topic Re: PIX inspect http problem in Network Security

PIX inspect http problem

george.goebel — Mon, 11 Mar 2019 11:27:35 GMT

WE have our PIX version 7.2(2) using http inspection and set to drop protocol violations. The problem is, that it drops the Microsoft Updates. Anybody have an idea how to allow the MS Updates to work while still using the inspect http policy.

Re: PIX inspect http problem

JORGE RODRIGUEZ — Fri, 19 Oct 2007 16:00:07 GMT

George, I believe you would have to work with creating policy and class-map to classify certain traffic, by default global policy does not inspect http but since you have altered this you would need to create a policy whereby you can apply acl to allow certain http traffic to not be ispected.

I have not done this as we have websence for filtering http but have read about it, if someone can point a good link that will be great or if there is any other way to do it.. if I find a good example link I will posted.

Rgds

Jorge

Re: PIX inspect http problem

JORGE RODRIGUEZ — Sat, 20 Oct 2007 03:38:12 GMT

George, this is the link you would want to reference , applying application layer protocol inspection, this covers module policy framework and class-maps for your particular request.

http://www.cisco.com/en/US/customer/docs/security/asa/asa72/configuration/guide/inspect.html

Re: PIX inspect http problem

george.goebel — Mon, 22 Oct 2007 15:36:00 GMT

Thanks. It took a little head scratching but it works now.