Hi,all:
my config like this:
Class Map match-all 1 (id 3)
Match protocol dns
Class Map match-all 2 (id 4)
Match protocol http host "*cisco.com*"
Class Map match-all 3 (id 5)
Match not class-map 1
Match not class-map 2
Policy Map 1
Class 1
Class 2
Class 3
drop
I want deny all web access except to cisco.com
If i not use "drop" command in class 3,i can see packets match stats in class 2 when i use command "show policy-map interface";but if i use "drop" command in class 3,all http packets will be droped,i can't access the cisco.com,and there is any packets match stats in class 2,but class 1 and class 3's match stats grow up correct,i try some other way for class 3,like:
class 3
match class class-default
or
class 3
match any
or
class 3
match access-group xxx
but all fail,the router drop all http packets as long as "drop" command be used in class3.
please help me,thx
