Hi community
One of our customers is facing a porblem with the default HTTP inspection (page loads slowly). I now tried to exclude this specific range via the MPF of the ASA (IPs are just for example):
access-list http-inspection extended deny tcp host 172.22.10.50 host 8.8.8.8 eq www
class-map http-inspection
match access-list http-inspection
policy-map global_policy
class inspection_default
inspect icmp
<snip>
inspect ip-options
class http-inspection
inspect http
The packet-tracer shows, that with this ACL only traffic from 172.22.10.50 to 8.8.8.8 is inspected. Traffic from 172.22.10.50 to 7.7.7.7 for example is not expected. I tried to modify the ACL to a permit:
access-list http-inspection extended permit tcp host 172.22.10.50 host 8.8.8.8 eq www
In the packet-tracer this shows me the exact same result. I checked this option in the ASDM. There is an option for "DO NOT MATCH" and the ACL is with a deny statement. From this I would assume that it is possible to exclude some traffic from the inspection.
Has anyone a solution on this?
Regards
Matthias
