Are you sure you were able to attach two policy-maps to the same interface simultaneously?interface vlan 300 service-policy input test_https_policy service-policy input test_nat_policy
Capture the traffic and check if the cookie appears in the HTTP header too (Set-Cookie: JSESSIONID=xxx). If so, try to match that one. In my Oracle experience the cookie name was all upper case.Peter
