With Pix/ASA OS 7.1 to configure http inspection the configuration guide shows expamples like the following:
access-list HTTP_PORTS extended permit tcp any any range 80 81
!
class-map http-ports
match access-list HTTP_PORTS
exit
!
http-map maphttp
max-uri-length 256 action reset log
port-misuse default action drop log
request-method rfc default action reset log
request-method rfc get action allow
request-method rfc post action allow
request-method rfc head action allow
strict-http action allow log
exit
!
policy-map global_policy
...
class http-ports
inspect http maphttp
exit
exit
All packets matched by class "http-port" are inspected using configuration defined in http-map "maphttp".
In OS 7.2 configuration guide the examples showing http inspect configuration are quite different. It seems that in OS 7.2 the "http-map" has been substituted by a mix of "class map type inspect http" and "policy map type inspect http" commands.
So an example of http inspection configuration with OS 7.2 is:
class-map type inspect http HTTP_METHOD_CLASS
match not request method get
match not request method post
match not request method head
exit
!
policy-map type inspect http HTTP_OUT_INSPECT
match request uri length gt 256
reset log
exit
class HTTP_METHOD_CLASS
reset log
exit
parameters
protocol-violation action reset log
exit
exit
!
policy-map global_policy
....
class http-ports
inspect http HTTP_OUT_INSPECT
exit
exit
The first question is: is it true? Is "http-map" deprecated or outdated in OS 7.2? I couldn't find clear documentation about it.
Actually is still possible configure a PIX/ASA with OS 7.2 using "http-map", the command is still there and is still described in the 7.2 command reference documentation (but not in the configuration guide).
I believe that the "http-map" configuration and the "class-map/policy-map type inspect http" configuration are quite different. Using "http-map" we can configure the "port-misuse" command and the strict-http command too, which are not available in "class-map/policy-map type inspect http" configuration "style". Moreover with "policy-map type inspect http" only we can configure the mysterious "protocol-violation" parameter.
I called protocol-violation "mysterious" because if you look for it in the command reference you can find that it is related to netbios protocol inspection, not http... So the second question is: is there anybody who can exactly explain what the "protocol-violation" command does in the http inspection context?
The two configuration styles seems both available in OS 7.2 but I can't understand how they can be mixed (if they can), which should be used and why it seems there are two ways to configure quite the same thing (not exactly the same: "port-misuse" is used to detect tunneling protocols in http and I don't know how to do it using the 7.2 configuration style).
The third (and last) question is: is there anybody who can clearly explain the difference between the http inspection configuration methods (if there is any) and which will be valid in the future?
I hope I could explain my doubts clearly.
Thanks.
