I would go with the PIX Firewall, you can use the Application-Aware Inspection Services with the new code
check the configuration example below:
Create a class-map for http inspection
pix(config)# class-map http-port
pix(config-cmap)# match port tcp eq 80
pix(config-cmap)# exit
Create an http-map to specify parameters for inspect http
pix(config)# http-map inbound_http
pix(config-http-map)# content-length min 100 max 2000 action reset log
pix(config-http-map)# content-type-verification match-req-rsp action reset log
pix(config-http-map)# max-header-length request 100 action reset log
pix(config-http-map)# max-uri-length 100 action reset log
pix(config-http-map)# port-misuse p2p action drop
pix(config-http-map)# port-misuse im action drop
pix(config-http-map)# port-misuse default action allow
pix(config-http-map)# exit
Create a policy-map for http inspection
* pix(config)# policy-map inbound_policy
pix(config-pmap)# class http-port
pix(config-pmap-c)# inspect http inbound_http
pix(config-pmap-c)# exit
pix(config-pmap)# exit
If necessary create a service-policy or use the default-inspection policy
pix(config)# service-policy inbound_policy interface outside
This ends up in the config as:
--------------------------------------------------------------------------
class-map http-port
match port tcp eq 80
class-map http-port8080
match port tcp eq 8080
…
http-map inbound_http
content-length min 100 max 2000 action reset log
content-type-verification match-req-rsp action reset log
max-header-length request 100 action reset log
max-uri-length 100 action reset log
port-misuse p2p action drop
port-misuse im action drop
port-misuse default action allow
…
policy-map inbound_policy
class http-port
inspect http inbound_http
class http-port8080
inspect http inbound_http
…
service-policy inbound_policy interface outside
If you notice, you can add more ports via class-maps which tie to the inbound_policy we
created to tie to the interface. I haven't tested this yet but you can set the
port-misuse default action to allow which we did above so you should be able to inspect
other ports that are being used without blocking anything that you're currently doing as
long as the P2P/IM headers aren't found in the packets.
Essentially this will cause the pix to block the IM/P2P applications while still allowing
normal traffic over port 80/8080.
also here is the link to PIX 7.0 and ASA CLI architecture. This should be a comprehensive
reference in configuring your 7.0 PIX at the CLI level.
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_book09186a0080485008.html
Franco Zamora
