Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1078 / 2164

1-16
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Service Policy Using the Modular Policy Framework
Defining Actions (Layer 3/4 Policy Map)
Detailed Steps
Examples
The following is an example of a policy-map command for connection policy. It limits the number of
connections allowed to the web server 10.1.1.1:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1
hostname(config)# class-map http-server
hostname(config-cmap)# match access-list http-server
hostname(config)# policy-map global-policy
hostname(config-pmap)# description This policy map defines a policy concerning connection
to http server.
hostname(config-pmap)# class http-server
hostname(config-pmap-c)# set connection conn-max 256
The following example shows how multi-match works in a policy map:
hostname(config)# class-map inspection_default
hostname(config-cmap)# match default-inspection-traffic
hostname(config)# class-map http_traffic
hostname(config-cmap)# match port tcp eq 80
hostname(config)# policy-map outside_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect http http_map
hostname(config-pmap-c)# inspect sip
hostname(config-pmap)# class http_traffic
hostname(config-pmap-c)# set connection timeout idle 0:10:0
Command Purpose
Step 1
policy-map policy_map_name
Example:
hostname(config)# policy-map global_policy
Adds the policy map. The policy_map_name argument is the
name of the policy map up to 40 characters in length. All types of
policy maps use the same name space, so you cannot reuse a name
already used by another type of policy map. The CLI enters
policy-map configuration mode.
Step 2
(Optional)
class class_map_name
Example:
hostname(config-pmap)# description global
policy map
Specifies a previously configured Layer 3/4 class map, where the
class_map_name is the name of the class map. See the
“Identifying Traffic (Layer 3/4 Class Maps)” section on page 1-12
to add a class map.
Note
If there is no match default-inspection-traffic command
in a class map, then at most one inspect command is
allowed to be configured under the class.
For QoS, you can configure a hierarchical policy map for
the traffic shaping and priority queue features. See the
“Task Flow for Configuring Hierarchical Policy Maps for
QoS Traffic Shaping” section on page 1-11
for more
information.
Step 3
Specify one or more actions for this class map. See the “Supported Features” section on page 1-2 .
Step 4
Repeat Step 2 and Step 3 for each class map you
want to include in this policy map.