What code are you running on the PIX?
For example with the PIX new code (7.0) you can successfully use the Advance HTTP inspection engines to block a variety of ports, below is an example:
Create a class-map for http inspection
pix(config)# class-map http-port
pix(config-cmap)# match port tcp eq 80
pix(config-cmap)# exit
Create an http-map to specify parameters for inspect http
pix(config)# http-map inbound_http
pix(config-http-map)# content-length min 100 max 2000 action reset log
pix(config-http-map)# content-type-verification match-req-rsp action reset log
pix(config-http-map)# max-header-length request 100 action reset log
pix(config-http-map)# max-uri-length 100 action reset log
pix(config-http-map)# port-misuse p2p action drop
pix(config-http-map)# port-misuse im action drop
pix(config-http-map)# port-misuse default action allow
pix(config-http-map)# exit
Create a policy-map for http inspection
* pix(config)# policy-map inbound_policy
pix(config-pmap)# class http-port
pix(config-pmap-c)# inspect http inbound_http
pix(config-pmap-c)# exit
pix(config-pmap)# exit
If necessary create a service-policy or use the default-inspection policy
pix(config)# service-policy inbound_policy interface outside
*Attach the policy-map for http inspection to an interface (an existing policy map could
also be used).
This ends up in the config as:
--------------------------------------------------------------------------
class-map http-port
match port tcp eq 80
class-map http-port8080
match port tcp eq 8080
…
http-map inbound_http
content-length min 100 max 2000 action reset log
content-type-verification match-req-rsp action reset log
max-header-length request 100 action reset log
max-uri-length 100 action reset log
port-misuse p2p action drop
port-misuse im action drop
port-misuse default action allow
…
policy-map inbound_policy
class http-port
inspect http inbound_http
class http-port8080
inspect http inbound_http
…
service-policy inbound_policy interface outside
--------------------------------------------------------------------------
If you notice, you can add more ports via class-maps which tie to the inbound_policy I
created to tie to the interface. You can set the port-misuse default action to allow which we did above so you should be able to inspect other ports that are being used without blocking anything that you're currently doing as long as the P2P/IM headers aren't found in the packets.
Essentially this will cause the pix to block the IM/P2P applications while still allowing
normal traffic over port 80/8080.
Regards,
Franco Zamora
