Cisco 4700M Configuration Manual page 183

Chapter 3 Configuring Application Protocol Inspection
Defining an HTTP Transfer Encoding Type
OL-16202-01
The ACE disables the match request-method command by default. If you do
•
not configure a request method, the default action by the ACE is to allow the
RFC 2616 HTTP request method without generating a log.
For example, to create a class map that identifies the connect, get, head, and
index HTTP RFC 2616 protocols for HTTP application protocol inspection,
enter:
host1/Admin(config)# class-map type http inspect match-any
HTTP_INSPECT_L7CLASS
host1/Admin(config-cmap-http-insp)# match request-method rfc connect
host1/Admin(config-cmap-http-insp)# match request-method rfc get
host1/Admin(config-cmap-http-insp)# match request-method rfc head
host1/Admin(config-cmap-http-insp)# match request-method ext index
To clear an RFC 2616 HTTP request method match criteria from the class map,
enter:
host1/Admin(config-cmap-http-insp)# no match request-method rfc
connect
You can use the match transfer-encoding command to configure the class map
to define application inspection decisions that limit the HTTP transfer-encoding
types that can pass through the ACE. The transfer-encoding general-header field
indicates the type of transformation, if any, that has been applied to the HTTP
message body to safely transfer it between the sender and the recipient. When an
HTTP request message contains the configured transfer-encoding type, the ACE
performs the configured action in the policy map.
You must access the class map configuration mode to specify the match
transfer-encoding command.
The syntax of this command is as follows:
[line_number] match transfer-encoding coding_types
The keywords, arguments, and options are as follows:
line_number—(Optional) Argument that assists you in editing or deleting
•
individual match commands. Enter an integer from 2 to 1024 as the line
number. You can enter no line_number to delete long match commands
instead of entering the entire line. The line numbers do not dictate a priority
or sequence for the match statements.
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
Configuring a Layer 7 HTTP Deep Inspection Policy
3-59