From: Ruhann (groupstudy@ru.co.za)
Date: Sun Feb 15 2009 - 06:24:16 ARST
Hi
If you used google images to test matching the "http url", your policy wont
block the images, as the google URL doesn't contain your matching string
"*.jpeg"
and your second class-map the matches are incorrect.
"http host" - matches the domain names ie:
match protocol http host *youtube.com*|*video.google.com*
"http url"- mathes additional strings in the URL, words after the first /
match protocol http url *.flv|*.mp4|*.m4v|*.m4a|*.3gp|*.mov
"http mime-type" - used to match file types, (your matches are not in REGEX,
as it matches a mime type/suffic) ie
match protocol http mime image/jpeg
! This would match jpeg,jpg,jpe,jfif,pjpeg, and pjp types
!
match protocol http mime image/jpg
! This would not match anything as it is not a proper mime type.
!
match protocol http mime image*
! This would match all image mime types
!
match protocol http mime application/x-shockwave-flash
! This would not only match swf flash movies, but all of flash.
!
match protocol http mime
video/flv|video/x-flv|video/mp4|video/x-m4v|audio/mp4a-latm
! This would block most movie formats
So to block all JPG, JPEG images from, the following should work,
class-map JPEGS
match protocol http mime image/jpeg
policy-map DROP
class JPEGS
drop
int s1/0
service-policy input DROP
You can get your MIME type from here :
http://www.sfsu.edu/training/mimetype.htm
HTH
<ruhann>
On Fri, Feb 6, 2009 at 12:20 AM, robert nowosadzki <rnowosadzki@yahoo.com>wrote:
> What is the correct config when it comes to mime matching? I have been
> playing with this and the only results that I get are with the following
> config:
>
> class-map match-any IMAGES
> match protocol http url "*.jpg"
> match protocol http url "*.jpeg"
>
> policy-map IMAGES_PM
> class IMAGES
> drop
>
> int fa0/0
> serice-policy input IMAGES_PM
>
> My setup is basically a laptop connected to a router (fa0/1) and the router
> (fa0/0) is connected to the internet. For testing I go to google images and
> try to browse .jpg or .jpeg images.
>
> I have also tried the config below, but that does not produce any hits on
> the policy-map.
>
> class-map match-any IMAGES
> match protocol http mime "*.jpg"
> match protocol http mime "*.jpeg"
>
> Any help is greatly appreciated.
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html
>
>
>
>
>
>
>
>
-- <ruhann>Blogs and organic groups at http://www.ccie.net
This archive was generated by hypermail 2.1.4 : Sun Mar 01 2009 - 09:44:11 ARST