Cisco Systems ASA 5580 Manual De Usuario

Descargar
Página de 712
 
9-7
Cisco ASA Series Firewall CLI Configuration Guide
 
Chapter 9      Getting Started with Application Layer Protocol Inspection
  Configuring Application Layer Protocol Inspection
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
 parameters
message-length maximum client auto
message-length maximum 512
dns-guard
protocol-enforcement
nat-rewrite
policy-map global_policy
 class inspection_default
inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225 _default_h323_map
  inspect h323 ras _default_h323_map
  inspect ip-options _default_ip_options_map
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp _default_esmtp_map
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
Configuring Application Layer Protocol Inspection
This feature uses Modular Policy Framework to create a service policy. Service policies provide a 
consistent and flexible way to configure ASA features. For example, you can use a service policy to 
create a timeout configuration that is specific to a particular TCP application, as opposed to one that 
applies to all TCP applications. See 
 for more information. For some applications, you can perform special actions when you 
enable inspection. See 
for more information.
Inspection is enabled by default for some applications. See the 
 
section for more information. Use this section to modify your inspection policy.
Detailed Steps
Step 1
To identify the traffic to which you want to apply inspections, add either a Layer 3/4 class map for 
through traffic or a Layer 3/4 class map for management traffic. See the 
 and 
 for detailed information. The management Layer 3/4 class map can be used 
only with the RADIUS accounting inspection.
The default Layer 3/4 class map for through traffic is called “inspection_default.” It matches traffic using 
a special match command, match default-inspection-traffic, to match the default ports for each 
application protocol. This traffic class (along with match any, which is not typically used for inspection) 
matches both IPv4 and IPv6 traffic for inspections that support IPv6. See the 
 for a list of IPv6-enabled inspections.