Hi,

One of my clients needs to allow only their cache servers to access their webservers on port 80. No one else should be able to access these servers from outside. We cannot filter using source IP because, we do not have the list of all cache servers.

So, we have to filter the traffic based on a "header: value" pair available in the HTTP Request Header. Any HTTP request coming from the cache servers will have "testcache: ourcacheserver" as a pair in the HTTP request header. I would like to look for any http request header that does not have this pair and reset that connection. So, only the HTTP connections from cache servers will be successful.

I am using the MPF configuration shown below to implement this. But, there seems to be something wrong in my logic. The "match not request header regex cheader regex class Cache-Request" command does not seem to be working according to my understanding.

I was thinking that "match not request header regex cheader regex class Cache-Request" would match everything but the traffic coming from cache servers.

Please let me know if my understanding of the "match not request header" command is wrong. Or, let me know if there is any other logic I could use to address the requirement.

Regards,

Suresh

*********************************

regex cheader “testcache”

regex cvalue “ourcacheserver”

Class-map type regex match-any Cache-Request

                match regex cvalue

class-map type inspect http match-all Non-Cache-Traffic

                match not request header regex cheader regex class Cache-Request

policy-map type inspect http Non-Cache-Pmap

                class Non-Cache-Traffic

                    reset log

access-list 11server-httptraffic extended permit tcp any 1.1.1.1 eq www

class-map 11server-cmap

     match access-list 11server-httptraffic

policy-map outside_policy

                class 11server-cmap

                     inspect http Non-Cache-Pmap

service-policy outside_policy interface outside