Привет,
через ZBPF думаю выглядеть будет как-то так:
пишем parameter-map с нужным regex
parameter-map type regex "parameter-map name" pattern "паттерн"
вставить её в class-map, _инспектирующую http_
class-map type inspect http match-any "class-map-name" match request uri regex "parameter-map name"
добавить класс в policy-map
policy-map type inspect http "policy-map-name"
class type inspect http "class-map-name" allow log
Привязать policy-map к нужной zone-pair. Нет. Не будет так работать. Под zone-pair нельзя сказать inspect http: "A Layer 7 policy map must be contained in a Layer 3 or Layer 4 policy map; it cannot be attached directly to a target. To attach a Layer 7 policy map to a top-level policy map, use the service policy inspect command and specify
On Thu, Jun 18, 2009 at 06:21:43PM +0300, Andrey Kozlov wrote: the application name (that is, HTTP, IMAP, POP3, SMTP, or SUNRPC). The parent class for a Layer 7 policy should have an explicit match criterion that matched only one Layer 7 protocol before the policy is attached. " Пробуем сделать, как написано: ! ! parameter-map type inspect par-Inspect-HTTP audit-trail on parameter-map type regex par-URL pattern .* ! ! class-map type inspect match-all cm-HTTP match protocol http class-map type inspect http match-any cm-ihttp match request uri regex par-URL ! ! policy-map type inspect http pm-ihttp class type inspect http cm-ihttp log allow class class-default policy-map type inspect pm-Out class type inspect cm-HTTP inspect par-Inspect-HTTP service-policy http pm-ihttp class class-default pass ! ! zone-pair security Int-to-Ext source Internal destination External service-policy type inspect pm-Out ! В итоге получаем, что каунтеры растут: test#show policy-map type inspect zone-pair Int-to-Ext Zone-pair: Int-to-Ext Service-policy inspect : pm-Out Class-map: cm-HTTP (match-all) Match: protocol http Inspect Packet inspection statistics [process switch:fast switch] tcp packets: [3:41] http packets: [0:17] Session creations since subsystem startup or last reset 3 Current session counts (estab/half-open/terminating) [1:0:0] Maxever session counts (estab/half-open/terminating) [3:1:2] Last session created 00:02:02 Last statistic reset never Last session creation rate 0 Maxever session creation rate 3 Last half-open session total 0 Deep packet inspection Policy: http pm-ihttp 8 packets, 352 bytes Class-map: class-default (match-any) Match: any Pass 14 packets, 182 bytes но в логе только *Mar 2 10:00:41.588: %APPFW-4-HTTP_URI_REGEX_MATCHED: URI regex (.*) matched - session 172.16.0.2:60152 198.133.219.25:80 on zone-pair Int-to-Ext class cm-HTTP appl-class cm-ihttp *Mar 2 10:00:41.608: %APPFW-4-HTTP_URI_REGEX_MATCHED: URI regex (.*) matched - session 172.16.0.2:56905 198.133.219.25:80 on zone-pair Int-to-Ext class cm-HTTP appl-class cm-ihttp URL не пишется... :( -- Kind Regards, Alexander Shikoff AMS1-UANIC