2-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 2 Special Actions for Application Inspections (Inspection Policy Map)
Identifying Traffic in an Inspection Class Map
Detailed Steps
Examples
The following example creates an HTTP class map that must match all criteria:
hostname(config-cmap)#
class-map type inspect http match-all http-traffic
hostname(config-cmap)#
match req-resp content-type mismatch
hostname(config-cmap)#
match request body length gt 1000
hostname(config-cmap)#
match not request uri regex class URLs
The following example creates an HTTP class map that can match any of the criteria:
hostname(config-cmap)#
class-map type inspect http match-any monitor-http
hostname(config-cmap)#
match request method get
hostname(config-cmap)#
match request method put
hostname(config-cmap)#
match request method post
Command
Purpose
Step 1
(Optional)
Create a regular expression.
See the general operations configuration guide.
Step 2
class-map type
inspect
application
[
match-all
|
match-any
]
class_map_name
Example:
hostname(config)# class-map type inspect
http http_traffic
hostname(config-cmap)#
Creates an inspection class map, where the
application
is the
application you want to inspect. For supported applications, see
the CLI help for a list of supported applications or see
“Getting Started with Application Layer Protocol Inspection.”
The
class_map_name
argument
is the name of the class map up to
40 characters in length.
The
match-all
keyword is the default, and specifies that traffic
must match all criteria to match the class map.
The
match-any
keyword specifies that the traffic matches the
class map if it matches at least one of the criteria.
The CLI enters class-map configuration mode, where you can
enter one or more
match
commands.
Step 3
(Optional)
description
string
Example:
hostname(config-cmap)# description All UDP
traffic
Adds a description to the class map.
Step 4
Define the traffic to include in the class by
entering one or more
match
commands available
for your application.
To specify traffic that should not match the class map, use the
match not
command. For example, if the
match not
command
specifies the string “example.com,” then any traffic that includes
“example.com” does not match the class map.
To see the
match
commands available for each application, see
the appropriate inspection chapter.
Содержание ASA 5512-X
Страница 5: ...P A R T 1 Service Policies and Access Control ...
Страница 6: ......
Страница 50: ...3 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 3 Access Rules History for Access Rules ...
Страница 51: ...P A R T 2 Network Address Translation ...
Страница 52: ......
Страница 126: ...5 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 5 NAT Examples and Reference DNS and NAT ...
Страница 127: ...P A R T 3 Application Inspection ...
Страница 128: ......
Страница 255: ...P A R T 4 Connection Settings and Quality of Service ...
Страница 256: ......
Страница 288: ...12 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 12 Quality of Service History for QoS ...
Страница 303: ...P A R T 5 Advanced Network Protection ...
Страница 304: ......
Страница 339: ...P A R T 6 ASA Modules ...
Страница 340: ......
Страница 398: ...17 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 17 ASA CX Module History for the ASA CX Module ...