topic Re: ASA - Inspecting HTTP traffic to URL in Network Security

ASA - Inspecting HTTP traffic to URL

ciscors — Mon, 11 Mar 2019 10:38:40 GMT

I'm trying to block access to lycos.com and doing it this way but it's not working

regex regex_lycos "www.lycos.com"

class-map cmap_test

class-map type regex match-any cmap_regex1

match regex regex_lycos

class-map type inspect http match-all http_traffic

match request uri regex class cmap_regex1

policy-map type inspect http pmap_http

parameters

class http_traffic

reset log

policy-map pmap3

class cmap_test

inspect http pmap_http

service-policy pmap3 interface inside

service-policy pmap3 interface outside

Here is the output of my 'show service-policy' commands after going to lycos.com. The connection was allowed and nothing was blocked

H(config)# sh service-policy int inside

Interface inside:

Service-policy: pmap3

Class-map: cmap_test

Inspect: http pmap_http, packet 0, drop 0, reset-drop 0

H(config)# sh service-policy int ou

Interface outside:

Service-policy: pmap3

Class-map: cmap_test

Inspect: http pmap_http, packet 0, drop 0, reset-drop 0

Re: ASA - Inspecting HTTP traffic to URL

a-vazquez — Fri, 06 Jul 2007 19:38:42 GMT

The enhanced HTTP inspection feature, which is also known as an application firewall and is available when you configure an HTTP map can help prevent attackers from using HTTP messages for circumventing network security policy.

Refer this link:

http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/inspect.html#wp1431359

Re: ASA - Inspecting HTTP traffic to URL

sridharvaidyanathan — Wed, 22 Aug 2007 15:06:53 GMT

Hi,

Try replacing the following command,

regex regex_lycos "www.lycos.com"

with

regex regex_lycos "w{3}\.lycos\.com"

Rate it if it helps.

Regards,

Sridhar.