Cisco ASA 5508-X, Configuration Manual

Page: 243 / 428

11-9
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 11 Service Policy Using the Modular Policy Framework
Defaults for Service Policies
•
You can only assign one policy map per interface. However you can create up to 64 policy maps in
the configuration.
• You can apply the same policy map to multiple interfaces.
•
You can identify up to 63 Layer 3/4 class maps in a Layer 3/4 policy map.
• For each class map, you can assign multiple actions from one or more feature types, if supported.
See
Incompatibility of Certain Feature Actions, page 11-6 .
Service Policy Guidelines
• Interface service policies take precedence over the global service policy for a given feature. For
example, if you have a global policy with FTP inspection, and an interface policy with TCP
normalization, then both FTP inspection and TCP normalization are applied to the interface.
However, if you have a global policy with FTP inspection, and an interface policy with FTP
inspection, then only the interface policy FTP inspection is applied to that interface.
•
You can only apply one global policy. For example, you cannot create a global policy that includes
feature set 1, and a separate global policy that includes feature set 2. All features must be included
in a single policy.
• When you make service policy changes to the configuration, all new connections use the new service
policy. Existing connections continue to use the policy that was configured at the time of the
connection establishment. Output for the
show command will not include data about the old
connections.
For example, if you remove a QoS service policy from an interface, then add a modified version,
then the
show service-policy command only displays QoS counters associated with new
connections that match the new service policy; existing connections on the old policy no longer
show in the command output.
To ensure that all connections use the new policy, you need to disconnect the current connections so
they can reconnect using the new policy. Use the
clear conn or clear local-host commands.
Defaults for Service Policies
The following topics describe the default settings for service policies and the Modular Policy
Framework:
•
Default Service Policy Configuration, page 11-9
•
Default Class Maps (Traffic Classes), page 11-10
Default Service Policy Configuration
By default, the configuration includes a policy that matches all default application inspection traffic and
applies certain inspections to the traffic on all interfaces (a global policy). Not all inspections are enabled
by default. You can only apply one global policy, so if you want to alter the global policy, you need to
either edit the default policy or disable it and apply a new one. (An interface policy overrides the global
policy for a particular feature.)
The default policy includes the following application inspections:
•
DNS
•
FTP