Cisco ASA 5512-X, Configuration Manual

Page: 22 / 422

1-16
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 1 Service Policy Using the Modular Policy Framework
Configure Service Policies
Procedure
Step 1
Create a management class map, where class_map_name is a string up to 40 characters in length.
class-map type management class_map_name
The name “class-default” is reserved. All types of class maps use the same name space, so you cannot
reuse a name already used by another type of class map. The CLI enters class-map configuration mode.
Example:
hostname(config)# class-map all_udp
Step 2 (Optional) Add a description to the class map.
description string
Example:
hostname(config-cmap)# description All UDP traffic
Step 3
Match traffic using one of the following commands.
•
match access-list access_list_name —Matches traffic specified by an extended ACL. If the ASA is
operating in transparent firewall mode, you can use an EtherType ACL.
hostname(config-cmap)# match access-list udp
•
match port { tcp | udp } { eq port_num | range port_num port_num }—Matches TCP or UDP
destination ports, either a single port or a contiguous range of ports. For applications that use
multiple, non-contiguous ports, use the
match access-list command and define an ACE to match
each port.
hostname(config-cmap)# match tcp eq 80
Define Actions (Layer 3/4 Policy Map)
After you configure Layer 3/4 class maps to identify traffic, use a Layer 3/4 policy map to associate
actions to those classes.
Tip
The maximum number of policy maps is 64, but you can only apply one policy map per interface.
Procedure
Step 1 Add the policy map.
policy-map policy_map_name
The policy_map_name argument is the name of the policy map, up to 40 characters in length. All types
of policy maps use the same name space, so you cannot reuse a name already used by another type of
policy map. The CLI enters policy-map configuration mode.
Example:
hostname(config)# policy-map global_policy