Cisco 4700M Configuration Manual page 168

Configuring a Layer 7 HTTP Deep Inspection Policy
Defining a Secondary Cookie for HTTP Inspection
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
3-44
gt bytes—Specifies a minimum value for the content parse length in an HTTP
•
message received by the ACE. Based on the policy map action, the ACE
allows or denies messages with a content length greater than the specified
value. Valid entries are from 1 to 65535 bytes.
lt bytes—Specifies a maximum value for the content parse length in an HTTP
•
message received by the ACE. Based on the policy map action, the ACE
allows or denies messages with a content length size less than the specified
value. Valid entries are from 1 to 65535 bytes.
• range bytes1 bytes2—Specifies a size range for the content parse length in an
HTTP message received by the ACE. Based on the policy map action, the
ACE allows or denies messages with a content length within this range. The
range is from 1 to 65535 bytes.
For example, to create a class map that identifies the content length in an HTTP
message that can be received by the ACE, enter:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match content length eq 3495
To clear the HTTP content length match criteria from the class map, enter:
host1/Admin(config-cmap-http-insp)# no match content length eq 3495
You can use the match cookie secondary command in class map HTTP
inspection configuration mode to configure a class map to define inspection
decisions based on the name or prefix and value of a secondary cookie (URL
query string). Normally, the ACE parses URLs up to, but not including, the
question mark (?) in a URL string. This feature extends the URL parsing
capabilities of the ACE to include the URL parameters beyond the question mark.
The ACE also uses this command to match secondary cookies present in the
HTTP content of POST requests. This command is available as either a match
statement in a class map or an inline match statement (slightly different syntax)
in a Layer 7 policy map. For details about inline match statements, see the
"Including Inline Match Statements in a Layer 7 HTTP Deep Packet Inspection
Policy Map" section.
The syntax of this command is as follows:
match cookie secondary [name cookie_name | prefix prefix_name] value
expression
Chapter 3 Configuring Application Protocol Inspection
OL-16202-01