures" in the payload.
You define policies to permit or deny the traffic, or to send a TCP reset message to the client or server to close the connection.
The security features covered by HTTP application inspection include:
•
•
•
•
•
DNS Inspection
Domain Name System (DNS) inspection performs the following tasks:
•
•
•
Note
•
Note
•
–
–
–
A single connection is created for multiple DNS sessions, as long as the DNS sessions are between the same two hosts, and the sessions have the same 5-tuple (source and destination IP address, source and destination port, and protocol). DNS identification is tracked by app_id, and the idle timer for each app_id runs independently.
Because the app_id expires independently, a legitimate DNS response can only pass through the security appliance within a limited period of time and there is no resource build-up. However, if you enter the show conn command, you will see the idle timer of a DNS connection being reset by a new DNS session. This reset action is due to the nature of the shared DNS connection and intended by design.
FTP Inspection
File Transfer Protocol (FTP) inspection inspects FTP sessions for address translation in a message, dynamic opening of ports, stateful tracking of request and response messages. Each specified FTP command must be acknowledged before the ACE allows a new command. Command filtering allows you to restrict specific commands by the ACE. When the ACE denies a command, it closes the connection.
The FTP command inspection process, as performed by the ACE:
•
•
Note
–
–
–
–
–
–
–
•
ICMP Inspection
Internet Control Message Protocol (ICMP) inspection allows ICMP traffic to have a "session" so it can be inspected similarly to TCP and UDP traffic. Without using ICMP inspection, we recommend that you do not allow ICMP traffic to pass through the ACE in an ACL. Without performing stateful inspection, ICMP can be used to attack your network. ICMP inspection ensures that there is only one response for each request, and that the sequence number is correct.
For stateful ICMP, state information, as maintained for TCP or UDP flows, is maintained for ICMP instead of performing only the ACL and NAT functions. The maintenance of ICMP state information is required to resolve the following problems:
•
•
•
ICMP error messages are generated by intermediate nodes situated on the network path to a destination whenever a packet sent to that destination cannot be forwarded. ICMP error messages may also be generated by endpoint nodes, as in the case of port unreachable errors. These error messages carry the original packet for which the error is generated in the data part of the message. They also contain the addresses of the intermediate node or endpoint node in the outer header and destination in the inner header. ICMP error fixup handles address translation of node address and destination address to global addresses using NAT configuration.
ICMP error fixup is user-configurable, and if not enabled, intermediate node or endpoint node addresses are translated in the same way as the destination address of the embedded packet. As a result, error messages appear as if originating from the destination and the node addresses or the route to destination is not revealed.
ICMP inspection performs the following tasks for ICMP request or reply messages:
•
•
•
•
•
ICMP error message inspection performs the following tasks:
•
•
•
•
RTSP Inspection
Real Time Streaming Protocol (RTSP) is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. RTSP applications use the well known port 554 with TCP and UDP as the control channel. The ACE only supports TCP in conformity with RFC 2326.
The TCP control channel negotiates the data channels used to transmit audio and video traffic, depending on the transport mode that is configured on the client. The supported data transport modes are: rtp/avp, rtp/avp/udp, x-real-rdt, x-real-rdt/udp, and x-pn-tng/udp. Data transport types rtp/avp/tcp and x-real-rdt/tcp use the control channel to stream data. RTSP inspection is not required in this case to open a pinhole for the data channel.
The ACE parses SETUP response messages with a status code of 200.
Because RFC 2326 does not require that the client and server ports be contained in the SETUP response message, the ACE must keep track of state and remember the client ports in the SETUP message. QuickTime places the client ports in the SETUP message; the server responds with only the server ports.
During RTSP inspection, the ACE does not:
•
•
•
•
The following additional restrictions apply to RTSP inspection as performed by the ACE:
•
•
Network Transport>RTSP Settings.–
–
Application Protocol Inspection Configuration Quick Start Procedures
The following tables provide a quick overview of the steps required to configure application protocol inspection on the ACE. This section includes the following quick start tables:
•
•
•
Configuring a Layer 7 HTTP Deep Inspection Policy
This section describes how to create a Layer 7 class map and policy map to be used for HTTP deep packet inspection by the ACE. The ACE performs a stateful deep packet inspection of the HTTP protocol and permits or restricts traffic based on the actions in your configured policy maps. The following security features are included as part of HTTP deep packet inspection as performed by the ACE:
•
•
•
•
•
•
•
Note
•
•
•
•
•
This section includes the following procedures:
•
•
Creating a Layer 7 HTTP Deep Inspection Class Map
This section contains the following procedures:
•
•
•
•
•
•
•
•
•
•
•
•
Creating an HTTP Deep Inspection Class Map
To create a Layer 7 class map for deep packet inspection of HTTP traffic, use the class-map type http inspect command in configuration mode.
The syntax of this command is:
class-map type http inspect [match-all | match-any] map_name
The keywords, arguments, and options are:
•
–
–
The default setting is to meet all of the match criteria (match-all) in a class map.
•
The CLI displays the class map HTTP application protocol inspection configuration mode. To classify the HTTP application inspection of traffic for evaluation by the ACE, include one or more of the commands to configure the match criteria for the Layer 7 class map:
•
•
•
•
•
•
•
•
•
•
Note that you may include multiple match commands in the class map.
For example, to specify HTTP_INSPECT_L7CLASS as the name of a class map and identify that at least one command in the Layer 7 HTTP application inspection class map must be satisfied for the ACE to indicate a match, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match header length request eq 200host1/Admin(config-cmap-http-insp)# match header Host header-value .*mycompanyexample.comhost1/Admin(config-cmap-http-insp)# match url length eq 10000host1/Admin(config-cmap-http-insp)# match url .*.gifTo remove the HTTP application inspection class map from the ACE, enter:
host1/Admin(config)# no class-map type http inspect match-any HTTP_INSPECT_L7CLASSAdding a Layer 7 HTTP Deep Packet Inspection Class Map Description
Use the description command to provide a brief summary about the Layer 7 HTTP deep packet inspection class map.
Access the class map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
To add a description that the class map is to perform HTTP deep packet inspection, enter:
host1/Admin(config-cmap-http-insp)# description HTTP protocol deep inspection of incoming trafficTo remove the description from the class map, enter:
host1/Admin(config-cmap-http-insp)# no descriptionDefining HTTP Content Match Criteria
Use the match content command to configure the class map to define HTTP application inspection decisions based on content expressions contained within the HTTP entity-body.
Access the class map configuration mode to specify the match content command.
The syntax of this command is:
[line_number] match content expression [offset number]
The keywords, arguments, and options are:
•
•
•
For example, to create a class map that specifies a content expression contained within the entity-body sent with an HTTP request, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match content .*newp2psigTo clear content expression checking match criteria from the class map, enter:
host1/Admin(config-cmap)# no match content .*newp2psigDefining the Length of HTTP Content for Inspection
Use the match content length command to configure the class map to define application inspection decisions on HTTP traffic up to the configured maximum content parse length. Messages that meet the specified criteria will be either allowed or denied based on the Layer 7 HTTP deep packet inspection policy map action.
Access the class map configuration mode to specify the match content length command.
The syntax of this command is:
[line_number] match content length {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
The keywords, arguments, and options are:
•
•
•
•
•
For example, to create a class map that identifies the content length in an HTTP message that can be received by the ACE, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match content length eq 3495To clear the HTTP content length match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match content length eq 3495Defining an HTTP Header for Inspection
Use the match header command to configure the class map to define application inspection decisions based on the name and value in an HTTP header. The ACE performs regular expression matching against the received packet data from a particular connection based on the HTTP header expression.
Access the class map configuration mode to specify the match header command.
The syntax of this command is:
[line_number] match header {header_name | header_field} header-value expression
The keywords, arguments, and options are:
•
•
Note
•
•
For example, to specify that the Layer 7 class map is to match and perform application inspection on HTTP headers, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap)# match header Host header-value .mycompanyexample.comFor example, to specify regular expressions in a class map to emulate a wildcard search to match the header value expression string, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match header Host header-value .*myfirstcompanyexample.comhost1/Admin(config-cmap-http-insp)# match header Host header-value .*mysecondcompanyexample.comTo clear an HTTP header match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match header Host header-value .*mysecondcompanyexample.comDefining the HTTP Maximum Header Length for Inspection
By default, the maximum header length for HTTP deep packet inspection is 2048 bytes. Use the match header length command to limit the HTTP traffic allowed through the ACE based on the length of the entity body in the HTTP message. Messages will be either allowed or denied based on the Layer 7 HTTP deep packet inspection policy map action.
Access the class map configuration mode to specify the match header length command.
The syntax of this command is:
[line_number] match header length {request | response} {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
The keywords, arguments, and options are:
•
•
•
•
•
•
•
For example, to specify that the class map is to match on HTTP traffic received with a length less than or equal to 3600 bytes in the entity body of the HTTP message, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match header length request eq 3600To clear the maximum HTTP header length match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match header length request eq 3600Defining a Header MIME Type Messages for Inspection
Use the match header mime-type command to specify a subset of the Multipurpose Internet Mail Extension (MIME)-type messages that the ACE permits or denies based on the actions in the policy map. MIME-type validation extends the format of Internet mail to allow non-US-ASCII textual messages, non-textual messages, multipart message bodies, and non-US-ASCII information in message headers.
Note
The syntax of this command is:
[line_number] match header mime-type mime_type
The keywords, arguments, and options are:
•
•
The following lists the supported mime-types.
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
Note the following considerations:
•
•
For example, to create a class map that specifies the MIME-type audio\midi and audio\mpeg messages permitted through the ACE, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match header mime-type audio\midihost1/Admin(config-cmap-http-insp)# match header mime-type audio\mpegTo deselect the specified MIME message match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match header mime-type audio\midiDefining an HTTP Traffic Restricted Category
Use the match port-misuse command to configure the class map to define application inspection compliance decisions that restrict certain HTTP traffic from passing through the ACE. This class map detects the misuse of port 80 (or any other port running HTTP) for tunneling protocols such as peer-to-peer (p2p) applications, tunneling applications, and instant messaging.
Access the class map configuration mode to specify the match port-misuse command.
The syntax of this command is:
[line_number] match port-misuse application_category
The keywords, arguments, and options are:
•
•
–
–
–
Note the following considerations:
•
•
•
•
For example, to create a class map that identifies peer-to-peer applications as restricted HTTP traffic, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match port-misuse p2pTo clear the HTTP restricted application category match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match port-misuse p2pDefining HTTP Request Methods and Extension Methods
By default, the ACE allows all request and extension methods. Use the match request-method command to configure the class map to define application inspection compliance decisions based on the request methods defined in RFC 2616 and by HTTP extension methods. If the HTTP request method or extension method compliance checks fails, the ACE denies or resets the specified HTTP traffic based on the policy map action.
Access the class map configuration mode to specify the match request-method command.
The syntax of this command is:
[line_number] match request-method {ext method | rfc method}
The keywords, arguments, and options are:
•
•
•
Note the following considerations:
•
•
•
•
For example, to create a class map that identifies the connect, get, head, and index HTTP RFC 2616 protocols for HTTP application protocol inspection, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match request-method rfc connecthost1/Admin(config-cmap-http-insp)# match request-method rfc gethost1/Admin(config-cmap-http-insp)# match request-method rfc headhost1/Admin(config-cmap-http-insp)# match request-method ext indexTo clear an RFC 2616 HTTP request method match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match request-method rfc connectDefining an HTTP Transfer Encoding Type
Use the match transfer-encoding command to configure the class map to define application inspection decisions that limit the HTTP transfer-encoding types that can pass through the ACE. The transfer-encoding general-header field indicates the type of transformation, if any, that has been applied to the HTTP message body to safely transfer it between the sender and the recipient. When an HTTP request message contains the configured transfer-encoding type, the ACE performs the configured action in the policy map.
Access the class map configuration mode to specify the match transfer-encoding command.
The syntax of this command is:
[line_number] match transfer-encoding coding_types
The keywords, arguments, and options are:
•
•
–
–
–
–
–
Note the following considerations:
•
•
•
For example, to create a class map that specifies a chunked HTTP transfer encoding type to limit the HTTP traffic that flows through the ACE, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match transfer-encoding chunkedTo clear the HTTP transfer-encoding match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match transfer-encoding chunkedDefining an HTTP URL for Inspection
Use the match url command to configure the class map to define application inspection decisions based on URL name. HTTP performs regular expression matching against the received packet data from a particular connection based on the URL expression.
Access the class map configuration mode to specify the match url command.
The syntax of this command is:
[line_number] match url expression
The keywords, arguments, and options are:
•
•
Note
For example, to specify that the Layer 7 class map is to match and perform application inspection on a specific URL, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match url whatsnew/latest.*For example, to use regular expressions to emulate a wildcard search to match on any .gif or .html file, enter:
host1/Admin(config)# class-map type http inspect match-any HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match url .*.gifhost1/Admin(config-cmap-http-insp)# match url .*.htmlTo clear a URL match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match url .*.gifDefining an HTTP Maximum URL Length for Inspection
Use the match url length command to limit the HTTP traffic allowed through the ACE by specifying the maximum length of a URL in a request message that can be received by the ACE. Messages will be either allowed or denied based on the Layer 7 HTTP deep packet inspection policy map action.
Access the class map configuration mode to specify the match url length command.
The syntax of this command is:
[line_number] match url length {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
The keywords, arguments, and options are:
•
•
•
•
•
For example, to specify that a class map is to match on a URL with a length equal to 10000 bytes in the request message, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASShost1/Admin(config-cmap-http-insp)# match url length eq 10000To clear a URL length match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match url length eq 10000Configuring a Layer 7 HTTP Deep Packet Inspection Policy Map
This section outlines how to configure a Layer 7 HTTP deep inspection policy map. The Layer 7 policy map configures the applicable HTTP deep packet inspection actions executed on the network traffic that match the classifications defined in a class map. You then associate the completed Layer 7 HTTP deep packet inspection policy with a Layer 3 and Layer 4 policy map to activate the operation on a VLAN interface (see the "Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions" section).
This section includes the following topics:
•
•
•
•
•
Creating a Layer 7 HTTP Deep Packet Inspection Policy Map
Use the policy-map type inspect http command in configuration mode to name the traffic policy and initiate Layer 7 HTTP deep packet inspection.
The syntax of this command is:
policy-map type inspect http all-match map_name
The keyword and arguments are:
•
•
For example, to create a Layer 7 HTTP deep packet inspection policy map, enter:
host/Admin(config)# policy-map type inspect http all-match HTTP_INSPECT_L7POLICYhost/Admin(config-pmap-ins-http)#The CLI displays the policy map configuration mode.
To remove a Layer 7 HTTP deep packet inspection policy map from the ACE, enter:
host1/Admin(config)# no policy-map type inspect http all-match HTTP_INSPECT_L7POLICYAdding a Layer 7 HTTP Deep Packet Inspection Policy Map Description
Use the description command to provide a brief summary about the Layer 7 HTTP deep packet inspection policy map.
Access the policy map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
To add a description that the policy map is to perform HTTP deep packet inspection, enter:
host1/Admin(config-pmap-ins-http)# description HTTP protocol deep inspection of incoming trafficTo remove the description from the policy map, enter:
host1/Admin(config-pmap-ins-http)# no descriptionIncluding Inline Match Statements in a Layer 7 HTTP Deep Packet Inspection Policy Map
To include a single inline match criteria in the policy map without specifying a traffic class, enter an applicable Layer 7 match command. The inline Layer 7 policy map match commands function the same as with the Layer 7 class map match commands. However, when you use an inline match command, you can specify an action for only a single match statement in the Layer 7 policy map.
Note
The syntax for an inline match command is:
match name match_statement [insert-before map_name]
The arguments are:
•
•
•
The syntax for the HTTP deep packet inspection policy map inline match commands includes:
match name content expression [offset number]
match name content length {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
match name content-type-verification
match name header {header_name | header_field} header-value expression
match name header length {request | response} {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
match name header mime-type mime_type
match name port-misuse application_category
match name request-method {ext method | rfc method}
match name strict-http
match name transfer-encoding coding_types
match name url expression
match name url length {eq bytes | gt bytes | lt bytes | range bytes1 bytes 2}
See the "Creating a Layer 7 HTTP Deep Inspection Class Map" section for details on the individual inline match commands.
The match content-type-verification and match strict-http commands are available only as inline match commands under the Layer 7 policy-map type inspect http command. Because these two Layer 7 HTTP deep inspection match criteria cannot be combined with other match criteria, they appear as inline match commands for a policy map.
These two match commands perform the following HTTP deep inspection functions:
•
Note
•
For example, to add an inline match command to a Layer 7 HTTP deep inspection policy map, enter:
host/Admin(config-pmap-ins-http)# match L7httpinspect port-misuse p2pSpecifying a Layer 7 HTTP Inspection Traffic Class with the Traffic Policy
To specify a traffic class created with the class-map command to associate network traffic with the traffic policy, use the class command. The syntax of this command is:
class map_name
The map_name argument specifies the name of a previously defined traffic class, configured with the class-map command, to associate traffic to the traffic policy. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
The CLI displays the policy map class configuration mode.
For example, to specify an existing class map in the Layer 7 policy map, enter:
host1/Admin(config-pmap-ins-http)# class HTTP_INSPECT_L7CLASShost1/Admin(config-pmap-ins-http-c)#To remove a class map from a Layer 7 policy map, enter:
host1/Admin(config-pmap-ins-http)# no class HTTP_INSPECT_L7CLASSTo manually insert a class map ahead of a previously specified class map, use the insert-before command. The ACE does not save sequence reordering through the insert-before command as part of the configuration.
The syntax of this command is:
class map_name1 insert-before map_name2
The keywords and arguments are:
•
•
For example, to use the insert-before command to define the sequential order of two class maps in the policy map, enter:
host1/Admin(config-pmap-ins-http)# class HTTP_INSPECT_L7CLASSMAP2 insert-before HTTP_INSPECT_L7CLASSTo specify the class-default class map for the traffic policy, use the class class-default command. All traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications match, the ACE then matches the action specified under the class class-default command. The class-default class map has an implicit match any statement in it such that it matches all traffic.
Note
For example, to use the class class-default command, enter:
host1/Admin(config-pmap-ins-http)# class class-defaulthost1/Admin(config-pmap-ins-http-c)#The CLI displays the policy map class configuration mode.
Specifying the Layer 7 HTTP Deep Packet Policy Actions
The default behavior of the ACE is to permit HTTP traffic. For example, if a policy map explicitly permits the HTTP GET method, other methods such as PUT will also be permitted. Only an explicit deny is capable of dropping traffic.
Specify the permit or reset command to define the action that the ACE performs on the HTTP traffic depending on whether it matches the specified commands. You apply the specified command against the single inline match command or the specified class map.
The Layer 7 HTTP deep packet inspection policy commands include:
{permit | reset}
The keywords, arguments, and options are:
•
•
For example, to specify the actions in the Layer 7 HTTP deep packet inspection policy map, enter:
host1/Admin(config)# policy-map type inspect http all-match HTTP_DEEPINSPECT_L7POLICYhost1/Admin(config-pmap-ins-http)# class http_checkhost1/Admin(config-pmap-ins-http-c)# permitBecause the default is to permit all HTTP packets, you must remove the class map to disable this function. For example, enter:
host1/Admin(config-pmap-ins-http)# no class http_checkBy default, HTTP inspection allows traffic which does not match any of the configured Layer 7 HTTP deep packet inspection matches. You can modify this behavior by including the class class-default command with the reset action to deny the specified Layer 7 HTTP traffic. In this case, if none of the class matches configured in the Layer 7 HTTP deep packet inspection policy map are hit, the class-default action will be taken by the ACE. For example, you can include a class map to allow the HTTP GET method and use the class class-default command to block all of the other requests.
Note
Configuring a Layer 7 FTP Command Inspection Policy
This section describes how to create a Layer 7 class map and policy map to be used for FTP command inspection by the ACE, a security feature that prevents web browsers from sending embedded commands to the ACE in FTP requests. Each FTP command must be acknowledged before the ACE allows a new command. FTP inspection allows traffic by default and restricts traffic that fails the security checks. Command filtering allows you to restrict specific commands through the ACE. When the ACE denies a command, it closes the connection.
Note
•
•
•
•
•
This section includes the following procedures:
•
•
•
•
Creating an FTP Inspection Class Map
To define a class map to be used for the inspection of FTP request commands, use the class-map type ftp inspect command in configuration mode.
The syntax of this command is:
class-map type ftp inspect match-any map_name
The keywords, arguments, and options are:
•
•
The CLI displays the class map FTP command inspection configuration mode. To classify the FTP request commands for inspection by the ACE, include one or more of the match request-method commands to configure the match criteria for the Layer 7 class map. See the "Defining FTP Match Request Methods" section.
For example, to specify FTP_INSPECT_L7CLASS as the name of a class map and identify that at least one FTP inspection command in the class map must be satisfied for the ACE to indicate a match, enter:
host1/Admin(config)# class-map type ftp inspect match-any FTP_INSPECT_L7CLASShost1/Admin(config-cmap-ftp-insp)# match request-method cduphost1/Admin(config-cmap-ftp-insp)# match request-method mkdirhost1/Admin(config-cmap-ftp-insp)# match request-method gethost1/Admin(config-cmap-ftp-insp)# match request-method putTo remove the FTP request inspection class map from the ACE, enter:
host1/Admin(config)# no class-map type ftp inspect match-any FTP_INSPECT_L7CLASSAdding a Layer 7 FTP Inspection Class Map Description
Use the description command to provide a brief summary about the Layer 7 FTP inspection class map.
Access the class map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
To add a description that the class map is to perform FTP command inspection, enter:
host1/Admin(config-cmap-ftp-insp)# description FTP command inspection of incoming trafficTo remove the description from the class map, enter:
host1/Admin(config-cmap-ftp-insp)# no description FTP command inspection of incoming trafficDefining FTP Match Request Methods
Use the match request-method command to configure the class map to define FTP command inspection decisions by the ACE. The match command identifies the FTP commands that you want filtered by the ACE.
Access the class map configuration mode to specify the match request-method command.
The syntax of this command is:
match request-method ftp_commands
The ftp_commands argument specifies the FTP command in the class map to be subjected to FTP inspection by the ACE. The possible ftp_commands include: appe, cdup, dele, get, help, mkd, put, rmd, rnfr, rnto, site, stou, and syst.
You can specify multiple match request-methods commands within a class map.
For example, to specify FTP_INSPECT_L7CLASS as the name of a class map and identify that at least one FTP inspection command in the class map must be satisfied for the ACE to indicate a match, enter:
host1/Admin(config)# class-map type ftp inspect match-any FTP_INSPECT_L7CLASShost1/Admin(config-cmap-ftp-insp)# match request-method cduphost1/Admin(config-cmap-ftp-insp)# match request-method mkdirhost1/Admin(config-cmap-ftp-insp)# match request-method gethost1/Admin(config-cmap-ftp-insp)# match request-method stouhost1/Admin(config-cmap-ftp-insp)# match request-method putUse the no form of the command to clear the FTP inspection request method from the class map.
host1/Admin(config-cmap-ftp-insp)# no match request-method cdupConfiguring a Layer 7 FTP Command Inspection Policy Map
This section outlines how to configure a Layer 7 FTP command inspection policy map. The Layer 7 policy map configures the applicable FTP command inspection actions executed on the network traffic that match the classifications defined in a class map. You then associate the completed Layer 7 FTP command inspection policy with a Layer 3 and Layer 4 policy map to activate the operation on a VLAN interface (see the "Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions" section).
This section includes the following topics:
•
•
•
•
•
Creating a Layer 7 FTP Command Inspection Policy Map
Use the policy-map type inspect ftp command in configuration mode to name the traffic policy and initiate FTP command inspection.The syntax of this command is:
policy-map type inspect ftp first-match map_name
The keyword and arguments are:
•
•
For example, to create a Layer 7 FTP command inspection policy map, enter:
host/Admin(config)# policy-map type inspect ftp first-match FTP_INSPECT_L7POLICYhost/Admin(config-pmap-ftp-ins) #The CLI displays the policy map configuration mode.
To remove a Layer 7 command inspection policy map from the ACE, enter:
host1/Admin(config)# no policy-map type inspect ftp first-match FTP_INSPECT_L7POLICYAdding a Layer 7 FTP Inspection Policy Map Description
Use the description command to provide a brief summary about the Layer 7 FTP inspection policy map.
Access the policy map FTP inspection configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
To add a description that the policy map is to perform FTP command inspection, enter:
host1/Admin(config-pmap-ftp-ins)# description FTP command inspection of incoming trafficTo remove the description from the policy map, enter:
host1/Admin(config-pmap-ftp-ins)# no description FTP command inspection of incoming trafficIncluding Inline Match Statements in a Layer 7 Command Inspection Policy Map
To include a single inline match criteria in the policy map without specifying a traffic class, enter an applicable Layer 7 match command. The inline Layer 7 policy map match commands function the same as with the Layer 7 class map match commands. However, when you use an inline match command, you can specify an action for only a single match statement in the Layer 7 policy map.
Note
The syntax for an inline match command is:
match name match_statement [insert-before map_name]
The arguments are:
•
•
•
The syntax for the Layer 7 FTP inspection policy map inline match commands includes:
[line_number] match name request-method {appe | cdup | dele | get | help | mkd | put | rmd | rnfr | rnto | site | stou | syst}
See the "Defining FTP Match Request Methods" section for details about the inline match command.
For example, to add an inline match command to a Layer 7 FTP command policy map, enter:
host/Admin(config-pmap-ftp-ins)# match FTP_REQUEST_MATCH request-method mkdirhost/Admin(config-pmap-ftp-ins-m)#Specifying a Layer 7 FTP Command Inspection Traffic Class with the Traffic Policy
To specify a traffic class created with the class-map command to associate network traffic with the traffic policy, use the class command. The syntax of this command is:
class map_name
The map_name argument specifies the name of a previously defined traffic class, configured with the class-map command, to associate traffic to the traffic policy. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
The CLI displays the policy map class configuration mode.
For example, to specify an existing class map in the Layer 7 policy map, enter:
host1/Admin(config-pmap-ftp-ins)# class FTP_INSPECT_L7CLASShost1/Admin(config-pmap-ftp-ins-c)#To remove a class map from a Layer 7 policy map, enter:
host1/Admin(config-pmap-ftp-ins)# no class FTP_INSPECT_L7CLASSSpecifying the Layer 7 FTP Command Inspection Policy Actions
By default, the ACE allows all FTP commands to pass. To explicitly deny specific FTP commands, use one of the following commands as the action if the specified FTP traffic matches the classification. You apply the specified action against the single inline match command or the specified class map.
{deny | mask-reply}
The keywords, arguments, and options are:
•
•
For example, to specify the actions in the Layer 7 FTP inspection policy map, enter:
host1/Admin(config)# policy-map type inspect ftp first-match FTP_INSPECT_L7POLICYhost1/Admin(config-pmap-ftp-ins)# class FTP_INSPECT_L7CLASShost1/Admin(config-pmap-ftp-ins-c)# mask-replyTo disable an action from the Layer 7 FTP inspection policy map, enter:
host1/Admin(config-pmap-ftp-ins-c)# no mask-replyConfiguring a Layer 3 and Layer 4 Application Protocol Inspection Traffic Policy
This section describes how to create a Layer 3 and Layer 4 class map and policy map to classify network traffic passing through the ACE to perform an applicable application protocol inspection traffic policy. The Layer 3 and Layer 4 traffic policy defines the Layer 3 and Layer 4 HTTP deep packet inspection, FTP command inspection, or application protocol inspection policy actions. Application inspection involves the examination of protocols such as DNS, FTP, HTTP, ICMP, and RTSP to verify the protocol behavior and identify unwanted or malicious traffic passing through the ACE.
•
•
Configuring a Layer 3 and Layer 4 Class Map
To create a Layer 3 and Layer 4 class map to classify network traffic passing through the ACE to perform an applicable application protocol inspection policy, use the class-map command in configuration mode.
There can be multiple match commands in a single class map to specify the matching criteria. For example, you can configure class maps to define multiple access group or port commands in a group that you then associate with an application protocol inspection policy. The match-all and match-any keywords determine how the ACE evaluates multiple match statements operations when multiple match criteria exist in a class map.
The syntax of this command is:
class-map [match-all | match-any] map_name
The keywords and options are:
•
–
–
The default setting is to meet all of the match criteria (match-all) in a class map.
•
The CLI displays the class map configuration mode. To classify network traffic passing through the ACE for application protocol inspection, include one or more of the following commands to configure the match criteria for the class map:
•
•
•
Note the following when creating a class map to define a Layer 3 and Layer 4 match classification:
•
•
For example, to define a Layer 3 and Layer 4 class map, enter:
host1/Admin(config)# class-map match-all DNS_INSPECT_L4CLASShost1/Admin(config-cmap)# description DNS application protocol inspection of incoming traffichost1/Admin(config-cmap)# match port udp eq domainTo remove a Layer 3 and Layer 4 network traffic class map from the ACE, enter:
host1/Admin(config)# no class-map match-all DNS_INSPECT_L4CLASSAdding a Layer 3 and Layer 4 Class Map Description
Use the description command to provide a brief summary about the Layer 3 and Layer 4 class map. Access the class map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to specify a description that the class map is to perform DNS application protocol inspection, enter:
host1/Admin(config)# class-map DNS_INSPECT_L4CLASShost1/Admin(config-cmap)# description DNS application protocol inspection of incoming trafficTo remove the description from the class map, enter:
host1/Admin(config-cmap)# no descriptionDefining Access-List Match Criteria
Use the match access-list command to configure the class map to filter Layer 3 and Layer 4 network traffic on a per flow basis by using a pre-defined access control list. When a packet matches an entry in an access list, and if it is a permit entry, the ACE allows the matching result. If it is a deny entry, the ACE blocks the matching result. Refer to Chapter 1, Configuring Security Access Control Lists for details about the creating access control lists in the ACE.
Access the class map configuration mode to specify the match access-list command.
The syntax of this command is:
[line_number] match access-list identifier
The keywords, arguments, and options are:
•
•
There can be multiple match access-list commands within a single class map. You may combine multiple match access-list and match port commands in a class map.
For example, to specify that the class map is to match on access control list INBOUND_ACL1, enter:
host1/Admin(config)# class-map match-any DNS_INSPECT_L4CLASShost1/Admin(config-cmap)# match access-list INBOUND_ACL1To clear the access control list match criteria from the class map, enter:
host1/Admin(config-cmap)# no match access-list inboundacl1Defining TCP/UDP Port Number or Port Range Match Criteria
Use the match port command to specify a TCP or UDP port number or port range as the Layer 3 and Layer 4 network traffic matching criteria.
Access the class map configuration mode to specify the match port command.
The syntax of this command is:
[line_number] match port {tcp | udp} {any | eq {port_number} | range port1 port2}
The keywords, arguments, and options are:
•
•
–
–
–
There can be multiple match port commands within a single class map. You may combine multiple match access-list and match port commands in a class map.
For example, to specify that the class map is to match on TCP port number 23 (Telnet client), enter:
host1/Admin(config)# class-map DNS_INSPECT_L4CLASShost1/Admin(config-cmap)# match port tcp eq 23To clear the TCP or UDP port number match criteria from the class map, enter:
host1/Admin(config-cmap)# no match port tcp eq 23Configuring a Layer 3 and Layer 4 Policy Map
This section outlines how to configure a Layer 3 and Layer 4 policy that defines an HTTP deep packet inspection, FTP command inspection, or application protocol inspection traffic policy.
This section includes the following topics:
•
•
•
•
Creating a Layer 3 and Layer 4 Policy Map
Use the policy-map multi-match configuration command to configure a Layer 3 and Layer 4 policy map that defines the application inspection policies. The ACE attempts to match multiple classes within the Layer 3 and Layer 4 policy map, but can match only one class within each of the sets of traffic classes. If a classification matches more than one class map, then the ACE executes all of the corresponding actions. However, for a specific feature, the ACE executes only the first matching classification action.
The syntax of this command is:
policy-map multi-match map_name
The map_name argument specifies the name assigned to the policy map. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
For example, to create a Layer 3 and Layer 4 network traffic policy map, enter:
host1/Admin(config)# policy-map multi-match HTTP_INSPECT_L4POLICYhost1/Admin(config-pmap)#The CLI displays the policy map configuration mode.
To remove a Layer 3 and Layer 4 policy map from the ACE, enter:
host1/Admin(config)# no policy-map multi-match HTTP_INSPECT_L4POLICYAdding a Layer 3 and Layer 4 Policy Map Description
Use the description command to provide a brief summary about the Layer 3 and Layer 4 policy map. Access the policy map configuration mode to specify the description command.
The syntax of this command is:
description text
Use the text argument to enter an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to specify a description that the policy map is to perform DNS application protocol inspection, enter:
host1/Admin(config-pmap)# description DNS application protocol inspection of incoming trafficTo remove the description from the policy map, enter:
host1/Admin(config-pmap)# no descriptionSpecifying a Layer 3 and Layer 4 Traffic Class with the Traffic Policy
To specify a traffic class created with the class-map command to associate network traffic with the traffic policy, use the class command. The syntax of this command is:
class map_name
The map_name argument specifies the name of a previously defined traffic class, configured with the class-map command, to associate traffic to the traffic policy. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
The CLI displays the policy map class configuration mode.
For example, to specify an existing class map within the Layer 3 and Layer 4 policy map, enter:
host1/Admin(config-pmap)# class HTTP_INSPECT_L4CLASShost1/Admin(config-pmap-c)#To remove a class map from a Layer 3 and Layer 4 policy map, enter:
host1/Admin(config-pmap)# no class HTTP_INSPECT_L4CLASSTo manually insert a class map ahead of a previously specified class map, use the insert-before command. The ACE does not save sequence reordering through the insert-before command as part of the configuration.
The syntax of this command is:
class map_name1 insert-before map_name2
The keywords and arguments are:
•
•
For example, to use the insert-before command to define the sequential order of two class maps in the policy map, enter:
host1/Admin(config-pmap-c)# 5 class FTP_INSPECT_L4CLASS insert-before HTTP_INSPECT_L4CLASSTo specify the class-default class map for the Layer 3 and Layer 4 traffic policy, use the class class-default command. All network traffic that fails to meet the other matching criteria in the named class map belongs to the default traffic class. If none of the specified classifications match, the ACE then matches the action specified under the class class-default command. The class-default class map has an implicit match any statement in it such that it matches all traffic.
For example, to use the class class-default command, enter:
host1/Admin(config-pmap)# class class-defaulthost1/Admin(config-pmap-c)#The CLI displays the policy map class configuration mode.
Defining Layer 3 and Layer 4 Application Protocol Inspection Policy Actions
Use the inspect command in policy map class configuration mode to define the Layer 3 and Layer 4 HTTP deep packet inspection, FTP command inspection, or application protocol inspection policy actions. Application inspection involves the examination of protocols such as DNS, FTP, HTTP, ICMP, and RTSP to verify the protocol behavior and identify unwanted or malicious traffic passing through the ACE.
If you intend to perform Layer 7 application inspection of network traffic, first create a Layer 7 policy as described below:
•
•
You associate the Layer 7 policy map within the appropriate Layer 3 and Layer 4 policy map to provide an entry point for the traffic classification. Layer 7 policy maps are considered to be child policies and can only be associated within an Layer 3 and Layer 4 policy map. Only a Layer 3 and Layer 4 policy map can be applied to a VLAN interface or applied globally to all VLAN interfaces in the same context; a Layer 7 policy map cannot be directly applied on an interface.
Note
The syntax of the inspect command for Layer 3 and Layer 4 application protocol inspection includes:
inspect dns [maximum-length bytes]
inspect ftp [strict policy policy_map1]
inspect http [policy policy_map2 | url-logging]
inspect icmp [error]
inspect rtsp
The keywords, arguments, and options are:
•
•
•
•
•
Note
•
•
Note
•
•
•
•
For example, to specify the inspect http command as an action for an HTTP application protocol inspection policy map, enter:
host1/Admin(config)# policy-map multi-match HTTP_INSPECT_L4POLICYhost1/Admin(config-pmap)# class HTTP_INSPECT_L4CLASShost1/Admin(config-pmap-c)# inspect http policy HTTP_DEEPINSPECT_L7POLICYFor example, to specify the inspect dns command as an action for a DNS application protocol inspection policy map, enter:
host1/Admin(config) #policy-map multi-match DNS_INSPECT_L4POLICYhost1/Admin(config-pmap) #class DNS_INSPECT_L4CLASShost1/Admin(config-pmap-c) inspect dns 1000For example, to specify the inspect ftp command as an action for an FTP command inspection policy map, enter:
host1/Admin(config)# policy-map multi-match FTP_INSPECT_L4POLICYhost1/Admin(config-pmap)# class FTP_INSPECT_L7CLASShost1/Admin(config-pmap-c)# inspect ftp strict policy FTP_INSPECT_L7POLICYhost1/Admin(config-pmap-c)# exithost1/Admin(config)#To disable an application protocol inspection action from a policy map, enter:
host1/Admin(config-pmap-c) no inspect dns 1000Configuring an HTTP Parameter Map for Use in a Layer 3 and Layer 4 Policy Map
A parameter map is a means to combine related actions for use in a Layer 3 and Layer 4 HTTP deep packet inspection policy map. You reference this parameter map in the appl-parameter command in policy map class configuration mode. See the "Associating an HTTP Parameter Map with a Layer 3 and Layer 4 Policy Map" section.
To configure advanced HTTP behavior for HTTP deep packet inspection, use the parameter-map type http command in configuration mode. The syntax of this command is:
parameter-map type http name
The name argument specifies the identifier assigned to the parameter map. Enter an unquoted text string with no spaces and a maximum of 32 alphanumeric characters.
This section includes the following procedures to define the advanced HTTP parameter map:
•
•
•
•
Disabling Case Sensitivity Matching
By default, the ACE CLI is case sensitive. To disable case sensitivity matching for HTTP only, use the case-insensitive command in HTTP parameter map configuration mode. With case-insensitive matching enabled, upper- and lower-case letters are considered the same. When case sensitivity is disabled, it applies to:
•
•
•
The syntax of this command is:
case-insensitive
For example, to disable case sensitivity, enter:
host1/Admin(config-parammap-http)# case-insensitiveTo reenable case-sensitive matching after it has been disabled, enter:
host1/Admin(config-parammap-http)# no case-insensitiveSetting the Maximum Number of Bytes to Parse in HTTP Headers
To set the maximum number of bytes to parse in HTTP headers, use the set header-maxparse-length command in HTTP parameter-map configuration mode. The syntax of this command is:
set header-maxparse-length bytes
The bytes argument specifies the maximum number of bytes to parse for HTTP headers. Enter an integer from 1 to 65535. The default is 2048 bytes.
For example, to set the HTTP header maximum parse length to 8192, enter:
host1/Admin(config-parammap-http)# set header-maxparse-length 8192To reset the HTTP header maximum parse length to the default of 2048 bytes, enter:
host1/Admin(config-parammap-http)# no set-header maxparse-lengthSetting the Maximum Number of Bytes to Parse in HTTP Content
To set the maximum number of bytes to parse in HTTP content, use the set content-maxparse-length command in HTTP parameter map configuration mode. The syntax of this command is:
set content-maxparse-length bytes
The bytes argument specifies the maximum number of bytes to parse in HTTP content. Enter an integer from 1 to 65535. The default is 4096 bytes.
For example, to set the maximum parse length to 8192, enter:
host1/Admin(config-parammap-http)# set content-maxparse-length 8192To reset the maximum parse length to the default of 4096 bytes, enter:
host1/Admin(config-parammap-http)# no set content-maxparse-lengthAssociating an HTTP Parameter Map with a Layer 3 and Layer 4 Policy Map
To associate an HTTP parameter map with a Layer 3 and Layer 4 policy map, use the appl-parameter http advanced-options command in policy map class configuration mode.
The syntax of this command is:
appl-parameter http advanced-options name
The name argument identifies the name of an existing HTTP parameter map. Parameter maps aggregate HTTP traffic-related actions together. For details, see the "Configuring an HTTP Parameter Map for Use in a Layer 3 and Layer 4 Policy Map" section.
For example, to specify the appl-parameter http advanced-options command as an action for the HTTP deep packet inspection policy map, enter:
host1/Admin(config)# policy-map multi-match HTTP_INSPECT_L4POLICYhost1/Admin(config-pmap)# class HTTP_INSPECT_L4CLASShost1/Admin(config-pmap-c)# appl-parameter http advanced-options HTTP_PARAM_MAP1To disassociate the HTTP parameter map as an action from the HTTP deep packet inspection policy map, enter:
host1/Admin(config-pmap-c)# no appl-parameter http advanced-options HTTP_PARAM_MAP1Applying a Service Policy
Use the service-policy command to:
•
•
•
The service-policy command is available at both the interface configuration mode and at the configuration mode. Specifying a policy map in the interface configuration mode applies the policy map to a specific VLAN interface. Specifying a policy map in the configuration mode applies the policy to all of the VLAN interfaces associated with a context.
The syntax of this command is:
service-policy input policy_name
The keywords, arguments, and options are:
•
•
For example, to specify a VLAN interface and apply multiple service policies to a VLAN, enter:
host1/Admin(config)# interface vlan 50host1/Admin(config-if)# ip address 172.16.1.100 255.255.255.0host1/Admin(config-if)# service-policy input FTP_INSPECT_L4POLICYhost1/Admin(config-if)# service-policy input HTTP_INSPECT_L4POLICYhost1/Admin(config-if)# service-policy input DNS_INSPECT_L4POLICYFor example, to globally apply multiple service policies to all of the VLANs associated with a context, enter:
host1/Admin(config)# service-policy input FTP_INSPECT_L4POLICYhost1/Admin(config)# service-policy input HTTP_INSPECT_L4POLICYhost1/Admin(config)# service-policy input DNS_INSPECT_L4POLICYTo detach a traffic policy from a VLAN interface, enter:
host1/Admin(config-if)# no service-policy input DNS_INSPECT_L4POLICYTo globally detach a traffic policy from all VLANs associated with a context, enter:
host1/Admin(config)# no service-policy input DNS_INSPECT_L4POLICYWhen you detach a traffic policy either:
•
•
the ACE automatically resets the associated service policy statistics. The ACE performs this action to provide a new starting point for the service policy statistics the next time you attach a traffic policy to a specific VLAN interface or globally to all VLAN interfaces in the same context.
Note the following when creating a service policy:
•
•
•
Viewing Application Protocol Inspection Statistics and Service Policy Information
The ACE CLI provides a comprehensive set of show commands that display application protocol inspection statistics and service policy configuration information. This section includes the following topics:
•
•
Displaying HTTP Protocol Inspection Statistics
To display HTTP protocol inspection statistics, use the show stats inspect http command. The syntax for this command is:
show stats inspect http
For example, enter:
host1/Admin# show stats inspect http+------------------------------------------++--------- HTTP Inspect statistics --------++------------------------------------------+Total request/response : 0Total allow decisions : 0Total drop decisions : 0Total logging decisions : 0Use the clear stats inspect http command to clear the HTTP protocol inspection statistics.
Table 3-9 describes the fields in the show stats inspect command output.
Displaying Service Policy Configuration Information
To display service policy statistics use the show service-policy command in Exec mode. The statistics that appear in the output are dependent on the configuration of the associated Layer 3 and Layer 4 policy map. The show service-policy command displays following information:
•
•
•
The syntax of this command is:
show service-policy policy_name [detail]
The keywords, options, and arguments are as follows:
•
•
Note
For example, to display service policy statistics for the HTTP_INSPECT_L4POLICY policy map, enter:
host1/Admin# show service-policy HTTP_INSPECT_L4POLICYStatus : ACTIVEDescription: HTTP protocol deep inspection of incoming traffic-----------------------------------------Interface: vlan 40service-policy: HTTP_INSPECT_L4POLICYclass: HTTP_INSPECT_L4CLASSinspect http:curr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0L4 policy stats:TotalReq/Resp: 0 TotalAllowed: 0TotalDropped : 0 TotalLogged : 0L7 policy: HTTP_INSPECT_L7POLICY, url logging: disabledL7 policy stats: Total number of L7 rules 1L7 class/match HTTP_INSPECT_L7CLASS: resetTotalInspected : 0 TotalMatched: 0TotalDroppedOnError: 0 TotalLogged : 0For example, to display service policy statistics for the FTP_INSPECT_L4POLICY policy map, enter:
Status : ACTIVEDescription: FTP command inspection of incoming traffic-----------------------------------------Context Global Policy:service-policy: FTP_INSPECT_L4POLICYclass: class-defaultinspect ftp:strict ftp: ENABLEDcurr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0L7 policy: FTP_INSPECT_L4POLICYTotalReplyMasked : 0 TotalDropped: 0For example, to display service policy statistics for the APP_INSPECT_L4POLICY policy map, enter:
Status : ACTIVE-----------------------------------------Context Global Policy:service-policy: APP_INSPECT_L4POLICYclass: APP_INSPECT_L4CLASSinspect dns:max length: 0curr conns : 0 , hit count : 0dropped conns : 0client pkt count : 0 , client byte count: 0server pkt count : 0 , server byte count: 0To clear the service policy statistics, use the clear service-policy command. The syntax of this command is:
clear service-policy policy_name
For the policy_name argument, enter the identifier of an existing policy map that is currently in service (applied to an interface).
For example, to clear the statistics for the policy map HTTP_INSPECT_L4POLICY that is currently in service, enter:
host1/Admin# clear service-policy HTTP_INSPECT_L4POLICYTable 3-10 describes the fields in the show service-policy detail command output for an application protocol inspection policy map.
