Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1141 / 2164

1-35
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Inspection of Basic Internet Protocols
TFTP Inspection
The log keyword, which you can use alone or with one of the other keywords, sends a system log
message.
The rate-limit message_rate argument limits the rate of messages.
You can specify multiple class or match commands in the policy map. For information about the order
of class and match commands, see the “Defining Actions in an Inspection Policy Map” section on
page 1-4 .
Step 6
To configure parameters that affect the inspection engine, perform the following steps:
a.
To enter parameters configuration mode, enter the following command:
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
b.
To configure a local domain name, enter the following command:
hostname(config-pmap-p)# mail-relay domain-name action [ drop-connection | log ]]
Where the drop-connection action closes the connection. The log action sends a system log
message when this policy map matches traffic.
c.
To enforce banner obfuscation, enter the following command:
hostname(config-pmap-p)# mask-banner
The following example shows how to define an ESMTP inspection policy map.
hostname(config)# regex user1 “user1@cisco.com”
hostname(config)# regex user2 “user2@cisco.com”
hostname(config)# regex user3 “user3@cisco.com”
hostname(config)# class-map type regex senders_black_list
hostname(config-cmap)# description “Regular expressions to filter out undesired senders”
hostname(config-cmap)# match regex user1
hostname(config-cmap)# match regex user2
hostname(config-cmap)# match regex user3
hostname(config)# policy-map type inspect esmtp advanced_esmtp_map
hostname(config-pmap)# match sender-address regex class senders_black_list
hostname(config-pmap-c)# drop-connection log
hostname(config)# policy-map outside_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect esmtp advanced_esmtp_map
hostname(config)# service-policy outside_policy interface outside
TFTP Inspection
TFTP inspection is enabled by default.
TFTP, described in RFC 1350, is a simple protocol to read and write files between a TFTP server and
client.
The ASA inspects TFTP traffic and dynamically creates connections and translations, if necessary, to
permit file transfer between a TFTP client and server. Specifically, the inspection engine inspects TFTP
read request (RRQ), write request (WRQ), and error notification (ERROR).