HTTP Inspection Engine
The HTTP Inspection Engine feature allows users to configure their Cisco IOS Firewall to detect and prohibit HTTP connections--such as tunneling over port 80, unauthorized request methods, and non-HTTP compliant file transfers--that are not authorized within the scope of the security policy configuration. Tunneling unauthorized protocols through port 80 and over HTTP exposes a network to significant security risks.
The Cisco IOS Firewall can now be configured with a security policy that adheres to the following tasks:
- Allowing specific traffic targeted for port 80 to traverse the firewall. The traffic is inspected for protocol conformance and for the types of HTTP commands that are allowed or disallowed.
- Denying specific traffic targeted for port 80 that does not comply to HTTP traffic standards. The firewall is enabled to drop the packet, reset the connection, and send a syslog message, as appropriate.
Feature History for HTTP Inspection Engine
|
Release |
Modification |
|---|---|
|
12.3(14)T |
This feature was introduced. |
- Finding Feature Information
- Restrictions for HTTP Inspection Engine
- Information About HTTP Inspection Engine
- How to Define and Apply an HTTP Application Policy to a Firewall for Inspection
- Configuration Examples for Setting Up an HTTP Inspection Engine
- Additional References
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Restrictions for HTTP Inspection Engine
The Cisco 831 router with 48M RAM does not have enough memory to support this feature.
Information About HTTP Inspection Engine
Before configuring an application firewall to detect and police specific traffic targeted for port 80, you should understand the following concepts:
What Is a Security Policy
The application firewall uses a security policy, which consists of a collection of static signatures, to detect security violations. A static signature is a collection of parameters that specify protocol conditions that must be met before an action is taken. (For example, a signature may specify that an HTTP data stream containing the POST method must reset the connection.) These protocol conditions and reactions are defined by the end user via the command-line interface (CLI) to form a security policy.
Cisco IOS HTTP Application Policy Overview
HTTP uses port 80 to transport Internet web services, which are commonly used on the network and rarely challenged with regards to their legitimacy and conformance to standards. Because port 80 traffic is typically allowed through the network without being challenged, many application developers are leveraging HTTP traffic as an alternative transport protocol in which to enable their application to travel through or even bypass the firewall.
Most firewalls provide only packet filtering capabilities that simply permit or deny port 80 traffic without inspecting the data stream; the Cisco IOS application firewall for HTTP performs packet inspection as follows:
- Detects HTTP connections that are not authorized within the scope of the security policy configuration.
- Detects users who are tunneling applications through port 80.
If the packet is not in compliance with the HTTP protocol, it will be dropped, the connection will be reset, and a syslog message will be generated, as appropriate.
How to Define and Apply an HTTP Application Policy to a Firewall for Inspection
Defining an HTTP Application Policy
Use this task to create an HTTP application firewall policy.
 Note | Although application firewall policies are defined in global configuration mode, only one global policy for a given protocol is allowed per interface. > |
1.
enable
2.
configure
terminal
3. appfw policy-name policy-name
4.
application
protocol
5. strict-http action {reset | allow} [alarm]
6. content-length {min bytes max bytes | min bytes | max bytes} action {reset | allow} [alarm]
7. content-type-verification [match-req-resp] action {reset | allow} [alarm]
8. max-header-length {request bytes response bytes} action {reset | allow} [alarm]
9. max-uri-length bytes action {reset | allow} [alarm]
10. request method {rfc rfc-method | extension extension-method} action {reset | allow} [alarm]
11. port-misuse {p2p | tunneling | im | default} action {reset | allow} [alarm]
12. transfer-encoding type {chunked | compress | deflate | gzip | identity | default} action {reset | allow} [alarm]
13.
timeout
seconds
14. audit-trail {on | off}
15.
end
DETAILED STEPS
What to Do Next
After you have successfully defined an application policy for HTTP traffic inspection, you must apply the policy to an inspection rule. Thereafter, the inspection rule must be applied to an interface. For information on completing this task, see the section “Applying an HTTP Application Policy to a Firewall for Inspection.”
Applying an HTTP Application Policy to a Firewall for Inspection
Use this task to apply an HTTP application policy to an inspection rule, followed by applying the inspection rule to an interface.
Note | An application policy can coexist with other inspection protocols (for example, an HTTP policy and an FTP policy can coexist). |
You must have already defined an application policy (as shown in the section “Defining an HTTP Application Policy”).
or
show ip inspect name inspection-name | config | interfaces | session [detail] | statistics | all}
1.
enable
2.
configure
terminal
3.
ip
inspect
name
inspection-name
appfw
policy-name
4.
ip
inspect
name
inspection-name
http
[alert {on | off}] [audit-trail {on | off}] [timeout seconds]
5.
interface
type
number
6.
ip
inspect
inspection-name
in
| out}
7.
exit
8.
exit
9. show appfw configuration [name]
DETAILED STEPS
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable
Example: Router> enable |
Enables privileged EXEC mode.
|
| Step 2 |
configure
terminal
Example: Router# configure terminal |
Enters global configuration mode. |
| Step 3 |
ip
inspect
name
inspection-name
appfw
policy-name
Example: Router(config)# ip inspect name firewall appfw mypolicy |
Defines a set of inspection rules for the application policy.
|
| Step 4 |
ip
inspect
name
inspection-name
http
[alert {on | off}] [audit-trail {on | off}] [timeout seconds]
Example: Router(config)# ip inspect name firewall http |
Defines a set of inspection rules that is to be applied to all HTTP traffic.
|
| Step 5 |
interface
type
number
Example: Router#(config)# interface FastEthernet0/0 |
Configures an interface type and enters interface configuration mode. |
| Step 6 |
ip
inspect
inspection-name
in
| out}
Example: Router#(config-if)# ip inspect firewall in |
Applies the inspection rules (defined in Step 3 and Step 4) to all traffic entering the specified interface.
|
| Step 7 |
exit
Example: Router#(config-if)# exit | Exits interface configuration mode. |
| Step 8 |
exit
Example: Router(config)# exit | Exits global configuration mode. |
| Step 9 |
show appfw configuration [name]
Example: Router# show appfw configuration Example: Example: or Example:
show ip inspect {name inspection-name | config | interfaces | session [detail] | statistics |
all}
Example: Router# show ip inspect config | (Optional) Displays application firewall policy configuration information. (Optional) Displays firewall-related configuration information. |
Troubleshooting Tips
To help troubleshoot the application firewall configuration, issue the following application-firewall specific debug command: debug appfw application protocol | function-trace | object-creation | object-deletion | events | timers | detailed} .
The following sample configuration shows how to configure an HTTP policy with application firewall debugging enabled:
Router(config)# appfw policy-name myPolicyAPPFW FUNC:appfw_policy_find
APPFW FUNC:appfw_policy_find -- Policy myPolicy is not found
APPFW FUNC:appfw_policy_alloc
APPFW FUNC:appfw_policy_alloc -- policy_alloc 0x65727278
APPFW FUNC:appfw_policy_alloc -- Policy 0x65727278 is set to valid
APPFW FUNC:appfw_policy_alloc -- Policy myPolicy has been created
APPFW FUNC:appfw_policy_command -- memlock policy 0x65727278
! Debugging sample for application (HTTP) creation
Router(cfg-appfw-policy)# application httpAPPFW FUNC:appfw_http_command
APPFW FUNC:appfw_http_appl_find
APPFW FUNC:appfw_http_appl_find -- Application not found
APPFW FUNC:appfw_http_appl_alloc
APPFW FUNC:appfw_http_appl_alloc -- appl_http 0x64D7A25C
APPFW FUNC:appfw_http_appl_alloc -- Application HTTP parser structure 64D7A25C created
! Debugging sample for HTTP-specific application inspection
Router(cfg-appfw-policy-http)#
Router(cfg-appfw-policy-http)# strict-http action reset alarm
APPFW FUNC:appfw_http_subcommand
APPFW FUNC:appfw_http_subcommand -- strict-http cmd turned on
Router# debug appfw detailed
APPFW Detailed Debug debugging is on
fw7-7206a#debug appfw object-creation
APPFW Object Creations debugging is on
fw7-7206a#debug appfw object-deletion
APPFW Object Deletions debugging is on
Configuration Examples for Setting Up an HTTP Inspection Engine
Setting Up and Verifying an HTTP Inspection Engine Example
The following example show how to define the HTTP application firewall policy “mypolicy.” This policy includes all supported HTTP policy rules. This example also includes sample output from the show appfw configuration and show ip inspect config commands, which allow you to verify the configured setting for the application policy.
! Define the HTTP policy.
appfw policy-name mypolicy
application http
strict-http action allow alarm
content-length maximum 1 action allow alarm
content-type-verification match-req-rsp action allow alarm
max-header-length request 1 response 1 action allow alarm
max-uri-length 1 action allow alarm
port-misuse default action allow alarm
request-method rfc put action allow alarm
transfer-encoding type default action allow alarm
!
!
! Apply the policy to an inspection rule.
ip inspect name firewall appfw mypolicy
ip inspect name firewall http
!
!
! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.
interface FastEthernet0/0
ip inspect firewall in
!
!
! Issue the show appfw configuration
command and the show ip inspect config
command after the inspection rule “mypolicy” is applied to all incoming HTTP traffic on the FastEthernet0/0 interface.
!
Router# show appfw configuration
Application Firewall Rule configuration
Application Policy name mypolicy
Application http
strict-http action allow alarm
content-length minimum 0 maximum 1 action allow alarm
content-type-verification match-req-rsp action allow alarm
max-header-length request length 1 response length 1 action allow alarm
max-uri-length 1 action allow alarm
port-misuse default action allow alarm
request-method rfc put action allow alarm
transfer-encoding default action allow alarm
Router# show ip inspect config
Session audit trail is disabled
Session alert is enabled
one-minute (sampling period) thresholds are [400:500] connections
max-incomplete sessions thresholds are [400:500]
max-incomplete tcp connections per host is 50. Block-time 0 minute.
tcp synwait-time is 30 sec -- tcp finwait-time is 5 sec
tcp idle-time is 3600 sec -- udp idle-time is 30 sec
dns-timeout is 5 sec
Inspection Rule Configuration
Inspection name firewall
http alert is on audit-trail is off timeout 3600
Additional References
The following sections provide references related to the HTTP Inspection Engine feature.
Related Documents
|
Related Topic |
Document Title |
|---|---|
|
Firewall commands: complete command syntax, command mode, defaults, usage guidelines, and examples |
Cisco IOS Security Command Reference |
Standards
|
Standards |
Title |
|---|---|
|
No new or modified standards are supported by this feature. |
-- |
MIBs
|
MIBs |
MIBs Link |
|---|---|
|
No new or modified MIBs are supported by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFCs
|
RFCs |
Title |
|---|---|
|
RFC 2616 |
Technical Assistance
|
Description |
Link |
|---|---|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
Feedback