-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 4.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show debug -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config logging -- show running-config vpn-sessiondb
-
show service-policy -- show xlate
-
shun -- sysopt uauth allow-http-cache
-
- T through Z Commands
-
Feedback
Table Of Contents
gateway through http-map Commands
http authentication-certificate
gateway through http-map Commands
gateway
To specify which group of call agents are managing a particular gateway, use the gateway command in MGCP map configuration mode. To remove the configuration, use the no form of this command.
gateway ip_address [group_id]
Syntax Description
gateway
Specifies the group of call agents that are managing a particular gateway.
group_id
The ID of the call agent group, from 0 to 2147483647.
ip_address
The IP address of the gateway.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Mgcp map configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the gateway command to specify which group of call agents are managing a particular gateway. The IP address of the gateway is specified with the ip_address option. The group_id option is a number from 0 to 4294967295 that must correspond with the group_id of the call agents that are managing the gateway. A gateway may only belong to one group.
Examples
The following example allows call agents 10.10.11.5 and 10.10.11.6 to control gateway 10.10.10.115, and allows call agents 10.10.11.7 and 10.10.11.8 to control both gateways 10.10.10.116 and 10.10.10.117:
hostname(config)# mgcp-map mgcp_policyhostname(config-mgcp-map)# call-agent 10.10.11.5 101hostname(config-mgcp-map)# call-agent 10.10.11.6 101hostname(config-mgcp-map)# call-agent 10.10.11.7 102hostname(config-mgcp-map)# call-agent 10.10.11.8 102hostname(config-mgcp-map)# gateway 10.10.10.115 101hostname(config-mgcp-map)# gateway 10.10.10.116 102hostname(config-mgcp-map)# gateway 10.10.10.117 102Related Commands
global
To create a pool of mapped addresses for NAT, use the global command in global configuration mode. To remove the pool of addresses, use the no form of this command.
global (mapped_ifc) nat_id {mapped_ip[-mapped_ip] [netmask mask] | interface}
no global (mapped_ifc) nat_id {mapped_ip[-mapped_ip] [netmask mask] | interface}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
1.1(1)
This command was introduced.
3.2.(1)
NAT is now supported in transparent firewall mode.
Usage Guidelines
For dynamic NAT and PAT, you first configure a nat command identifying the real addresses on a given interface that you want to translate. Then you configure a separate global command to specify the mapped addresses when exiting another interface (in the case of PAT, this is one address). Each nat command matches a global command by comparing the NAT ID, a number that you assign to each command.
See the nat command for more information about dynamic NAT and PAT.
If you change the NAT configuration, and you do not want to wait for existing translations to time out before the new NAT information is used, you can clear the translation table using clear xlate command. However, clearing the translation table disconnects all of the current connections.
Examples
The following example hows how to translate the 10.1.1.0/24 network on the inside interface:
hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0hostname(config)# global (outside) 1 209.165.201.1-209.165.201.30To identify a pool of addresses for dynamic NAT as well as a PAT address for when the NAT pool is exhausted, enter the following commands:
hostname(config)# nat (inside) 1 10.1.1.0 255.255.255.0hostname(config)# global (outside) 1 209.165.201.5hostname(config)# global (outside) 1 209.165.201.10-209.165.201.20To translate the lower security DMZ network addresses so they appear to be on the same network as the inside network (10.1.1.0), for example, to simplify routing, enter the following commands:
hostname(config)# nat (dmz) 1 10.1.2.0 255.255.255.0 outside dnshostname(config)# global (inside) 1 10.1.1.45To identify a single real address with two different destination addresses using policy NAT, enter the following commands:
hostname(config)# access-list NET1 permit ip 10.1.2.0 255.255.255.0 209.165.201.0 255.255.255.224hostname(config)# access-list NET2 permit ip 10.1.2.0 255.255.255.0 209.165.200.224 255.255.255.224hostname(config)# nat (inside) 1 access-list NET1 tcp 0 2000 udp 10000hostname(config)# global (outside) 1 209.165.202.129hostname(config)# nat (inside) 2 access-list NET2 tcp 1000 500 udp 2000hostname(config)# global (outside) 2 209.165.202.130To identify a single real address/destination address pair that use different ports using policy NAT, enter the following commands:
hostname(config)# access-list WEB permit tcp 10.1.2.0 255.255.255.0 209.165.201.11 255.255.255.255 eq 80hostname(config)# access-list TELNET permit tcp 10.1.2.0 255.255.255.0 209.165.201.11 255.255.255.255 eq 23hostname(config)# nat (inside) 1 access-list WEBhostname(config)# global (outside) 1 209.165.202.129hostname(config)# nat (inside) 2 access-list TELNEThostname(config)# global (outside) 2 209.165.202.130Related Commands
group-delimiter
To enable group-name parsing and specify the delimiter to be used when parsing group names from the user names that are received when tunnels are being negotiated, use the group-delimiter command in global configuration mode. To disable this group-name parsing, use the no form of this command.
group-delimiter delimiter
no group-delimiter
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
By default, no delimiter is specified, disabling group-name parsing.
Examples
The following example shows the group-delimiter command to change the group delimiter to the hash mark (#):
hostname(config)# group-delimiter #Related Commands
show running-config group-delimiter
Displays the current group-delimiter value.
strip-group
Enables or disables strip-group processing.
group-lock
To restrict remote users to access through the tunnel group only, use the group-lock command in group-policy configuration mode or username configuration mode. To remove the group-lock attribute from the running configuration, use the no form of this command.
group-lock {value tunnel-grp-name | none}
no group-lock
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy configuration
•
—
•
—
—
Username configuration
•
—
•
—
—
Command History
Usage Guidelines
This option allows inheritance of a value from another group policy. To disable group-lock, use the group-lock none command.
Group-lock restricts users by checking if the group configured in the VPN client is the same as the tunnel group to which the user is assigned. If it is not, the FWSM prevents the user from connecting. If you do not configure group-lock, the FWSM authenticates users without regard to the assigned group.
Examples
The following example shows how to set group lock for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# group-lock value tunnel group nameThis option allows inheritance of a value from another group policy. To disable group-lock, use the group-lock none command.
Group-lock restricts users by checking if the group configured in the VPN client is the same as the tunnel group to which the user is assigned. If it is not, the FWSM prevents the user from connecting. If you do not configure group-lock, the FWSM authenticates users without regard to the assigned group.group-object
To add network object groups, use the group-object command in protocol, network, service, and icmp-type configuration modes. To remove network object groups, use the no form of this command.
group-object obj_grp_id
no group-object obj_grp_id
Syntax Description
obj_grp_id
Identifies the object group (one to 64 characters) and can be any combination of letters, digits, and the "_", "-", "." characters.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Command History
Usage Guidelines
The group-object command is used with the object-group command to define an object that itself is an object group. It is used in protocol, network, service, and icmp-type configuration modes. This command allows logical grouping of the same type of objects and construction of hierarchical object groups for structured configuration.
Duplicate objects are allowed in an object group if they are group objects. For example, if object 1 is in both group A and group B, it is allowed to define a group C which includes both A and B. It is not allowed, however, to include a group object which causes the group hierarchy to become circular. For example, it is not allowed to have group A include group B and then also have group B include group A.
The maximum allowed levels of a hierarchical object group is 10.
Examples
The following example shows how to use the group-object command in network configuration mode eliminate the need to duplicate hosts:
hostname(config)# object-group network host_grp_1hostname(config-network)# network-object host 192.168.1.1hostname(config-network)# network-object host 192.168.1.2hostname(config-network)# exithostname(config)# object-group network host_grp_2hostname(config-network)# network-object host 172.23.56.1hostname(config-network)# network-object host 172.23.56.2hostname(config-network)# exithostname(config)# object-group network all_hostshostname(config-network)# group-object host_grp_1hostname(config-network)# group-object host_grp_2hostname(config-network)# exithostname(config)# access-list grp_1 permit tcp object-group host_grp_1 any eq ftphostname(config)# access-list grp_2 permit tcp object-group host_grp_2 any eq smtphostname(config)# access-list all permit tcp object-group all-hosts any eq wRelated Commands
group-policy
To create or edit a group policy, use the group-policy command in global configuration mode. To remove a group policy from the configuration, use the no form of this command.
group-policy name {internal [from group-policy_name] | external server-group server_group password server_password}
no group-policy name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
A default group policy, named "DefaultGroupPolicy," always exists on the FWSM. However, this default group policy does not take effect unless you configure the FWSM to use it. For configuration instructions, see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide.
The DefaultGroupPolicy has these AVPs:
Examples
The following example shows how to create an internal group policy with the name "FirstGroup":
hostname(config)#group-policy FirstGroup internalThe following example shows how to create an external group policy with the name "ExternalGroup," the AAA server group "BostonAAA," and the password "12345678":
hostname(config)#group-policy ExternalGroup external server-group BostonAAA password 12345678Related Commands
group-policy attributes
To enter the group-policy attributes mode, use the group-policy attributes command in global configuration mode. To remove all attributes from a group policy, user the no form of this command. The attributes mode lets you configure AVPs for a specified group policy.
group-policy name attributes
no group-policy name attributes
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The syntax of the commands in attributes mode have the following characteristics in common:
•
•
•
Examples
The following example shows how to enter group-policy attributes mode for the group policy named "FirstGroup":
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)#Related Commands
gtp-map
To identify a specific map to use for defining the parameters for GTP, use the gtp-map command in global configuration mode. To remove the map, use the no form of this command.
gtp-map map_name
no gtp-map map_name
Note
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
GPRS is a data network architecture that is designed to integrate with existing GSM networks. It offers mobile subscribers uninterrupted, packet-switched data services to corporate networks and the Internet. For an overview of GTP and how the FWSM ensures secure access over wireless networks, refer to the "Applying Application Layer Protocol Inspection" chapter in the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide.
Use the gtp-map command to identify a specific map to use for defining the parameters for GTP. When you enter this command, the system enters a configuration mode that lets you enter the different commands used for defining the specific map. After defining the GTP map, you use the inspect gtp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.
Examples
The following example shows how to use the gtp-map command to identify a specific map (gtp-policy) to use for defining the parameters for GTP:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)#The following example shows how to use access lists to identify GTP traffic, define a GTP map, define a policy, and apply the policy to the outside interface:
hostname(config)# access-list gtp-acl permit udp any any eq 3386hostname(config)# access-list gtp-acl permit udp any any eq 2123hostname(config)# class-map gtp-traffichostname(config-cmap)# match access-list gtp-aclhostname(config-cmap)# exithostname(config)# gtp-map gtp-policyhostname(config-gtpmap)# request-queue 300hostname(config-gtpmap)# permit mcc 111 mnc 222hostname(config-gtpmap)# message-length min 20 max 300hostname(config-gtpmap)# drop message 20hostname(config-gtpmap)# tunnel-limit 10000hostname(config)# policy-map inspection_policyhostname(config-pmap)# class gtp-traffichostname(config-pmap-c)# inspect gtp gtp-policyhostname(config)# service-policy inspection_policy outsideRelated Commands
h225-map
To define an H.225 application inspection map, use the h225-map command in global configuration mode. To remove the map, use the no form of this command.
h225-map map_name
no h225-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
An H.225 map allows the FWSM to open dynamic, port-specific pinholes for an H.245 connection when an HSI is involved in H.225 call-signalling.
The H.225 map provides information about the HSI and its associated endpoints, which is required to establish this connection without compromising the security of the network protected by the FWSM.
When you enter the h225-map command, the system enters the h225 map configuration mode, which lets you enter the different commands used for defining the specific map.
One H.225 map can contain a maximum of five HSI groups. Each HSI group can contain a maximum of ten endpoints.
Examples
The following example shows how to define an H.225 map:
hostname(config)# h225-map sample_maphostname(config-h225-map)# hsi-group 1hostname(config-h225-map-hsi-grp)# hsi 10.10.15.11hostname(config-h225-map-hsi-grp)# endpoint 10.3.6.1 insidehostname(config-h225-map-hsi-grp)# endpoint 10.10.25.5 outsidehostname(config-h225-map-hsi-grp)# exitRelated Commands
hello-interval
To specify the interval between EIGRP hello packets sent on an interface, use the hello-interval command in interface configuration mode. To return the hello interval to the default value, use the no form of this command.
hello-interval eigrp as-number seconds
no hello-interval eigrp as-number seconds
Syntax Description
as-number
The autonomous system number of the EIGRP routing process.
seconds
Specifies the interval between hello packets that are sent on the interface; valid values are from 1 to 65535 seconds.
Defaults
The default seconds is 5 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
The smaller the hello interval, the faster topological changes will be detected, but more routing traffic will ensue. This value must be the same for all routers and access servers on a specific network.
Examples
The following example sets the EIGRP hello interval to 10 seconds and the hold time to 30 seconds:
hostname(config-if)# hello-interval eigrp 100 10hostname(config-if)# hold-time eigrp 100 30Related Commands
help
To display help information for the command specified, use the help command in user EXEC mode.
help {command | ?}
Syntax Description
command
Specifies the command for which to display the CLI help.
?
Displays all commands that are available in the current privilege level and mode.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
The help command displays help information about all commands. You can see help for an individual command by entering the help command followed by the command name. If you do not specify a command name and enter ? instead, all commands that are available in the current privilege level and mode display.
If you enable the pager command and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->The More prompt uses syntax similar to the UNIX more command as follows:
•
•
•
Examples
The following example shows how to display help for the rename command:
hostname#help renameUSAGE:rename /noconfirm [{disk0:|disk1:|flash:}] <source path> [{disk0:|disk1:|flash:}] <destination path>DESCRIPTION:rename Rename a fileSYNTAX:/noconfirm No confirmation{disk0:|disk1:|flash:} Optional parameter that specifies the filesystem<source path> Source file path<destination path> Destination file pathhostname#The following examples shows how to display help by entering the command name and a question mark:
hostname(config)# enable ?usage: enable password <pwd> [encrypted]Help is available for the core commands (not the show, no, or clear commands) by entering ? at the command prompt:
hostname(config)# ?aaa Enable, disable, or view TACACS+ or RADIUSuser authentication, authorization and accounting...Related Commands
hold-time
To specify the hold time advertised by the FWSM in EIGRP hello packets, use the hold-time command in interface configuration mode. To return the hello interval to the default value, use the no form of this command.
hold-time eigrp as-number seconds
no hold-time eigrp as-number seconds
Syntax Description
as-number
The autonomous system number of the EIGRP routing process.
seconds
Specifies the hold time, in seconds. Valid values are from 1 to 65535 seconds.
Defaults
`The default seconds is 15 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
This value is advertised in the EIGRP hello packets sent by the FWSM. The EIGRP neighbors on that interface use this value to determine the availability of the FWSM. If they do not receive a hello packet from the FWSM during the advertised hold time, the EIGRP neighbors will consider the FWSM to be unavailable.
On very congested and large networks, the default hold time might not be sufficient time for all routers and access servers to receive hello packets from their neighbors. In this case, you may want to increase the hold time.
We recommend that the hold time be at least three times the hello interval. If the FWSM does not receive a hello packet within the specified hold time, routes through this neighbor are considered unavailable.
Increasing the hold time delays route convergence across the network.
Examples
The following example sets the EIGRP hello interval to 10 seconds and the hold time to 30 seconds:
hostname(config-if)# hello-interval eigrp 100 10hostname(config-if)# hold-time eigrp 100 30Related Commands
hello-interval
Specifies the interval between EIGRP hello packets sent on an interface.
hostname
To set the FWSM hostname, use the hostname command in global configuration mode. To restore the default hostname, use the no form of this command. The hostname appears as the command line prompt, and if you establish sessions to multiple devices, the hostname helps you keep track of where you enter commands.
hostname name
no hostname [name]
Syntax Description
name
Specifies a hostname up to 63 characters. A hostname must start and end with a letter or digit, and have as interior characters only letters, digits, or a hyphen.
Defaults
The default is FWSM.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
For multiple context mode, the hostname that you set in the system execution space appears in the command line prompt for all contexts.
The hostname that you optionally set within a context does not appear in the command line, but can be used for the banner command $(hostname) token.
Examples
The following example sets the hostname to firewall1:
hostname(config)# hostname firewall1firewal11(config)#Related Commands
banner
Sets a login, message of the day, or enable banner.
domain-name
Sets the default domain name.
hsi
To associate an HSI with an HSI group, use the hsi command in hsi group configuration mode. To remove the HSI, use the no form of this command.
hsi ip address
no hsi ip address
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Hsi group configuration
•
•
•
•
—
Command History
Usage Guidelines
An HSI group allows the FWSM to open dynamic, port-specific pinholes for enabling H.323 connections when a Cisco CallManager tries to establish a connection between H.323 endpoints.
Up to five HSI groups can be associated with a single H.225 map. Each HSI group can contain a maximum of ten endpoints.
Examples
The following example shows how to define an H.225 map:
hostname(config)# h225-map hmaphostname(config-h225-map)# hsi-group 1hostname(config-h225-map-hsi-grp)# hsi 10.10.15.11hostname(config-h225-map-hsi-grp)# endpoint 10.3.6.1 insidehostname(config-h225-map-hsi-grp)# endpoint 10.10.25.5 outsidehostname(config-h225-map-hsi-grp)# exitRelated Commands
hsi-group
To define an HSI group, use the hsi-group command in h225 map configuration mode. To remove the HSI group, use the no form of this command.
hsi-group group_ID
no hsi-group group_ID
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
H.225 map configuration
•
•
•
•
—
Command History
Usage Guidelines
When you enter the hsi-group command, the system enters the HSI group configuration mode, which lets you enter the different commands used for defining the specific map.
A HSI group allows the FWSM to open dynamic, port-specific pinholes for an H.245 connection when an HSI is involved in H.225 call-signalling.
Up to five HSI groups can be associated with a single H.225 map. Each HSI group can contain a maximum of ten endpoints. You must configure an HSI within the group before configuring any endpoints. You must remove all endpoints and the HSI before removing the HSI group.
Examples
The following example shows how to define an H.225 map:
hostname(config)# h225-map hmaphostname(config-h225-map)# hsi-group 1hostname(config-h225-map-hsi-grp)# hsi 192.168.100.1hostname(config-h225-map-hsi-grp)# endpoint 192.168.100.101hostname(config-h225-map-hsi-grp)# endpoint 192.168.100.102hostname(config-h225-map-hsi-grp)# exithostname(config-h225-map)# hsi-group 2hostname(config-h225-map-hsi-grp)# hsi 192.168.200.1hostname(config-h225-map-hsi-grp)# endpoint 192.168.200.101hostname(config-h225-map-hsi-grp)# endpoint 192.168.200.102hostname(config-h225-map-hsi-grp)# exitRelated Commands
http
To specify hosts that can access the HTTP server internal to the FWSM, use the http command in global configuration mode. To remove one or more hosts, use the no form of this command. To remove the attribute from the configuration, use the no form of this command without arguments.
http ip_address subnet_mask interface_name
no http
Syntax Description
Defaults
No hosts can access the HTTP server.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Examples
The following example shows how to allow the host with the IP address of 10.10.99.1 and the subnet mask of 255.255.255.255 access to the HTTP server via the outside interface:
hostname(config)# http 10.10.99.1 255.255.255.255 outsideThe next example shows how to allow any host access to the HTTP server via the outside interface:
hostname(config)# http 0.0.0.0 0.0.0.0 outsideRelated Commands
http authentication-certificate
To require authentication via certificate from users who are establishing HTTPS connections, use the http authentication-certificate command in global configuration mode. To remove the attribute from the configuration, use the no form of this command. To remove all http authentication-certificate commands from the configuration, use the no form without arguments.
http authentication-certificate interface
no http authentication-certificate [interface]
Syntax Description
Defaults
HTTP certificate authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The FWSM validates certificates against the PKI trust points. If a certificate does not pass validation, the FWSM closes the SSL connection.
You can configure certificate authentication for each interface, such that connections on a trusted/inside interface do not have to provide a certificate. You can use the command multiple times to enable certificate authentication on multiple interfaces.
Validation occurs before the URL is known, so this affects both WebVPN and ASDM access.
The ASDM uses its own authentication method in addition to this value. That is, it requires both certificate and username/password authentication if both are configured, or just username/password if certificate authentication is disabled.
Examples
The following example shows how to require certificate authentication for clients connecting to the interfaces named outside and external:
hostname(config)# http authentication-certificate insidehostname(config)# http authentication-certificate externalRelated Commands
http server enable
To enable the FWSM HTTPS server for ASDM, use the http server enable command in global configuration mode. To disable the HTTPS server, use the no form of this command.
http server enable
no http server enable
Defaults
The HTTP server is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example shows how to enable the HTTPS server:
hostname(config)# http server enableRelated Commands
http-map
To create an HTTP map for applying enhanced HTTP inspection parameters, use the http-map command in global configuration mode. To remove the command, use the no form of this command.
http-map map_name
no http-map map_name
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The enhanced HTTP inspection feature, which is also known as an application firewall, verifies that HTTP messages conform to RFC 2616, use RFC-defined and supported extension methods, and comply with various other criteria. This can help prevent attackers from using HTTP messages for circumventing network security policy.
Note
In many cases, you can configure the criteria and how the FWSM responds when the criteria are not met. The criteria that you can apply to HTTP messages include the following:
•
•
•
•
•
•
•
•
•
•
Note
Table 13-2 summarizes the configuration commands available in HTTP map configuration mode. For detailed syntax for a command, see the corresponding command entry in this guide.
Examples
The following example shows how to identify HTTP traffic, define an HTTP map, define a policy, and apply the policy to the outside interface:
hostname(config)# class-map http-porthostname(config-cmap)# match port tcp eq 80hostname(config-cmap)# exithostname(config)# http-map inbound_httphostname(config-http-map)# content-length min 100 max 2000 action reset loghostname(config-http-map)# content-type-verification match-req-rsp reset loghostname(config-http-map)# max-header-length request bytes 100 action log resethostname(config-http-map)# max-uri-length 100 action reset loghostname(config-http-map)# exithostname(config)# policy-map inbound_policyhostname(config-pmap)# class http-porthostname(config-pmap-c)# inspect http inbound_httphostname(config-pmap-c)# exithostname(config-pmap)# exithostname(config)# service-policy inbound_policy interface outsideThis example causes the FWSM to reset the connection and create a syslog entry when it detects any traffic that contain the following:
•
•
•
•
Related Commands
