topic Re: ACE: WebDAV Traffic dropped by inspection in Application Networking

ACE: WebDAV Traffic dropped by inspection

Roble Mumin — Mon, 14 Jan 2008 14:11:24 GMT

I terminate http and https on the ACE. Within the L4 multi-match policy exists a class for inspection purpose.

The class itself filters on

port misuse p2p

port misuse im

port misuse tunnel

The action for a valid match is reset.

Somehow WebDAV traffic gets matched by any of the above criteria.

The only chance i have to enable WebDAV is to disable/remove the inspection from the multi-match policy.

Is this a "works as designed", "possible bug" or "bad configuration" issue?

Thanks for reading.

Roble

Re: ACE: WebDAV Traffic dropped by inspection

Gilles Dufour — Mon, 14 Jan 2008 15:49:20 GMT

we can't really say it was designed like this.

Now, it could be that webdav behavior is similar to any of the protocol in the list.

Do you know if the problem is for any of the protocols listed or one in particular ?? Did you try just one of them in your match statement ?

Also, do you have a trace when this occurs so we can look at the webdav request ?

Thanks,

Gilles.

Re: ACE: WebDAV Traffic dropped by inspection

Roble Mumin — Mon, 14 Jan 2008 16:12:17 GMT

Hey Gilles...

The funny thing is any of the single statements causes match.

When the class map is filled with only one "qualifier" e.g. port-misuse p2p the inspection engine drops the packet. I tried it with every single statement. Even when the class map is empty it will drop the WebDAV packets.

I was thinking about a possible whitelist the WebDAV traffic and use the port-misuse statements as blacklist approach.

Currently i am not yet sure how to identify WebDAV Traffic within a class map.

I sniffed the connection and the only thing i see is a "regular" RST packet after the WebDAV Method "PROPFIND".

That is all i could find out so far. In my opinion this could be another bug. Because i see no reason to mark WebDAV traffic as malicious content.

But i would also face a "what the heck have you configured there" statement as long as it helps. 🙂

Roble

Re: ACE: WebDAV Traffic dropped by inspection

Gilles Dufour — Mon, 14 Jan 2008 16:57:22 GMT

ok.

I can see the same behavior in my lab.

I will investigate.

Gilles.

Re: ACE: WebDAV Traffic dropped by inspection

Roble Mumin — Tue, 15 Jan 2008 09:15:20 GMT

Great to hear you could reproduce that behavior. So i probably end up with TAC-Call and a DevImage fixing this.

Roble

Re: ACE: WebDAV Traffic dropped by inspection

Gilles Dufour — Tue, 15 Jan 2008 11:09:38 GMT

Roble,

after some digging in the code and a discussion with the person in charge of this feature, it appears that webdav is not supported by http inspect. the http method propfind is rejected by http inspect.

This is not considered a bug.

But I believe we might add it with a feature request.

Gilles.

Re: ACE: WebDAV Traffic dropped by inspection

Roble Mumin — Tue, 15 Jan 2008 12:02:39 GMT

The way to go from here is TAC-Call with a feature request? Or is there another approach i should take?

Anyhow thanks for clearing up the issue.

Roble