Cisco 4700M Configuration Manual page 181

Chapter 3 Configuring Application Protocol Inspection
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
OL-16202-01
The keywords, arguments, and options are as follows:
line_number—(Optional) Argument that assists you in editing or deleting
•
individual match commands. Enter an integer from 2 to 1024 as the line
number. You can enter no line_number to delete long match commands
instead of entering the entire line. The line numbers do not dictate a priority
or sequence for the match statements.
application_category—Restricted HTTP application category for the class
•
map. The possible values for application_category are as follows:
im—Instant messaging application category. The ACE checks for the
–
Yahoo Messenger instant messaging application.
p2p—Peer-to-peer application category. The applications checked
–
include Kazaa, GoToMyPC, and Gnutella.
tunneling—Tunneling application category. The applications checked
–
include: HTTPort/HTTHost, GNU Httptunnel, and Firethru.
Follow these guidelines when using the match port-misuse command:
You can specify multiple match port-misuse commands within a class map.
•
Each match port-misuse command configures a single application type.
•
The port misuse application inspection process requires a search of the
•
entity-body of the HTTP message, which may degrade performance of the
ACE.
The ACE disables the match port-misuse command by default. If you do not
•
configure a restricted HTTP application category, the default action by the
ACE is to allow the applications without generating a log.
For example, to create a class map that identifies peer-to-peer applications as
restricted HTTP traffic, enter:
host1/Admin(config)# class-map type http inspect HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match port-misuse p2p
To clear the HTTP restricted application category match criteria from the class
map, enter:
host1/Admin(config-cmap-http-insp)# no match port-misuse p2p
Configuring a Layer 7 HTTP Deep Inspection Policy
3-57