Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1090 / 2164

1-6
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Special Actions for Application Inspections (Inspection Policy Map)
Identifying Traffic in an Inspection Class Map
Restrictions
Not all applications support inspection class maps. See the CLI help for class-map type inspect for a
list of supported applications.
Detailed Steps
Examples
The following example creates an HTTP class map that must match all criteria:
hostname(config-cmap)# class-map type inspect http match-all http-traffic
hostname(config-cmap)# match req-resp content-type mismatch
hostname(config-cmap)# match request body length gt 1000
hostname(config-cmap)# match not request uri regex class URLs
The following example creates an HTTP class map that can match any of the criteria:
hostname(config-cmap)# class-map type inspect http match-any monitor-http
hostname(config-cmap)# match request method get
hostname(config-cmap)# match request method put
hostname(config-cmap)# match request method post
Command Purpose
Step 1
(Optional)
Create a regular expression.
See the “Defining Actions in an Inspection Policy Map” section
on page 1-4 .
Step 2
class-map type inspect
application
[ match-all | match-any ] class_map_name
Example:
hostname(config)# class-map type inspect
http http_traffic
hostname(config-cmap)#
Creates an inspection class map, where the application is the
application you want to inspect. For supported applications, see
the CLI help for a list of supported applications or see
Chapter 1,
“Getting Started with Application Layer Protocol Inspection.”
The class_map_name argument is the name of the class map up to
40 characters in length.
The match-all keyword is the default, and specifies that traffic
must match all criteria to match the class map.
The match-any keyword specifies that the traffic matches the
class map if it matches at least one of the criteria.
The CLI enters class-map configuration mode, where you can
enter one or more
match commands.
Step 3
(Optional)
description string
Example:
hostname(config-cmap)# description All UDP
traffic
Adds a description to the class map.
Step 4
Define the traffic to include in the class by
entering one or more
match commands available
for your application.
To specify traffic that should not match the class map, use the
match not command. For example, if the match not command
specifies the string “example.com,” then any traffic that includes
“example.com” does not match the class map.
To see the match commands available for each application, see
the appropriate inspection chapter.