Applying Inspection And Qos Policing To Http Traffic - Cisco FirePOWER ASA 5500 series Configuration Manual

Modular Policy Framework Examples

Applying Inspection and QoS Policing to HTTP Traffic

In this example (see
security appliance through the outside interface is classified for HTTP inspection. Any HTTP traffic that
exits the outside interface is classified for policing.
Figure 21-1
A
Host A
See the following commands for this example:
hostname(config)# class-map http_traffic
hostname(config-cmap)# match port tcp eq 80
hostname(config)# policy-map http_traffic_policy
hostname(config-pmap)# class http_traffic
hostname(config-pmap-c)# inspect http
hostname(config-pmap-c)# police output 250000
hostname(config)# service-policy http_traffic_policy interface outside
Applying Inspection to HTTP Traffic Globally
In this example (see
appliance through any interface is classified for HTTP inspection. Because the policy is a global policy,
inspection occurs only as the traffic enters each interface.
Figure 21-2
A
Host A
See the following commands for this example:
hostname(config)# class-map http_traffic
hostname(config-cmap)# match port tcp eq 80
Cisco Security Appliance Command Line Configuration Guide
21-18
Figure 21-1), any HTTP connection (TCP traffic on port 80) that enters or exits the
HTTP Inspection and QoS Policing
Security
appliance
port 80
port 80
inside outside
Figure 21-2), any HTTP connection (TCP traffic on port 80) that enters the security
Global HTTP Inspection
Security
appliance
port 80
insp.
port 80 insp.
inside outside
Chapter 21
insp.
police
insp.
Host B
Host B
Using Modular Policy Framework
OL-10088-01