Cisco ASA 5512-X, Руководство по настройке

Страница: 30 / 422

2-2
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Special Actions for Application Inspections (Inspection Policy Map)
Guidelines and Limitations
•
Parameters—Parameters affect the behavior of the inspection engine.
Guidelines and Limitations
•
HTTP inspection policy maps—If you modify an in-use HTTP inspection policy map ( policy-map
type inspect http ), you must remove and reapply the inspect http map action for the changes to
take effect. For example, if you modify the “http-map” inspection policy map, you must remove and
readd the
inspect http http-map command from the layer 3/4 policy:
hostname(config)# policy-map test
hostname(config-pmap)# class http
hostname(config-pmap-c)#
no inspect http http-map
hostname(config-pmap-c)# inspect http http-map
• All inspection policy maps—If you want to exchange an in-use inspection policy map for a different
map name, you must remove the
inspect protocol map command, and readd it with the new map.
For example:
hostname(config)# policy-map test
hostname(config-pmap)# class sip
hostname(config-pmap-c)# no inspect sip sip-map1
hostname(config-pmap-c)# inspect sip sip-map2
•
You can specify multiple class or match commands in the inspection policy map.
If a packet matches multiple different match or class commands, then the order in which the ASA
applies the actions is determined by internal ASA rules, and not by the order they are added to the
inspection policy map. The internal rules are determined by the application type and the logical
progression of parsing a packet, and are not user-configurable. For example for HTTP traffic,
parsing a Request Method field precedes parsing the Header Host Length field; an action for the
Request Method field occurs before the action for the Header Host Length field. For example, the
following match commands can be entered in any order, but the
match request method get
command is matched first.
match request header host length gt 100
reset
match request method get
log
If an action drops a packet, then no further actions are performed in the inspection policy map. For
example, if the first action is to reset the connection, then it will never match any further
match or
class commands. If the first action is to log the packet, then a second action, such as resetting the
connection, can occur.
If a packet matches multiple match or class commands that are the same, then they are matched in
the order they appear in the policy map. For example, for a packet with the header length of 1001,
it will match the first command below, and be logged, and then will match the second command and
be reset. If you reverse the order of the two
match commands, then the packet will be dropped and
the connection reset before it can match the second match command; it will never be logged.
match request header length gt 100
log
match request header length gt 1000
reset
A class map is determined to be the same type as another class map or match command based on
the lowest priority match command in the class map (the priority is based on the internal rules). If
a class map has the same type of lowest priority match command as another class map, then the class