Downloads |
Table Of Contents
Restrictions for HTTP Inspection Engine
Information About HTTP Inspection Engine
Cisco IOS HTTP Application Policy Overview
How to Define and Apply an HTTP Application Policy to a Firewall for Inspection
Defining an HTTP Application Policy
Applying an HTTP Application Policy to a Firewall for Inspection
Configuration Examples for Setting Up an HTTP Inspection Engine
Setting Up and Verifying an HTTP Inspection Engine: Example
HTTP Inspection Engine
The HTTP Inspection Engine feature allows users to configure their Cisco IOS Firewall to detect and prohibit HTTP connections—such as tunneling over port 80, unauthorized request methods, and non-HTTP compliant file transfers—that are not authorized within the scope of the security policy configuration. Tunneling unauthorized protocols through port 80 and over HTTP exposes a network to significant security risks.
The Cisco IOS Firewall can now be configured with a security policy that adheres to the following tasks:
•
Allowing specific traffic targeted for port 80 to traverse the firewall. The traffic is inspected for protocol conformance and for the types of HTTP commands that are allowed or disallowed.
•
Feature History for HTTP Inspection Engine
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
•
•
•
Restrictions for HTTP Inspection Engine
The Cisco 831 router with 48M RAM does not have enough memory to support this feature.
Information About HTTP Inspection Engine
Before configuring an application firewall to detect and police specific traffic targeted for port 80, you should understand the following concepts:
•
What Is a Security Policy?
The application firewall uses a security policy, which consists of a collection of static signatures, to detect security violations. A static signature is a collection of parameters that specify protocol conditions that must be met before an action is taken. (For example, a signature may specify that an HTTP data stream containing the POST method must reset the connection.) These protocol conditions and reactions are defined by the end user via the command-line interface (CLI) to form a security policy.
Cisco IOS HTTP Application Policy Overview
HTTP uses port 80 to transport Internet web services, which are commonly used on the network and rarely challenged with regards to their legitimacy and conformance to standards. Because port 80 traffic is typically allowed through the network without being challenged, many application developers are leveraging HTTP traffic as an alternative transport protocol in which to enable their application to travel through or even bypass the firewall.
Most firewalls provide only packet filtering capabilities that simply permit or deny port 80 traffic without inspecting the data stream; the Cisco IOS application firewall for HTTP performs packet inspection as follows:
•
•
If the packet is not in compliance with the HTTP protocol, it will be dropped, the connection will be reset, and a syslog message will be generated, as appropriate.
How to Define and Apply an HTTP Application Policy to a Firewall for Inspection
This section contains the following procedures:
•
•
Defining an HTTP Application Policy
Use this task to create an HTTP application firewall policy.
Restrictions
Although application firewall policies are defined in global configuration mode, only one global policy for a given protocol is allowed per interface.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
DETAILED STEPS
What to Do Next
After you have successfully defined an application policy for HTTP traffic inspection, you must apply the policy to an inspection rule. Thereafter, the inspection rule must be applied to an interface. For information on completing this task, see the section "Applying an HTTP Application Policy to a Firewall for Inspection."
Applying an HTTP Application Policy to a Firewall for Inspection
Use this task to apply an HTTP application policy to an inspection rule, followed by applying the inspection rule to an interface.
Note
Prerequisites
You must have already defined an application policy (as shown in the section "Defining an HTTP Application Policy").
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
or
show ip inspect {name inspection-name | config | interfaces | session [detail] | statistics | all}
DETAILED STEPS
Troubleshooting Tips
To help troubleshoot the application firewall configuration, issue the following application-firewall specific debug command: debug appfw {application protocol | function-trace | object-creation | object-deletion | events | timers | detailed}.
The following sample configuration shows how to configure an HTTP policy with application firewall debugging enabled:
Router(config)# appfw policy-name myPolicyAPPFW FUNC:appfw_policy_findAPPFW FUNC:appfw_policy_find -- Policy myPolicy is not foundAPPFW FUNC:appfw_policy_allocAPPFW FUNC:appfw_policy_alloc -- policy_alloc 0x65727278APPFW FUNC:appfw_policy_alloc -- Policy 0x65727278 is set to validAPPFW FUNC:appfw_policy_alloc -- Policy myPolicy has been createdAPPFW FUNC:appfw_policy_command -- memlock policy 0x65727278! Debugging sample for application (HTTP) creationRouter(cfg-appfw-policy)# application httpAPPFW FUNC:appfw_http_commandAPPFW FUNC:appfw_http_appl_findAPPFW FUNC:appfw_http_appl_find -- Application not foundAPPFW FUNC:appfw_http_appl_allocAPPFW FUNC:appfw_http_appl_alloc -- appl_http 0x64D7A25CAPPFW FUNC:appfw_http_appl_alloc -- Application HTTP parser structure 64D7A25C created! Debugging sample for HTTP-specific application inspectionRouter(cfg-appfw-policy-http)#Router(cfg-appfw-policy-http)# strict-http action reset alarmAPPFW FUNC:appfw_http_subcommandAPPFW FUNC:appfw_http_subcommand -- strict-http cmd turned onRouter# debug appfw detailedAPPFW Detailed Debug debugging is onfw7-7206a#debug appfw object-creationAPPFW Object Creations debugging is onfw7-7206a#debug appfw object-deletionAPPFW Object Deletions debugging is onConfiguration Examples for Setting Up an HTTP Inspection Engine
This section contains the following configuration example:
•
Setting Up and Verifying an HTTP Inspection Engine: Example
The following example show how to define the HTTP application firewall policy "mypolicy." This policy includes all supported HTTP policy rules. This example also includes sample output from the show appfw configuration and show ip inspect config commands, which allow you to verify the configured setting for the application policy.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc put action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!! Issue the show appfw configuration command and the show ip inspect config command after the inspection rule "mypolicy" is applied to all incoming HTTP traffic on the FastEthernet0/0 interface.!Router# show appfw configurationApplication Firewall Rule configurationApplication Policy name mypolicyApplication httpstrict-http action allow alarmcontent-length minimum 0 maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request length 1 response length 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc put action allow alarmtransfer-encoding default action allow alarmRouter# show ip inspect configSession audit trail is disabledSession alert is enabledone-minute (sampling period) thresholds are [400:500] connectionsmax-incomplete sessions thresholds are [400:500]max-incomplete tcp connections per host is 50. Block-time 0 minute.tcp synwait-time is 30 sec -- tcp finwait-time is 5 sectcp idle-time is 3600 sec -- udp idle-time is 30 secdns-timeout is 5 secInspection Rule ConfigurationInspection name firewallhttp alert is on audit-trail is off timeout 3600Additional References
The following sections provide references related to the HTTP Inspection Engine feature.
Related Documents
Firewall commands: complete command syntax, command mode, defaults, usage guidelines, and examples
Standards
MIBs
RFCs
Technical Assistance
Command Reference
The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS Security Command Reference at http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.
New Commands
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Modified Command
•
CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.
