Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1072 / 2164

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Service Policy Using the Modular Policy Framework
Task Flows for Configuring Service Policies
Step 1
Identify the traffic—Identify the traffic on which you want to perform Modular Policy Framework
actions by creating Layer 3/4 class maps.
For example, you might want to perform actions on all traffic that passes through the ASA; or you might
only want to perform certain actions on traffic from 10.1.1.0/24 to any destination address.
See the “Identifying Traffic (Layer 3/4 Class Maps)” section on page 1-12 .
Step 2
Perform additional actions on some inspection traffic—If one of the actions you want to perform is
application inspection, and you want to perform additional actions on some inspection traffic, then create
an inspection policy map. The inspection policy map identifies the traffic and specifies what to do with it.
For example, you might want to drop all HTTP requests with a body length greater than 1000 bytes.
You can create a self-contained inspection policy map that identifies the traffic directly with match
commands, or you can create an inspection class map for reuse or for more complicated matching. See
the
“Defining Actions in an Inspection Policy Map” section on page 1-4 and the “Identifying Traffic in
an Inspection Class Map” section on page 1-5 .
Step 3
Create a regular expression—If you want to match text with a regular expression within inspected
packets, you can create a regular expression or a group of regular expressions (a regular expression class
map). Then, when you define the traffic to match for the inspection policy map, you can call on an
existing regular expression.
For example, you might want to drop all HTTP requests with a URL including the text “example.com.”
See the “Creating a Regular Expression” section on page 1-14 and the “Creating a Regular Expression
Class Map” section on page 1-17 .
Layer 3/4 Class Map Layer 3/4 Class Map
241506
Inspection Class Map/
Match Commands
Inspection Policy Map Actions
241507
Regular Expression Statement/
Regular Expression Class Map
Inspection Class Map/
Match Commands
Inspection Policy Map Actions
241509