cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
370
Views
0
Helpful
3
Replies

Inspection not working properly

cisconoobie
Level 2
Level 2

I need some help with this.

I created a new security policy rule that inspects http traffic for .bittorrent. I applied it to the global. The global already inspects certain default inspections.

It works ok and stops users from downloading .bittorrent files but everything else http is messed up like I cant get to Windows Update or use other services.

My Setup is this:

Global default Inspection policy to inspect traffic. I created a new HTTP inspection policy and added to global. Is there a implicit deny for these policies ? How do I make sure that both global policies go through ?

I also have a outside policy for certain traffic to be LLQ.

3 Replies 3

ymzhang
Level 1
Level 1

Hi,

You need to give more context here. What's the platform you are using. What is the OS version?

If you are using the feature on Cisco routers, please check http://www.cisco.com/go/iosfirewall and http://www.cisco.com/go/iosips

The feature you are refering should be under iosfirewall and look for application firewall. You can also try to use IOS IPS, which is a signature based IPS system.

Thanks,

-Chris

mhellman
Level 7
Level 7

You might try disabling the HTTP RFC compliance checking. I don't have a device in front of me, but I believe it's a checkbox that only shows up in the "advanced" view. I think it's checked by default.

I contacted Cisco TAc and found out that they have a bug with http inspection on ASA5500 7.2. basically if you create an http inspection rule, you have to set "Protocol Violations" to log only, otherwise it will not allow things like activex, etc.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card