Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1089 / 2164

1-5
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Special Actions for Application Inspections (Inspection Policy Map)
Identifying Traffic in an Inspection Class Map
“Creating a Regular Expression” section on page 1-14
Examples
The following is an example of an HTTP inspection policy map and the related class maps. This policy
map is activated by the Layer 3/4 policy map, which is enabled by the service policy.
hostname(config)# regex url_example example\.com
hostname(config)#
regex url_example2 example2\.com
hostname(config)# class-map type regex match-any URLs
hostname(config-cmap)# match regex url_example
hostname(config-cmap)#
match regex url_example2
hostname(config-cmap)# class-map type inspect http match-all http-traffic
hostname(config-cmap)#
match req-resp content-type mismatch
hostname(config-cmap)# match request body length gt 1000
hostname(config-cmap)# match not request uri regex class URLs
hostname(config-cmap)# policy-map type inspect http http-map1
hostname(config-pmap)# class http-traffic
hostname(config-pmap-c)#
drop-connection log
hostname(config-pmap-c)# match req-resp content-type mismatch
hostname(config-pmap-c)# reset log
hostname(config-pmap-c)#
parameters
hostname(config-pmap-p)# protocol-violation action log
hostname(config-pmap-p)#
policy-map test
hostname(config-pmap)# class test
(a Layer 3/4 class map not shown)
hostname(config-pmap-c)# inspect http http-map1
hostname(config-pmap-c)# service-policy test interface outside
Identifying Traffic in an Inspection Class Map
This type of class map allows you to match criteria that is specific to an application. For example, for
DNS traffic, you can match the domain name in a DNS query.
A class map groups multiple traffic matches (in a match-all class map), or lets you match any of a list of
matches (in a match-any class map). The difference between creating a class map and defining the traffic
match directly in the inspection policy map is that the class map lets you group multiple match
commands, and you can reuse class maps. For the traffic that you identify in this class map, you can
specify actions such as dropping, resetting, and/or logging the connection in the inspection policy map.
If you want to perform different actions on different types of traffic, you should identify the traffic
directly in the policy map.
Step 5
action
Example:
hostname(config-pmap-c)# drop-connection
log
Specifies the action you want to perform on the matching traffic.
Actions vary depending on the inspection and match type.
Common actions include:
drop , log , and drop-connection . For
the actions available for each match, see the appropriate
inspection chapter.
Step 6
parameters
Example:
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
Configures parameters that affect the inspection engine. The CLI
enters parameters configuration mode. For the parameters
available for each application, see the appropriate inspection
chapter.
Command Purpose