Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.
- Create BookmarkCreate Bookmark
- Create Note or TagCreate Note or Tag
- PrintPrint
Chapter 5. Advanced Zone-Based Policy Fi... > HTTP Packet Inspection
HTTP Packet Inspection
Cisco IOS Firewall software offers only rudimentary packet-matching features for most protocols for which deep packet inspection is supported. Hypertext Transfer Protocol (HTTP), the protocol used to exchange content between the web server and its clients, is a notable exception. You can use a number of different match conditions (introduced in Cisco IOS Release 12.3(14)T with the HTTP Application Inspection Engine) to classify the web traffic, from extremely helpful ones (identifying HTTP misuse for unauthorized traffic) to arcane ones (for example, the number of header fields in the request or response header).
Note
HTTP packet inspection works only on non-encrypted HTTP sessions. If the data exchange takes place over Secure Sockets Layer (SSL, also known as HTTPS), the firewall cannot inspect the packet content.
