ASA exclude

Matthias Jeker — Tue, 12 Mar 2019 05:39:31 GMT

Hi community

One of our customers is facing a porblem with the default HTTP inspection (page loads slowly). I now tried to exclude this specific range via the MPF of the ASA (IPs are just for example):

access-list http-inspection extended deny tcp host 172.22.10.50 host 8.8.8.8 eq www

class-map http-inspection
match access-list http-inspection

policy-map global_policy
class inspection_default
inspect icmp
<snip>
inspect ip-options
class http-inspection
inspect http

The packet-tracer shows, that with this ACL only traffic from 172.22.10.50 to 8.8.8.8 is inspected. Traffic from 172.22.10.50 to 7.7.7.7 for example is not expected. I tried to modify the ACL to a permit:

access-list http-inspection extended permit tcp host 172.22.10.50 host 8.8.8.8 eq www

In the packet-tracer this shows me the exact same result. I checked this option in the ASDM. There is an option for "DO NOT MATCH" and the ACL is with a deny statement. From this I would assume that it is possible to exclude some traffic from the inspection.

Has anyone a solution on this?

Regards

Matthias

push

Matthias Jeker — Fri, 20 Mar 2015 07:37:02 GMT

*push*

Solved. This is a bug in the

Matthias Jeker — Tue, 24 Mar 2015 07:39:01 GMT

Solved. This is a bug in the packet-tracer which doesn't look up the MPF correctly. You should use show service-policy flow instead.

topic ASA exclude in Network Security

ASA exclude

*push*

Solved. This is a bug in the

push