topic Problem with HTTP inspection. in Network Security

Problem with HTTP inspection.

gloubier — Mon, 11 Mar 2019 21:54:12 GMT

Hi,

I would like to find a way to give access to one website ( let say cisco.com ), give access to whatever website that have the word "test" in the URL and block the access to all the other websites for only one server ( let say the_server ).

Here the config I have now :

regex cisco.com "\.cisco\.com"

regex test "test"

regex all ".*"

access-list acl_test extended permit tcp object GLOUBIER any eq www

class-map inside-test

match access-list acl_test

class-map type inspect http match-all http_url_filtering_test

match request header host regex cisco.com

class-map type inspect http match-all http_url_filtering_test2

match request uri regex test

class-map type inspect http match-all http_url_filtering_test3

match request header host regex all

policy-map type inspect http http_url_inspection_test

parameters

class http_url_filtering_test

log

class http_url_filtering_test2

log

class http_url_filtering_test3

drop-connection

policy-map inside-policy

class inside-test

inspect http http_url_inspection_test

Those rules aren't working ( everything is blocked ), but if I'm try each class-map individualy, it's working fine.

Is there a way to make the 3 rules ( allow cisco.com, allow word test in URL, block the rest ) work together ?

Thanks for the answers and help.

Problem with HTTP inspection.

mirober2 — Wed, 30 Nov 2011 18:17:11 GMT

Hello,

I would suggest flipping your logic around to drop everything that doesn't match your allowed requests like this:

regex cisco.com "cisco\.com"
regex test "test"
!
access-list acl_test extended permit tcp object GLOUBIER any eq www 
!
class-map inside-test
   match access-list acl_test
!
class-map type inspect http match-all filter-class
   match not request header host regex cisco.com
   match not request uri regex test
!
policy-map type inspect http filter-policy
   parameters
   class filter-class
      drop-connection
policy-map inside-policy
   class inside-test
      inspect http filter-policy

That makes the config a bit more manageable and should do what you are looking for.

-Mike

Problem with HTTP inspection.

gloubier — Thu, 08 Dec 2011 20:02:32 GMT

That solution makes sense.

I'll try that in the next days and let you know if it fixe my problem or not.

Thanks for the reply.