Cisco ASA 5508-X, Configuration Manual

Page: 389 / 428

16-9
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 16 Connection Settings
Configure Connection Settings
The URG flag is used to indicate that the packet contains information that is of higher priority than
other data within the stream. The TCP RFC is vague about the exact interpretation of the URG flag,
therefore end systems handle urgent offsets in different ways, which may make the end system
vulnerable to attacks.
• window-variation { allow | drop }—Allow or drop a connection that has changed its window size
unexpectedly. The default is to allow the connection.
The window size mechanism allows TCP to advertise a large window and to subsequently advertise
a much smaller window without having accepted too much data. From the TCP specification,
“shrinking the window” is strongly discouraged. When this condition is detected, the connection can
be dropped.
Step 3 Apply the TCP map to a traffic class using a service policy.
a.
Define the traffic class with an L3/L4 class map and add the map to a policy map.
class-map name
match parameter
policy-map
name
class name
Example:
hostname(config)# class-map normalization
hostname(config-cmap)# match any
hostname(config)# policy-map global_policy
hostname(config-pmap)# class normalization
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If
you want to edit the global_policy, enter global_policy as the policy name. For information on
matching statements for class maps, see
Identify Traffic (Layer 3/4 Class Maps), page 11-13 .
b. Apply the TCP map.
set connection advanced-options tcp-map-name
Example:
hostname(config-pmap-c)# set connection advanced-options tcp_map1
c.
If you are editing an existing service policy (such as the default global policy called global_policy),
you are done. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name { global | interface interface_name }
Example:
hostname(config)# service-policy global_policy global
The global keyword applies the policy map to all interfaces, and interface applies the policy to one
interface. Only one global policy is allowed. You can override the global policy on an interface by
applying a service policy to that interface. You can only apply one policy map to each interface.
Examples
For example, to allow urgent flag and urgent offset packets for all traffic sent to the range of TCP ports
between the well known FTP data port and the Telnet port, enter the following commands:
hostname(config)# tcp-map tmap
hostname(config-tcp-map)# urgent-flag allow
hostname(config-tcp-map)# class-map urg-class
hostname(config-cmap)# match port tcp range ftp-data telnet